1. Who we are
The data controller is Showtrailscoutshelf SAS, a simplified joint-stock company registered in Paris under number RCS Paris 902 445 118, with its registered office at 27 Rue de Bretagne, 75003 Paris, France. You can reach us at [email protected]. Our Data Protection Officer can be contacted directly at [email protected] or by post at the address above, marked "DPO".
2. Data we collect
We collect only what is needed to run a café and a website. Depending on how you interact with us, this may include:
- Contact and booking data — name, email address, telephone number, party size, preferred date and time, and any dietary or accessibility notes you choose to give us.
- Event enquiry data — the above plus company name, invoicing address and payment confirmation for deposits.
- Payment card details for weekend reservation guarantees, which are handled entirely by our payment processor; we never see or store full card numbers.
- Technical data — IP address, browser type, pages visited and referring page, collected through server logs and, only with your consent, an analytics cookie.
- Correspondence — the content of emails or form messages you send us.
We do not knowingly collect data from children under 15, and we do not collect special-category data beyond the dietary or accessibility information you volunteer, which we use solely to serve you and delete after your visit.
3. How and why we use it
Under the EU General Data Protection Regulation (GDPR) and the French Data Protection Act, every use needs a legal basis. Ours are:
- Performance of a contract — taking, confirming and honouring reservations, pre-orders and event bookings, and processing deposits or no-show fees.
- Legitimate interests — keeping the website secure, preventing fraud, responding to enquiries, and keeping basic server logs for 30 days.
- Consent — analytics cookies, functional cookies and any marketing email, each of which you can withdraw at any time.
- Legal obligation — retaining invoices and accounting records as French commercial law requires.
We do not sell personal data, and we do not use it for automated decision-making or profiling.
4. Cookies
This site sets one essential item in local storage to remember your cookie choice, and, only if you accept, analytics and functional cookies. The full list, with names, purposes and lifetimes, is in our cookie policy, which also explains how to change your mind.
5. Third-party processors
We share data only with service providers who process it on our instructions under written agreements:
- Web hosting — a French cloud provider with data centres in Gravelines and Strasbourg, France.
- Reservations — a French restaurant booking platform that stores booking records within the European Union.
- Payments — Stripe Payments Europe Ltd (Ireland), for reservation guarantees and event deposits.
- Email — a French transactional email provider, for booking confirmations and replies to your enquiries.
- Analytics — a self-hosted Matomo instance on our own French server; no data is sent to an outside analytics company.
Where a provider is located outside the EU/EEA, transfers rely on the European Commission's Standard Contractual Clauses. We will name any provider on request.
6. How long we keep data
- Reservation records: 12 months after the booking date, then deleted or anonymised.
- Event contracts and invoices: 10 years, as required by the French Commercial Code.
- Enquiry emails: 24 months from the last exchange.
- Server logs: 30 days.
- Analytics data: 13 months, aggregated and IP-truncated.
- Dietary and accessibility notes: deleted within 7 days of your visit.
7. Your rights
Under the GDPR you may ask us to access, correct, erase or restrict the processing of your data; to receive it in a portable format; and to object to processing based on legitimate interests. Where processing is based on consent, you may withdraw that consent at any time without affecting earlier processing. You also have the right to give instructions about your data after your death, under French law.
If you are a California resident, the California Consumer Privacy Act (CCPA) gives you the right to know what personal information we collect, to request its deletion, to opt out of any sale (we do not sell data), and not to be discriminated against for exercising these rights.
To exercise any right, write to [email protected]. We respond within one month, and we may ask you to verify your identity first. You also have the right to lodge a complaint with the French supervisory authority, the CNIL, at cnil.fr, or with your local data protection authority.
8. Security
Data is transmitted over TLS, stored on access-controlled servers within the EU, and accessible only to staff who need it to do their jobs. Payment card data never touches our systems. If a breach ever affected your rights, we would notify you and the CNIL within 72 hours of becoming aware of it.
9. Changes to this policy
We review this policy annually and whenever our processing changes. The effective date at the top of the page tells you which version you are reading; material changes will be flagged on the home page for 30 days.