Privacy policy
Last updated: October 2026
Protecting your personal data is a priority for Chez Here-Ata. This page explains what data we process, why, how long we keep it and how to exercise your rights, in accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act (loi n° 78-17 of 6 January 1978).
1. Data controller
Anna MATAPO, sole trader operating as Chez Here-Ata (TAHITI No. 944 793), Baie de Maroe, 98731 Huahine, French Polynesia. Contact: contact@chezhereata.com.
2. Data we collect
- When you contact us (email, phone): first and last name, email address, phone number, dates of stay, number of guests and the content of your messages.
- When you stay with us: the information needed to welcome you (flight times for the airport pickup) and for invoicing.
- When you browse the site, only if you accept it: audience measurement data (pages viewed, device type, country, traffic source) collected by Google Analytics.
The site has no forms: we only receive the information you choose to send us. These contact details are necessary to process your booking request; without them, we cannot reply to you.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Answering your information and booking requests | Steps taken at your request before a contract (GDPR art. 6(1)(b)) |
| Managing your stay, your welcome and the airport pickup | Performance of the contract (GDPR art. 6(1)(b)) |
| Invoicing and accounting | Legal obligation (GDPR art. 6(1)(c)) |
| Site audience measurement (Google Analytics) | Your consent (GDPR art. 6(1)(a)), which you can withdraw at any time |
We never sell, rent or hand over your data to third parties for advertising purposes.
4. Retention periods
- Requests that did not lead to a booking: 3 years after our last exchange.
- Stay data: 3 years after the end of your stay.
- Invoices and accounting records: 10 years (legal obligation).
- Audience measurement data: 14 months.
- Your cookie choices: 6 months, after which we ask you again.
5. Recipients
Your data is only accessible to Anna and her team, and to the following service providers:
- Amazon Web Services EMEA SARL: website hosting (servers located in Paris).
- Web Affinity (Arue, Tahiti): design and technical maintenance of the website.
- Google Ireland Ltd: audience measurement, only if you have accepted it.
If you book through Booking.com or Airbnb, these platforms process your data as independent controllers, under their own privacy policies.
6. Where data is processed and transfers
Chez Here-Ata is established in French Polynesia, an overseas collectivity of France where the French Data Protection Act applies. The website is hosted in France. Audience measurement data may be transferred to the United States by Google LLC, which participates in the EU–US Data Privacy Framework recognised by the European Commission.
7. Cookies and local storage
No audience measurement cookie is set without your consent. The site uses the following:
| Name | Purpose | Duration | Consent |
|---|---|---|---|
| rgpd-consent | Remembers your cookie choices (local storage) | 6 months | Not required |
| chezhereata-lang | Remembers the language you chose (local storage) | Until deleted | Not required |
| chezhereata-theme | Remembers the light or dark appearance you chose (local storage) | Until deleted | Not required |
| _ga, _ga_* | Google Analytics audience measurement | 13 months | Required |
You can change your choices at any time by clicking . Withdrawing your consent deletes the Google Analytics cookies.
8. Your rights
You have the right to access, rectify, erase, restrict, object to and port your data, the right to withdraw your consent at any time, and the right to set instructions for what happens to your data after your death.
To exercise these rights, write to us at contact@chezhereata.com. We will reply within one month.
If you believe your rights are not being respected, you can lodge a complaint with the French data protection authority (CNIL): www.cnil.fr.
9. Security
The site is served over HTTPS only and applies strict security headers. The publisher and hosting provider are identified in our legal notice (in French).