Velaya Experience Privacy Policy

Last updated: October 29th 2025

Preamble

This privacy policy (the Privacy Policy) explains how Velaya Experience (hereinafter Velaya Experience, We, Us, Our) collects and processes personal data in connection with the website available at www.velayaexperience.com (the Website) and the services We provide through it (the Services).

Velaya Experience is a company registered with the Companies Registry under number _______ whose registered office is located at __________.

Personal data means any information relating to an identified or identifiable natural person (Personal Data).

We comply with all applicable data protection laws, in particular the General Data Protection Regulation 2016/679 (GDPR) and the French Data Protection Act of 6 January 1978 as amended.

1. What Personal Data do We collect

Depending on Your use of the Website and Our Services, We may collect the following Personal Data:

• identity data such as first name, last name, title
• contact data such as email address, telephone number, postal address
• information relating to Your booking or stay request such as travel dates, number of guests, preferences
• communication data such as messages exchanged with Our concierge team
• technical and browsing data such as IP address, device type, browser, pages visited, cookies
• payment related data such as transaction identifiers and the last digits and expiry date of a payment card, processed via secure payment providers
• any information You choose to share with Us when using the Website or Our Services

In some cases We may collect information about other persons for whom You make a booking or stay request. You must ensure that these persons are informed and agree that You share their information with Us.

2. Cookies

2.1 What are cookies

Cookies are small text files stored in Your browser when You visit the Website. They allow the Website to recognise Your device, remember Your preferences and improve Your browsing experience.

2.2 How We use cookies

We may use cookies and similar technologies in particular in order to:

• enable the proper functioning and security of the Website
• measure audience and understand how the Website is used
• improve Our Services and content

When required by law, We obtain Your consent before depositing non essential cookies. You can withdraw Your consent at any time.

2.3 Cookie choices

When You first visit the Website a cookie banner allows You to accept, refuse or personalise the use of cookies. You can change Your choices at any time via the cookie settings available on the Website or through Your browser settings.

3. How We collect Your Personal Data

We may collect Personal Data directly from You when You:

• browse the Website
• submit a request for information, a villa request or a stay request
• communicate with Our teams by email, telephone or messaging applications

We may also receive Personal Data from trusted partners that help Us provide the Services, in compliance with applicable law.

4. Legal bases for processing

We process Your Personal Data on the following legal bases:

• performance of a contract or pre contractual measures for managing Your booking or stay request and providing the Services You request
• Our legitimate interests for managing the Website, improving Our Services, protecting Our rights and preventing fraud
• compliance with Our legal and regulatory obligations such as accounting or tax obligations
• Your consent when this is required by law, in particular for certain cookies and for receiving Our marketing communications

5. Who receives Your Personal Data

Your Personal Data may be shared only with:

• the internal teams of Velaya Experience that need it to fulfil their duties
• technical and service providers acting as processors such as hosting providers, secure payment providers, email and messaging providers and tools for managing customer requests
• partners involved in the organisation of Your stay such as villa owners or local service providers where this is necessary for the execution of the Services
• public authorities or regulators when required by law or in the context of legal proceedings

In all cases We ensure that access to Your Personal Data is limited to what is strictly necessary and that appropriate contractual safeguards are in place.

6. International transfers

Some of Our service providers or partners may be located outside the European Economic Area. In this case We ensure that appropriate safeguards are implemented in accordance with the GDPR, such as an adequacy decision of the European Commission or the use of standard contractual clauses.

7. How We protect Your Personal Data

We implement technical and organisational security measures to protect Your Personal Data against unauthorised access, loss, misuse, alteration or disclosure.

However no system is fully secure. If You believe that Your interaction with Us is no longer secure please contact Us immediately using the contact details set out below.

8. Retention periods

We retain Your Personal Data only for as long as necessary for the purposes described in this Privacy Policy and in order to comply with Our legal obligations.

In particular, subject to applicable limitation periods:

• prospects and simple contact requests are retained for up to three years from the last contact with You
• data relating to a booking or stay may be retained for up to ten years from the end of the contractual relationship where required by law
• cookies are retained for the period indicated in the cookie settings panel

At the end of the relevant retention periods Your Personal Data is deleted or anonymised unless it must be kept longer for the establishment, exercise or defence of legal claims.

9. Your rights

In accordance with applicable law You have the following rights with respect to Your Personal Data:

• right of access to obtain confirmation that We process Your data and a copy of it
• right to rectification of inaccurate or incomplete data
• right to erasure in certain cases
• right to restriction of processing in certain cases
• right to data portability for data You have provided to Us when processing is based on consent or on a contract and carried out by automated means
• right to object at any time to processing based on Our legitimate interests and to processing for marketing purposes
• right to withdraw Your consent at any time where processing is based on consent
• where applicable, right to define instructions on the use of Your data after Your death

10. How to contact Us

To ask a question or exercise Your rights You can contact Us by email at contact@velayaexperience.com.

We may ask You for additional information to verify Your identity. Your request will be processed within the time limits set by applicable regulations.

If You consider that Your rights have not been respected You also have the right to lodge a complaint with the competent data protection authority and in particular with the Commission Nationale Informatique et Libertés (CNIL) in France.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time for example to reflect changes in Our practices or in applicable law. Any changes will take effect as from the date indicated at the top of this page. We invite You to consult this Privacy Policy regularly.