Privacy policy

1. Controller

La Maison a 100 Euros Ltd, England and Wales, Companies House n. [to be completed]. EU representative (GDPR art. 27): [to be assessed and completed before commercial opening where required]. Contact for privacy matters: contact@lamaisona100euros.com.

2. Data collected

• Account identity: first name, last name, date of birth, e-mail address, phone number, postal address.
• Authentication: hashed password (Argon2id, never in clear text).
• Preferences: newsletter opt-in, preferred language.
• Technical logs: IP address, sign-up and login timestamps (for security and abuse prevention).
• Ticketing (only if later opened): purchase history, ticket numbers, transaction identifiers.

3. Purposes and legal basis

• Account management (creation, sign-in, e-mail change, password reset) — contract (GDPR art. 6-1-b).
• Possible ticketing and prize allocation, only if later opened — contract (art. 6-1-b) and legal obligation for accounting (art. 6-1-c).
• Sign-up abuse prevention (IP rate limiting, honeypot, human verification) — legitimate interest (art. 6-1-f).
• Newsletter — free, specific, informed and unambiguous consent (art. 6-1-a). You can withdraw it at any time from your personal space.
• Security logs and fraud prevention — legitimate interest (art. 6-1-f).

4. Retention periods

• Active account: for the whole duration of your account.
• Account with participation history: 5 years after the last transaction (art. L123-22 French Code of Commerce).
• Inactive account (no purchase): 3 years after creation, then anonymised.
• Payment / accounting data (only if later opened): 10 years for the accounting invoice (art. L102 B LPF).
• Newsletter: 3 years after the last interaction.
• Sign-up security logs (IP addresses): 30 days.
• Aborted sign-ups (unverified accounts): 30 days then purged.
• Password-reset / e-mail-change / e-mail-verification tokens: expiration of the token (a few hours).

5. Recipients and transfers

• Hosting: LWS (France) - no transfer outside the EU.
• Transactional e-mail sending: LWS SMTP (France).
• Anti-bot protection: Cloudflare Turnstile - Cloudflare Inc. (USA), certified under the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795).
• Payment (only if later opened): provider to be confirmed before commercial opening. If Revolut is retained, EU / UK transfers must rely on the applicable adequacy framework.
• Public officer and notary: only if a validated draw and property deed require it, on a strict need-to-know basis.

6. Your rights

Under articles 15 to 22 GDPR, you have the following rights over your personal data: access, rectification, erasure (right to be forgotten), restriction of processing, portability, objection, withdrawal of consent. To exercise them: write to contact@lamaisona100euros.com, or delete your account directly from your personal space (Account > Delete my account). You may also lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertes, France, www.cnil.fr) or the ICO (Information Commissioner's Office, UK).

7. Security

Passwords are hashed using Argon2id. Sessions are cookie-based with the flags httponly, secure (production) and samesite=Lax, and are regenerated on each privilege change. Forms are protected by synchronizer CSRF tokens. Access to admin actions is protected by two-factor authentication (TOTP).

8. Minors

The service is strictly reserved to persons aged 18 or over. The date of birth is required at sign-up. Any account opened in violation of this rule is deleted upon detection, along with the associated data.

9. Update of this policy

This policy may be updated to reflect legal, technical or organisational changes. Substantial changes will be notified to account holders by e-mail.