Legal
Privacy Policy
Last updated : October 5, 2026
Introduction
This privacy policy has been drawn up in accordance with French Law No. 78-17 of January 6, 1978 (known as the “Loi Informatique et Libertés” or French Data Protection Act) and the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679). The Company is established in Saint-Barthélemy, a French overseas collectivity with the status of Overseas Country or Territory (OCT) under European Union law. The French Data Protection Act applies by operation of law in Saint-Barthélemy under the principle of legislative identity. The GDPR applies in addition, pursuant to Article 3(2) thereof, since the Platform is directed at individuals located in the European Union.
The company St Barth Experience (hereinafter “the Company” or “we”) publishes and operates the St Barth Experience platform (hereinafter “the Platform”), accessible from the website https://stbarthexperience.com/ (hereinafter “the Site”). The Platform is a service that connects independent providers offering activities in Saint-Barthélemy (hereinafter the “Providers”) with people wishing to book those activities (hereinafter the “End Customers”). Activities booked via the Platform are the subject of a contract concluded directly between the End Customer and the Provider. The Company acts as an intermediary. The term “activities” refers to all the services offered on the Platform, including accommodations in the “Properties” category.
This policy informs you of how we collect and process your personal data, and of the rights you have.
For most of the processing operations described below, we act as data controller: we determine the purposes and means of this processing.
In connection with the performance of the services booked via the Platform, we also act as a processor on behalf of the Providers for the following operations: hosting of End Customers' booking data, hosting of exchanges carried out via the internal messaging system, processing of payments on behalf of the Provider and related technical maintenance. For this processing, the Provider is the data controller and determines the conditions under which your data is processed. The framework for this processor relationship is defined by a data processing agreement (DPA) entered into between the Company and each Provider. For any question about the use of your data in this context, you can contact the Provider concerned directly.
This English version is a translation of the original French policy; in the event of any discrepancy between the two versions, the French version shall prevail.
Who does this policy apply to?
This policy applies to the following persons:
- Prospective Providers: professionals contacted by the Company with a view to being listed on the Platform, who have not yet created an account.
- Listed Providers (the “Providers”): professionals who have created an account on the Platform and offer activities for booking, as well as private individuals offering accommodations for rent in the “Properties” category. Providers are also referred to as “Partners” on the Platform.
- End Customers: people who have created an account on the Platform to book activities with Providers. Where a professional intermediary (travel agency, concierge service, hotel) books on behalf of a third party, the End Customer is the actual beneficiary of the service.
- Visitors to the Site: anyone browsing the Site without having created an account.
Data controller
The data controller is the company St Barth Experience, a French simplified joint-stock company (SAS) whose registered office is located at 147 Chemin des Plateformes 97133 Saint-Barthélemy and which is currently being registered with the Trade and Companies Register (Registre du Commerce et des Sociétés) of the Tribunal mixte de Basse-Terre.
Contact email address: contact@stbarthexperience.com
Processing relating to prospective providers
Data subjects: professionals identified as potentially interested in being listed on the Platform, who have not yet created an account.
Purposes and legal bases
| No. | Purpose | Legal basis |
|---|---|---|
| 1 | Commercial prospecting and communication: identification of potential providers, initial contact, relationship follow-up, sending of communications | Legitimate interest. For the tracking of communications by tracking pixel (opens, clicks): consent. |
| 2 | Organization of community events: management of registrations and participation in events organized to bring providers together | Legitimate interest. For photographs: consent. |
Data processed
| No. | Purpose | Data processed |
|---|---|---|
| 1 | Prospecting and communication | Last name, first name, email address, telephone number, activity, history of exchanges, pixel-based communication tracking data (opens, clicks) |
| 2 | Organization of events | Last name, first name, email address, telephone number, participation (registration, attendance), photographs taken during the event where applicable |
Retention periods
| No. | Purpose | Retention period |
|---|---|---|
| 1 | Prospecting and communication | 3 years from the last active contact. If an account is created, the data is attached to the Provider account. |
| 2 | Organization of events | 3 years from the event. Photographs are deleted if consent is withdrawn. |
Processing relating to listed providers
Data subjects: professionals who have created an account on the Platform and offer activities for booking, as well as private individuals offering accommodations for rent in the “Properties” category.
The Company collects the Providers' bank details in order to transmit them to the authorized payment service in use, so that the Providers can receive payment for their bookings. This collection does not apply to the “Properties” category: in that category, the price of the stay is paid directly by the End Customer to the Provider, by bank transfer, without the Company collecting the payment.
