Privacy policy

1. Controller

WEBCARE, société par actions simplifiée à associé unique (SASU) au capital de 100 €, RCS Paris 130 570 575 ("Kotlafet"), 47 rue Vivienne, 75002 Paris, France. For any question about your data: [email protected].

The provider you send a booking or quote request to is itself the controller of the processing it carries out to perform the rental.

2. Data processed

Customers: name, phone, email, company if any, event details (date, venue, number of guests, access, on-site contact), bookings and quotes, acceptance signature, declared payments, reviews.

Card guarantee: Kotlafet never receives your card number; Revolut sends us a card identifier, its last 4 digits and the result of operations.

Providers: users' identity and contact details, company information (BRN, address, bank and Juice details shown to customers), catalogue, bookings, recorded payments and proofs.

Technical data: server logs (IP address, date, page requested), kept for 14 days at most for security and abuse prevention.

3. Purposes and legal bases

Forwarding your requests and bookings to the provider, producing quotes, contracts and receipts, sending messages about your booking (contract or pre-contract steps); managing the card guarantee and late cancellation fees (contract); security, fraud prevention, internal statistics (legitimate interest); accounting and legal obligations (legal obligation).

No marketing message is sent without your consent. No commercial message is ever sent for a ceremony or remembrance gathering.

4. Recipients

The provider concerned by your booking; Revolut (payment provider) for the card guarantee; our technical processors: hosting (OVH, France), email delivery (SMTP relay), and WhatsApp (Meta) when you agreed to be contacted that way. Your data is never sold.

5. Transfers outside Mauritius and the EU

Data is hosted in France. Some providers (payment, messaging) may process data in other countries; such transfers rely on appropriate safeguards (standard contractual clauses, adequacy decisions), under the Data Protection Act 2017 and the GDPR.

6. Retention

Bookings, quotes and contracts: 5 years after the rental ends (limitation period), then archived or anonymised; accounting records: 7 years; unanswered quote requests: 2 years; provider accounts: length of the relationship then 5 years; technical logs: 14 days; uploaded payment proofs: length of the booking then 5 years.

7. Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability, and may withdraw consent at any time: [email protected]. We reply within one month.

You may contact the Mauritius Data Protection Office (dataprotection.govmu.org) or, if you live in the EU, the CNIL (cnil.fr) or your local authority.

8. Security

Encrypted connections (HTTPS), hashed passwords, access separated by provider, unguessable booking links, daily backups on a server in France, access logging.