Privacy policy

Data controller

Data we collect

We only collect the data you voluntarily send us through the contact form, namely:

• your first and last name;
• your email address;
• your telephone number;
• the subject and content of your message, including the dates of your planned stay.

Purpose and legal basis

This data is used solely to answer your request, prepare a stay proposal and, where applicable, manage your booking.

The legal basis for processing is your consent, given by voluntarily sending the form, and the performance of pre-contractual measures taken at your request (Article 6(1)(a) and (b) GDPR).

Recipients

Your data is processed by the team of Hôtel Châtelet Pétrusse. It is never sold, rented or transferred to third parties for commercial purposes.

Messages from the form are delivered by our technical provider Formspree (Formspree Inc., United States), acting as a processor. This transfer outside the European Union is covered by the European Commission's standard contractual clauses. You can read their privacy policy at formspree.io.

If you prefer not to use this provider, you can write to us directly at contact@chatelet.lu or call us.

Online booking takes place on the booking engine of our provider Lighthouse, which opens in a new tab. The data entered there is collected by that provider under its own privacy policy.

Cookies and local storage

A cookie is a small file placed by the site in your browser. This site sorts their use into three categories, which you control from the banner shown on your first visit:

• Necessary cookies — always on. They remember your cookie choice. Without them the banner would appear on every page.
• Audience measurement — with consent. Visit statistics that show which pages are viewed and help improve the site.
• Third-party content — with consent. External services embedded in the pages, such as the booking engine or a map, which may set their own cookies.

Until you give your consent, no audience measurement cookie and no third-party content is loaded. They stay blocked by default, including if you ignore the banner.

As of today, the site does not actually use any audience measurement tool. The only information kept is the chatelet_consent cookie, which stores your choice for twelve months. It does not identify you and is not shared with anyone.

The website's fonts are hosted on our own servers: displaying them does not send any data, including your IP address, to a third-party service.

The “Book” button opens our provider's booking engine in a new tab. That service has its own privacy policy and may set its own cookies, over which we have no control.

You can change your choice at any time, or delete this information by clearing your browser's site data.

Retention period

Messages received through the form are kept for as long as needed to handle your request, then archived for a maximum of three years from our last exchange. Data relating to an actual booking is kept for the legal accounting and tax retention periods.

Your rights

Under the GDPR, you have the following rights regarding your data:

• right of access and to obtain a copy;
• right to rectification of inaccurate data;
• right to erasure;
• right to restriction of processing;
• right to object;
• right to data portability;
• right to withdraw your consent at any time.

To exercise these rights, write to us at contact@chatelet.lu. If you believe your rights are not being respected, you may lodge a complaint with the National Commission for Data Protection (CNPD), 15, boulevard du Jazz, L-4370 Belvaux — cnpd.public.lu.

Security

The site is served over HTTPS and we apply reasonable measures to protect the data transmitted. As no system is infallible, please do not send us sensitive data (card numbers, identity documents) through the form.