Privacy policy.

1. Who is responsible for your data

Chillz is the data controller for the personal data collected through chillz.club.

Contact for any privacy question or request: contact@emmanuellevandepitterie.com.

2. What we collect

Depending on how you use the site, we may collect:

• Identity & contact data: first name, last name, email, phone/WhatsApp number, country of residence, age or age range.
• Application data: the answers you give in the application or waitlist questionnaire (interests, professional situation, faith or denomination when the edition is faith-based, expectations, date preferences, room preference, dietary needs).
• Booking data: chosen edition, room type, payment plan, order history and invoices.
• Payment data: processed directly by our payment provider. We never see or store your full card number.
• Technical data: IP address, browser type, pages viewed, and language/currency preference stored locally in your browser.

3. Sensitive data (faith, health)

Some editions are faith-based, and the application asks about your denomination or spiritual life. Under GDPR this is sensitive data (religious beliefs). We process it only with your explicit consent, given when you voluntarily submit the application, and only to assess whether the edition is a fit for you and to build a coherent group.

Dietary requirements or allergies you share with us are used exclusively to keep you safe and well fed during the stay, and are shared only with the venue concerned.

You can withdraw your consent at any time by writing to us; we then delete the related answers.

4. Why we use it, and on what legal basis

Each purpose has a legal basis under Article 6 GDPR:

• Reviewing your application and curating the group — legitimate interest, and explicit consent for sensitive answers.
• Managing your booking, payments, installments and invoices — performance of a contract.
• Sending you operational emails (confirmation, practical info, WhatsApp group invitation) — performance of a contract.
• Sending you news about future editions — consent, withdrawable at any time via the unsubscribe link.
• Keeping accounting records and handling disputes — legal obligation and legitimate interest.
• Measuring audience and improving the site — legitimate interest, using aggregated data.

5. Who processes your data with us

We only share what's strictly necessary, with providers acting as processors under contract:

• Our hosting and database provider, which stores applications and bookings.
• Stripe, for payment processing.
• Our transactional email provider, to send confirmations and notifications.
• The hotel or resort hosting your edition, for rooming, meals and dietary needs only.
• An AI provider, used to help summarise application answers into internal tags for some editions. Answers are not used to train third-party models.

6. International transfers

Some of our providers are located outside the European Economic Area (notably in the United States). When that happens, transfers are covered by the European Commission's Standard Contractual Clauses or an equivalent adequacy mechanism.

Editions take place in Thailand, so the data strictly required for your stay (name, room, dietary needs) is transmitted to the hosting venue there.

7. How long we keep it

Applications that are not accepted: up to 12 months, then deleted.

Guest and booking data: for the duration of the relationship, then archived for the legal accounting period (up to 10 years for invoices).

Marketing consent data: 3 years after your last interaction with us.

Technical logs: up to 12 months.

8. Cookies and local storage

We use only what the site needs to work: local storage for your language and currency preference, and a session cookie for payment and security. We do not run advertising cookies or third-party ad trackers.

You can clear this data at any time from your browser settings.

9. Your rights

Under GDPR you can, at any time:

• Access the data we hold about you and get a copy.
• Correct anything inaccurate or incomplete.
• Ask for deletion, when no legal obligation requires us to keep it.
• Restrict or object to a processing based on legitimate interest.
• Receive your data in a portable, machine-readable format.
• Withdraw your consent at any time, without affecting past processing.

10. How to exercise them

Write to contact@emmanuellevandepitterie.com with your request. We reply within one month. If our answer doesn't satisfy you, you can lodge a complaint with your national data protection authority (in France, the CNIL).

11. Security

Data is stored on secured servers with encrypted connections, access restricted to the people who need it, and payment handled entirely by a PCI-DSS compliant provider.

12. Minors

Chillz editions are for adults. We do not knowingly collect data from anyone under 18. Children accompanying a guest (Kids Care) are registered by their parent, who provides only what the service requires.

13. Changes

We may update this policy. The date at the top always reflects the current version, and material changes are communicated by email to active guests.