Purposes and legal bases
| No. | Purpose | Legal basis |
|---|---|---|
| 3 | Conclusion of the listing agreement: collection of the data necessary for the formation of the contract between the Company and the Provider | Pre-contractual measures. Performance of the listing agreement. |
| 4 | Provider account management: registration (via a form or via a Google account), authentication, profile management | Performance of the listing agreement. |
| 5 | Document verification | Performance of the listing agreement. Legal obligation for the registration of furnished tourist rentals. |
| 6 | Payment of Providers: collection of the IBAN and BIC for the payout of funds from bookings (excluding the “Properties” category) | Performance of the listing agreement. |
| 7 | Publication of listings: putting the Provider's activity pages online. | Performance of the listing agreement. |
| 8 | Calendar and availability: management of time slots via the internal calendar. The Provider may synchronize their Google Calendar with the Platform. | Performance of the listing agreement for the internal calendar. Consent for Google Calendar synchronization (which may be withdrawn at any time). |
| 9 | Ranking and evaluation: ranking of offers according to criteria of quality, accuracy and relevance; management of the quality score | Performance of the listing agreement. Legitimate interest: quality of service for End Customers. |
| 10 | Activity statistics (sales, orders, conversion rate, listing performance) | Legitimate interest. |
Data processed
| No. | Purpose | Data processed |
|---|---|---|
| 3 | Conclusion of the contract | Last name, first name, email address, telephone number, nature of the activity offered, geographical area, description of the offer, professional supporting documents |
| 4 | Account management | Last name, first name, email address, telephone number, login credentials, profile data. If registering via Google: Google account data (name, email) |
| 5 | Document verification | Identity document, proof of registration, professional liability insurance, licenses, permits, diplomas, furnished tourist rental registration number |
| 6 | Payment of Providers | IBAN, BIC |
| 7 | Publication of listings | Descriptions, photos, prices, terms, cancellation policy. |
| 8 | Availability management | Availability time slots. If synchronized: Google Calendar data |
| 9 | Ranking and evaluation | Quality score, response rate, confirmation rate |
| 10 | Activity statistics | Data broken down by Provider derived from bookings: amounts, number of orders, conversion rate, sales per day, performance per listing |
Retention periods
| No. | Purpose | Retention period |
|---|---|---|
| 3 | Conclusion of the contract | If refused: 6 months. If accepted: data attached to the Provider account. |
| 4 | Account management | Duration of the contractual relationship. Intermediate archiving: 5 years after the account is closed. |
| 5 | Document verification | Duration of the contract. Documents deleted within 30 days after the end of the contract. Verification information archived for 5 years. |
| 6 | Payment of Providers | Duration of the contract. Deletion within 30 days after the account is closed. Associated billing data: 10 years. |
| 7 | Publication of listings | Duration of the contract. Removal from the Platform upon termination. |
| 8 | Availability management | Duration of the contract. Google data deleted when the Google account is disconnected. |
| 9 | Ranking and evaluation | Duration of the contract. Intermediate archiving: 5 years. |
| 10 | Activity statistics | Duration of the contract. Intermediate archiving: 5 years after the account is closed. |
Processing relating to end customers
Data subjects: people who have created an account on the Platform to book activities with Providers.
Some bookings may be made by a professional intermediary (travel agency, concierge service, hotel) on behalf of an End Customer. In that case, the End Customer's data is transmitted to the Company by the professional intermediary. The contract for the service is formed directly between the End Customer and the Provider.
In the “Properties” category, the price of the stay is paid directly by the End Customer to the Provider, by bank transfer. The Provider may attach the rental agreement and their bank account details (RIB) via the Platform's internal messaging system. The Company does not collect this payment.
Purposes and legal bases
| No. | Purpose | Legal basis |
|---|---|---|
| 11 | End Customer account management: registration, authentication, profile management (optional photo and short bio), preferences and favorites | Performance of the Terms of Use. |
| 12 | Conclusion of the service contract: collection and transmission of the data necessary for the formation of the contract between the End Customer and the Provider | Pre-contractual measures. Performance of the Terms of Use. |
| 13 | Booking management: processing of bookings, handling of confirmations, changes and cancellations | Performance of the Terms of Use. |
| 14 | Payment processing (excluding the “Properties” category): collection of payments via the payment service in use, holding and release of funds to the Provider, refunds | Performance of the Terms of Use. |
| 15 | Review management: publication and display of reviews posted by End Customers after participation, with purchase verification | Legitimate interest (transparency). Legal obligation (purchase verification). |
Data processed
| No. | Purpose | Data processed |
|---|---|---|
| 11 | Account management | Name, email address, password (hashed), photo (optional), short bio (optional), registration date, currency preference, list of favorite activities |
| 12 | Conclusion of the contract | Last name, first name, email address, selected activity, date, time slot, number of participants |
| 13 | Booking management | Selected activity, date, time slot, number of participants, service address where applicable, date and reason for cancellation where applicable |
| 14 | Payment processing | Payment data processed by the payment service in use (bank card). We do not store card data. |
| 15 | Review management | Content of the review, rating, publication date |
Retention periods
| No. | Purpose | Retention period |
|---|---|---|
| 11 | Account management | Duration of the account. If there is no login or booking for 3 years, the account is considered inactive. The End Customer is informed by email 30 days before deletion and can reactivate their account by logging in. If it is not reactivated, the account and the associated data are deleted. Intermediate archiving: 5 years from deletion. |
| 12 | Conclusion of the contract | If the booking is completed: data attached to the End Customer account (duration of the account). If the booking is not completed (refusal by the Provider, no response, counterproposal declined): deletion within 30 days. |
| 13 | Booking management | Duration of the account. Intermediate archiving: 5 years after the end of the service. |
| 14 | Payment processing | Card data: not retained (payment service in use). Transaction data: 13 months. Billing data: 10 years. |
| 15 | Review management | Period during which the activity is listed. After deletion of the account: anonymization (content retained, name deleted). |
Common processing operations
Data subjects: Providers, End Customers, and visitors to the Site (purpose No. 20).
