Privacy Policy

1. Data controller

Laura Osorio, trading as Vague des Sens.

SIRET: 881 803 837 00031 — 19 Cours Sablon, 63000 Clermont-Ferrand, France.

Contact: contact@vaguedessens.fr

2. Data collected

When booking online: first name, last name, email address, phone number, any comments (contraindications, expectations).

When purchasing a gift card: purchaser's email address, recipient's first name and email address (optional), personalised message (optional).

During payment: Stripe Inc. collects card details directly — no card data ever passes through Vague des Sens' servers.

Data relating to card guarantee holds (for late-cancellation/no-show protection) is processed exclusively by Stripe and deleted once the hold is released.

Date of birth (optional): a date of birth may be added to your client file with your express verbal consent, collected by Laura Osorio during an appointment. This data is never collected via the online booking flow.

3. Purposes and legal bases

Appointment management, confirmation and session reminders — legal basis: performance of the contract (Article 6.1.b GDPR).

Sending transactional emails (confirmation, gift card, cancellation) — legal basis: performance of the contract (Article 6.1.b GDPR).

Gift card management and invoicing — legal basis: performance of the contract and legal obligation (Article 6.1.b and 6.1.c GDPR).

Managing the card guarantee hold (preventing no-shows and late cancellations) — legal basis: performance of the service contract (Article 6.1.b GDPR), the hold being a condition of the online booking.

Sending a birthday email with a personalised promotional offer (15% discount code valid for 1 month on your next treatment) — legal basis: consent (Article 6.1.a GDPR), collected verbally by Laura Osorio at the salon. You may withdraw this consent at any time via the unsubscribe link included in every birthday email, or by writing to contact@vaguedessens.fr. Withdrawing consent results in the immediate deletion of your date of birth.

4. Data recipients

Your data is processed by the following technical subcontractors, strictly within the scope of their functions:

• Stripe Inc. (Palo Alto, CA, USA) — secure payment processing. PCI-DSS level 1 certified.

• Resend Inc. (San Francisco, CA, USA) — transactional email delivery.

• Neon Inc. — database hosting (Frankfurt region, European Union).

• Vercel Inc. (Covina, CA, USA) — website hosting, serverless functions and anonymised audience measurement (Vercel Web Analytics and Speed Insights, cookie-free).

• Sentry (San Francisco, CA, USA) — technical error monitoring. Only technical data (browser type, operating system, error traces) is transmitted; no identifiable personal data is collected for monitoring purposes.

No data is sold, rented or transferred to third parties for commercial or advertising purposes.

5. Transfers outside the European Union

Stripe, Resend, Vercel and Sentry are US companies. Data transfers to the United States are governed by the standard contractual clauses adopted by the European Commission (Article 46.2.c GDPR) and, where applicable, the EU-U.S. Data Privacy Framework, which guarantee an adequate level of protection.

Data hosted on Neon remains within the European Union (Frankfurt region, Germany).

6. Retention period

Client data and booking history: retained for 3 years from the last appointment or purchase, then deleted or anonymised.

Invoicing data and accounting records: retained for 10 years in accordance with Article L.123-22 of the French Commercial Code.

Card guarantee holds: released and deleted after the service is performed, except in the event of a no-show charge (retained for as long as needed to manage any resulting dispute).

7. Your rights

In accordance with the GDPR and the French Data Protection Act, you have the following rights:

• Right of access: obtain confirmation that your data is being processed and receive a copy of it.

• Right of rectification: have inaccurate or incomplete data corrected.

• Right to erasure ("right to be forgotten"): request the deletion of your data within the legal limits.

• Right to restriction of processing: request that processing be temporarily suspended.

• Right to data portability: receive your data in a structured, machine-readable format.

• Right to object: object to processing based on legitimate interest.

To exercise these rights, send your request by email to contact@vaguedessens.fr with a copy of proof of identity. You will receive a response within a maximum of 30 days (Article 12 GDPR).

You also have the right to lodge a complaint with the CNIL — Commission Nationale de l'Informatique et des Libertés, 3 Place de Fontenoy, 75007 Paris — www.cnil.fr

8. Cookies and trackers

The vaguedessens.fr website uses only cookies strictly necessary for the service to function:

• Admin area authentication cookie (JWT — secure session).

• User session cookie for the booking flow to work correctly.

These cookies are exempt from prior consent requirements in accordance with CNIL recommendations (deliberation No. 2020-091 of 17 September 2020).

No advertising, profiling, social media or behavioural tracking cookies are placed on your device.

Audience measurement: the website uses Vercel Web Analytics and Vercel Speed Insights to measure traffic and performance. These tools place no cookies, collect no identifiable personal data, and do not allow cross-site tracking. The data collected (pages viewed, country of origin, browser type, performance metrics) is aggregated and anonymous.

9. Data security

Vague des Sens implements appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction or disclosure:

• Encryption of all communications via HTTPS/TLS (provided by Vercel CDN).

• Database hosted within the European Union with restricted access.

• No card data stored on Vague des Sens' servers — fully processed by Stripe (PCI-DSS level 1).

• Access to the admin area protected by secure authentication.

10. Changes to this policy

This privacy policy may be updated to reflect legal, regulatory or technical changes. The date of the last update is shown at the bottom of the page.

In the event of a substantial change, active clients will be notified by email.