Privacy policy

Data controller

[À COMPLÉTER : company name], [À COMPLÉTER : legal form], registered office at [À COMPLÉTER : registered address], operates the Le Rouge Pigalle website.

Privacy requests (access, rectification, deletion, objection, complaint): contact@lerougepigalle.fr.

Data processed

• Booking: first name, last name, email, phone, guest count, budget, payment data (via Stripe), reservation status.
• Entry ticket and cloakroom: email, optional cloakroom initials and item count, payment id.
• Table order: table number, order contents and status; payment (via Stripe) if you pay online.
• Door gift (QR): phone number, optional email. Kept for the evening SMS draw, the next-visit benefit, and, if you agreed, news and offers.
• Loyalty card: first name, last name, date of birth, phone or email, and a session token to show the card again.
• Evening feed: display name and photos you choose to publish.
• Staff / manager access: login details and session cookies.

The site also stores your last booking contact details in the browser so you do not have to type them again.

Purposes and legal bases

• Contract / pre-contractual steps: process the booking, ticket, order, payment, loyalty card, and send the necessary confirmations (email / SMS).
• Legitimate interest: fraud prevention, site security, lost property, and the guest list tied to a booking.
• Legal obligation: accounting and tax duties.
• Consent: audience measurement (Google Analytics), only if you accept it; marketing SMS or email, only if you tick the box on the door-gift page. You can withdraw these consents at any time.

Processors and transfers

• Stripe: payments. Stripe may process data in the United States. The transfer relies on the European Commission’s standard contractual clauses and, where applicable, an adequacy framework.
• Brevo: transactional email and SMS, in the European Union.
• Google Analytics (if consented): audience measurement. Google may process data in the United States under the same kinds of safeguards. The IP address is anonymised in the site configuration.

Retention

• Prospects (enquiry without a contract): 3 years after the last contact.
• Customers (booking, ticket, order, loyalty): for the relationship, then 5 years for possible disputes.
• Accounting records: 10 years.
• Marketing after consent: 3 years after the last contact, or until you withdraw consent.
• Cookies and similar tech: see Cookies. The consent choice is asked again after 6 months.

Confirm these periods with the company’s adviser if a shorter rule applies to a given processing.

Your rights

You may request access, rectification, erasure, restriction, objection, and portability where it applies. You may withdraw consent; this does not affect processing already carried out.

You may also lodge a complaint with the CNIL (French data protection authority), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.

To use your rights: contact@lerougepigalle.fr. Proof of identity may be requested if there is reasonable doubt.

Cookies and similar tech

Strictly necessary storage is set without consent:

• le_rouge_table: table number after the QR scan (12 hours).
• le_rouge_table_qr: table QR token (12 hours).
• le_rouge_loyalty: loyalty-card session (90 days).
• le_rouge_locale: chosen language (12 months).
• le_rouge_jwt and le_rouge_user: staff / manager session (7 days).
• le-rouge-theme: light / dark preference, in browser local storage.
• le-rouge-cookie-consent: stores your analytics choice, in local storage (not a cookie). The choice lasts 6 months, then the banner is shown again.

Audience measurement, only if you accept:

• _ga and _ga_*: Google Analytics cookies, publisher Google, maximum lifetime 13 months. They are not set if you decline.

You can accept or decline in the banner, then change that choice at any time with the “Cookie settings” link in the footer. Decline is offered at the same level as accept. Necessary cookies stay on either way.

Minors

The club and alcohol sales are reserved for people aged 18 and over. The site is not directed at children.