Privacy Policy

1. Who we are and who controls your data

This website, lanternssunnyroster.com (the "Site"), is published and operated by Maison Lanterne Éditions SAS ("we", "us", "our"), a simplified joint-stock company registered in France under company number FR-892 447 013, with its registered office and editorial desk at 27 Rue des Archives, 75004 Paris, France.

For the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the French Loi Informatique et Libertés, Maison Lanterne Éditions SAS acts as the data controller for all personal data processed through the Site. Where we engage third parties to process data on our behalf, those parties act as processors under written agreements that satisfy Article 28 GDPR.

You may contact our Data Protection Officer at any time using the details in section 12.

2. The categories of data we collect

We deliberately collect as little personal data as possible. The Site has no user accounts, no login area, no shopping basket and no booking engine. The categories below represent the complete scope of our collection.

2.1 Data you give us voluntarily

• Enquiry form data — your full name, email address, optional telephone number, chosen subject, hotel of interest, planned travel month and the free-text content of your message.
• Direct correspondence — the content, headers and attachments of emails you send to any address at the lanternssunnyroster.com domain.
• Correction and press requests — where you identify yourself professionally, your organisation name and role.

2.2 Data collected automatically

• Technical server data — truncated IP address, user-agent string, requested URL, HTTP referrer, response code and timestamp, recorded in web server logs.
• Consent data — the choice you make in our cookie banner, stored in your browser's local storage together with the date of that choice.
• Analytics data — only if you consent: aggregated page views, session duration, reading depth, approximate country-level location and device category.

2.3 Data we never collect

We do not collect payment card data, passport or identity document data, health data, biometric data, precise geolocation, or any of the special categories of personal data defined in Article 9 GDPR. We do not knowingly collect data from children under sixteen.

3. Why we process your data and on what legal basis

Where we rely on legitimate interests, we have carried out a balancing assessment and concluded that our interest in operating a secure, accurate editorial publication does not override your rights and freedoms. You may request a summary of that assessment.

4. Cookies and similar tracking technologies

The Site uses a limited set of cookies and browser storage items. Strictly essential items are set without consent, as permitted by the ePrivacy Directive. Analytics and functional items are set only after you give an affirmative choice through the cookie banner. You may change or withdraw that choice at any time by clearing your browser storage for this domain and reloading the page, which will cause the banner to reappear.

A full, itemised breakdown — including cookie names, providers, purposes, durations and browser-by-browser opt-out instructions — is published in our Cookie Policy, which forms part of this Privacy Policy.

5. Third-party processors and recipients

We share personal data only where it is necessary to operate the Site. Our current processors and service providers are:

We do not sell personal data, we do not share it with advertising networks, and we do not operate any data broker relationships. Hotel operators referenced on this Site receive no data about you from us; following an outbound link places you under the privacy policy of that hotel's own website.

6. International transfers

Our primary infrastructure is located within the European Economic Area. Where a service provider processes data outside the EEA — principally the image and font delivery networks described above — the transfer is protected by the European Commission's Standard Contractual Clauses, supplemented where appropriate by technical measures such as transport encryption and IP truncation. You may request a copy of the relevant transfer mechanism documentation.

7. Data retention

• Enquiry form submissions and email correspondence — retained for twenty-four (24) months from the date of last contact, then deleted, unless the exchange forms part of an ongoing editorial or legal matter.
• Web server logs — retained for thirty (30) days in identifiable form, then aggregated or deleted.
• Analytics data — retained in aggregated, non-identifying form for twenty-six (26) months.
• Consent records — retained for twelve (12) months in your browser, and as an internal record for up to three (3) years to demonstrate compliance.
• Records required by law — retained for the statutory period applicable under French commercial and tax law.

8. Your rights under the GDPR

If you are located in the European Economic Area, the United Kingdom or Switzerland, you have the following rights in relation to your personal data:

• Right of access — to obtain confirmation of whether we process your data and a copy of it.
• Right to rectification — to have inaccurate or incomplete data corrected without undue delay.
• Right to erasure — to have your data deleted where one of the grounds in Article 17 applies.
• Right to restriction — to limit our processing in the circumstances set out in Article 18.
• Right to data portability — to receive data you provided in a structured, commonly used, machine-readable format.
• Right to object — to object at any time to processing based on legitimate interests.
• Right to withdraw consent — at any time, without affecting the lawfulness of prior processing.
• Right to lodge a complaint — with a supervisory authority; in France this is the Commission Nationale de l'Informatique et des Libertés (CNIL), 3 Place de Fontenoy, 75007 Paris.
• Right concerning automated decisions — we carry out no automated decision-making or profiling that produces legal effects.

To exercise any right, email [email protected] or write to the registered address. We respond within one calendar month, extendable by two further months for complex requests, in which case we will tell you within the first month. There is no charge unless a request is manifestly unfounded or excessive.

9. Your rights under the CCPA / CPRA

If you are a California resident, you have the right to know what categories of personal information we collect, the purposes for which they are used and the categories of third parties with whom they are shared; the right to request deletion; the right to request correction; the right to opt out of the "sale" or "sharing" of personal information; and the right not to receive discriminatory treatment for exercising these rights.

We do not and have never sold or shared personal information as those terms are defined under the CCPA and CPRA. We do not use personal information for cross-context behavioural advertising. To submit a request, contact [email protected] with the subject line "California Privacy Request". We verify requests by matching the email address used against our records, and authorised agents must supply written authorisation.

10. Security measures

We apply technical and organisational measures appropriate to the risk, including HTTPS/TLS encryption across the whole Site, HTTP strict transport security, a restrictive content security policy, regular dependency patching, principle-of-least-privilege access control for editorial staff, multi-factor authentication on all administrative accounts, encrypted backups held within the EEA, and an internal incident response procedure. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the CNIL within seventy-two hours and inform affected individuals where the risk is high.

11. Children's privacy

The Site is intended for an adult audience planning luxury travel. We do not knowingly collect personal data from anyone under the age of sixteen. If you believe a child has provided us with personal data, please contact the DPO and we will delete it promptly.

12. Contacting our Data Protection Officer

Our Data Protection Officer can be reached as follows:

• Email: [email protected]
• Post: Data Protection Officer, Maison Lanterne Éditions SAS, 27 Rue des Archives, 75004 Paris, France
• Telephone: +33 1 84 79 22 40 (Monday–Friday, 09:30–18:00 CET)

13. Changes to this policy

We review this policy at least annually and whenever our processing activities change materially. The version number and effective date at the top of this page are updated with every revision. Substantive changes are announced on the home page for thirty days. Continued use of the Site after the effective date constitutes acceptance of the revised policy.