Purposes and legal bases
| No. | Purpose | Legal basis |
|---|---|---|
| 16 | Internal messaging: enabling communication between End Customers and Providers to organize the service booked. Administrators have access to conversations for moderation purposes. In the “Properties” category, the Provider may attach the rental agreement and their bank account details (RIB) to their messages. | Performance of the Terms of Use and the listing agreement. Legitimate interest for moderation. |
| 17 | Booking follow-up: informing users of the status of their bookings and sending them the information necessary for the service to take place | Performance of the Terms of Use and the listing agreement. |
| 18 | Customer service, complaints and mediation: handling of post-service complaints, collection of supporting documents, internal mediation, management of the blocking/release of funds, sanctions against Providers | Performance of the Terms of Use and the listing agreement. Legitimate interest: security of the Platform and protection of users. |
| 19 | Accounting and financial management: billing, payment tracking, tax returns | Legal obligation (accounting and tax obligations). Performance of the listing agreement and the Terms of Use (routine billing). |
| 20 | Management of contact requests: handling of requests for information or inquiries sent via the Site's contact form | Legitimate interest: responding to requests. Pre-contractual measures where applicable. |
Data processed
| No. | Purpose | Data processed |
|---|---|---|
| 16 | Internal messaging | Content of messages, attachments, date and time, identity of the parties to the conversation |
| 17 | Booking follow-up | Email address, booking details, Provider's contact details |
| 18 | Customer service and mediation | Identity of the complainant, description of the complaint, supporting documents (photos, invoices, testimonies), follow-up and decision |
| 19 | Accounting management | Identity of the Provider or the End Customer, amounts, dates, billing data |
| 20 | Management of contact requests | Name, email address, message |
Retention periods
| No. | Purpose | Retention period |
|---|---|---|
| 16 | Internal messaging | Duration of the accounts of the parties to the conversation. Intermediate archiving: 5 years after the last account concerned is closed. |
| 17 | Booking follow-up | Same period as for bookings. |
| 18 | Customer service and mediation | Duration of the handling of the case. Intermediate archiving: 5 years after closure. |
| 19 | Accounting management | 10 years (accounting and tax obligations). The listing agreement is retained for 10 years after it ends, in accordance with the civil statute of limitations. |
| 20 | Management of contact requests | 3 years from the request. |
Processing related to the operation of the Site and the Platform
Data subjects: visitors to the Site, End Customers, Providers.
Purposes and legal bases
| No. | Purpose | Legal basis |
|---|---|---|
| 21 | Technical management, security and cookies: hosting, maintenance and backups, account security, fraud prevention, cookie management. | Legitimate interest: operation and security of the service. Strictly necessary cookies do not require prior consent. |
| 22 | Location of services: address autocomplete (Google Maps) and map links in confirmation emails | Legitimate interest: facilitating the organization of the service. |
| 23 | Requests to exercise rights: handling of requests for access, rectification, erasure, portability, objection, restriction | Legal obligation. |
Data processed
| No. | Purpose | Data processed |
|---|---|---|
| 21 | Technical management, security and cookies | All data of the Platform and the Site, connection data (IP address, logs, identifiers, devices), session, currency and consent cookies, and cookies of the payment service in use |
| 22 | Location of services | Text entered in the address field, selected address |
| 23 | Management of rights requests | Identity of the requester, proof of identity where applicable, nature of the request, follow-up, response |
Retention periods
| No. | Purpose | Retention period |
|---|---|---|
| 21 | Technical management, security and cookies | Logs and connection data: 1 year. Cookies: duration of the session (session), 13 months (currency), 6 months (consent), policy of the payment service in use (payment). |
| 22 | Location of services | No retention by the Company. Data transmitted to Google Maps as the text is entered. |
| 23 | Management of rights requests | 3 years. Proof of identity deleted after verification. |
Mandatory or optional nature of data collection
The data collected is mandatory in order to achieve the processing purposes described in this policy, with the exception of the following data, which is optional:
- End Customer profile photo
- End Customer short bio
- End Customer two-factor authentication
Failure to provide the mandatory data makes it impossible, depending on the case, to create an account, make a booking, publish a listing or list a Provider on the Platform.
