GDPR Policy.

1. Introduction.
 
This GDPR Policy aims to inform users of the Bora Bora Zen Massage website about how their personal data is collected, processed, and protected in accordance with Regulation (EU) 2016/679 of April 27, 2016 (GDPR) and applicable French legislation.
 
2. Data Controller.
 
The data controller is: Caroline Le Carpentier
Address: Bora Bora, Polynésie française
Email: boraborazenmassage@gmail.com
Phone: +689 87 35 34 03
 
3. Data Collected.
 
As part of its activity, Bora Bora Zen Massage may collect the following data:
 

• Identification details: name, surname, phone number, email address.

• Information required for booking a massage (date, time, preferences).

• Browsing data (cookies, analytics tools such as Google Analytics).
   

No sensitive data is collected without your explicit consent.
 
4. Purpose of Processing.
 
Personal data collected is used for the following purposes:
 

• Managing contact and booking requests.

• Providing services (organization of massages).

• Communicating with clients (confirmation, follow-up, appointment reminders).

• Improving user experience and service quality.

• Producing anonymized traffic statistics.

5. Legal Basis for Processing.
 
Data processing is based on:
 

• Your consent (contact forms, cookies).

• Performance of a contract (massage booking).

• Compliance with legal obligations (invoicing, data retention).

6. Data Retention.
 

• Data from forms: kept for up to 3 years after the last contact.

• Invoicing-related data: kept for the statutory accounting retention period.

• Browsing data (cookies): variable depending on browser settings (maximum 13 months in general).

7. Data Recipients.
 
Data is intended exclusively for Bora Bora Zen Massage.

It may be processed by technical providers (Wix hosting, analytics tools) strictly for the purposes described and in compliance with GDPR.
 
8. Data Security.
 
All necessary technical and organizational measures are implemented to protect your personal data against loss, unauthorized access, disclosure, alteration, or destruction.
 
9. Your Rights.
 
In accordance with GDPR, you have the following rights:
 

• Right of access: obtain a copy of the data held.

• Right to rectification: correct inaccurate data.

• Right to erasure: request the deletion of your data.

• Right to object: refuse certain processing activities (e.g., marketing).

• Right to restriction: temporarily limit the use of your data.

• Right to data portability: receive your data in a structured format.

To exercise your rights, please contact us at: boraborazenmassage@gmail.com
 
10. Data Transfers Outside the EU.
 
The website and data hosting are provided by Wix (Israel).

According to the European Commission’s adequacy decision, Israel ensures an adequate level of protection for personal data.
 
11. Cookies and Consent.
 
The website uses cookies to:
 

• Improve browsing experience.

• Measure audience and performance.

• Personalize user experience.

When you first visit the site, a banner informs you of their use and allows you to accept, refuse, or customize your preferences.
 
12. Complaints.
 
If you believe your rights are not being respected, you may lodge a complaint with the CNIL (Commission Nationale de l’Informatique et des Libertés): www.cnil.fr.
 
13. Governing Law and Jurisdiction.
 
This GDPR Policy is governed by French law. In the event of a dispute, exclusive jurisdiction is granted to the courts of French Polynesia.