Data sources
In most cases, we collect data directly from the data subject, in particular when an account is created, a form is submitted, an activity is booked or the Platform is used.
Some data may be collected indirectly:
- Prospective Providers: the business contact details of potential providers may be collected from publicly accessible sources (websites, professional directories) for commercial prospecting purposes.
- End Customers: where a professional intermediary (travel agency, concierge service, hotel) makes a booking on behalf of an End Customer, the latter's data is transmitted by the professional intermediary. The End Customer is informed of the processing of their data as soon as possible and at the latest at the time of the first communication with them.
- Providers (registration via Google): where a Provider registers via their Google account (“Continue with Google”), the Google profile data (name, email) is transmitted to the Company by Google.
Data recipients
The personal data collected is reserved for use by the Company. It may be transmitted to the following categories of recipients, strictly to the extent necessary for the performance of their tasks:
- Service provider in charge of the development and maintenance of the Site and the Platform
- Hosting provider
- Online payment service provider (payment service in use)
- File storage provider
- Transactional email providers
- Mapping service provider
- Calendar synchronization service provider
- Authentication service provider (registration via Google account)
The payment service in use, our payment service provider, also processes personal data as an independent data controller, for its own purposes (in particular regulatory compliance and fraud prevention). For more information on this processing, you can consult the privacy policy of the payment service in use, available on its website.
The Company may be required to disclose personal data to the competent authorities in connection with legal obligations.
Data transfers outside the European Union
The Company is established in Saint-Barthélemy, an Overseas Country or Territory located outside the territory of the European Union. In the course of its activities, it may transfer personal data outside the European Union, through its processors.
The Company undertakes to ensure that these transfers are carried out:
- to countries ensuring an adequate level of protection as understood by the European data protection authorities, or
- with appropriate safeguards (in particular the implementation of standard contractual clauses), or
- in compliance with the derogations provided for by the GDPR.
You can obtain information on the safeguards in place by contacting us at the address indicated in the “Data controller” section.
Security measures
The Company implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk.
The Company takes the necessary measures to ensure that any person acting under its authority or under the authority of its processors, and having access to personal data, processes it only in accordance with the instructions of the Company and the requirements of the applicable regulations.
The Providers' supporting documents are stored in a private space, not accessible to the public, to which access is limited to the Provider concerned and to authorized administrators. The full IBAN collected for the payout of funds (purpose No. 6) is accessible only to administrators.
Your rights over your personal data
You can set out instructions regarding the retention, erasure and disclosure of your personal data after your death. These instructions may be general or specific.
You also have the following rights over your personal data:
- Right of access: a right to access your personal data
- Right to rectification: a right to have your personal data rectified if it is inaccurate or incomplete
- Right to erasure: a right to have your personal data erased, under the conditions provided for by the regulations
- Right to restriction of processing: a right to have the processing of your personal data restricted
- Right to data portability: a right to the portability of your personal data, under the conditions provided for by the regulations
- Right to object: a right to object to the processing of your personal data, in particular where the processing is based on legitimate interest
- Right to withdraw consent: a right to withdraw your consent at any time, where consent is the legal basis for the processing (in particular for the tracking of communications by tracking pixel, event photographs and Google Calendar synchronization). Withdrawal of consent does not affect the lawfulness of processing carried out before that withdrawal.
The request must state the last name and first name, and the email or postal address, of the data subject. In the event of reasonable doubt as to the identity of the requester, proof of identity may be requested from them.
You can exercise your rights by contacting: Flora Vignais - 147 Chemin des Plateformes 97133 Saint-Barthélemy - contact@stbarthexperience.com
For processing in respect of which we act as a processor on behalf of the Provider, you can exercise your rights directly with the Provider concerned, who is the data controller.
Complaint
You have the right to lodge a complaint with the supervisory authority (CNIL): https://www.cnil.fr/fr/plaintes
Changes to the policy
We may update this policy to take account of changes in our activities or in the applicable regulations. In the event of a substantial change, we will inform users of the Platform by any appropriate means. The date of the last update appears at the top of this policy.