Privacy Policy
CHÂTEAU SHUETTE · YOUR DATA
PRIVACY & COOKIES.
What we collect, why we use it, who receives it and the choices you have when you visit, shop, book or contact Château Shuette.
Effective · 19 September 2026 · Updated · 21 September 2026
CONTROLLER
Château Shuette SAS, Saint-Loubès, France.
YOUR REQUESTS
TRACKING
Aggregate measurement is active. Detailed analytics and advertising measurement load only after your choice.
01
WHO THIS NOTICE COVERS.
This notice explains how Château Shuette SAS handles personal data when you use this website, create an account, buy products, book a tour, submit a form, contact us or otherwise deal with us as a customer, visitor or trade contact.
Château Shuette SAS
37 Chemin du Caderot
33450 Saint-Loubès, France
Société par actions simplifiée with share capital of €1,000
RCS Bordeaux · SIREN 922 137 849
SIRET 922 137 849 00027
VAT number FR40 922137849
Privacy requests: contact@shuette.com
Telephone: +33 6 12 51 42 62
Château Shuette is the controller for the processing described here. We have not appointed a data-protection officer; privacy requests are handled through the address above.
02
THE DATA WE COLLECT.
Depending on how you use the site or deal with us, we may collect:
- Identity and contact details: name, email address, telephone number, billing address and delivery address.
- Account data: account identifier, authentication and account preferences managed through Odoo.
- Order data: products, quantities, prices, tax, delivery method, delivery status, returns, refunds and communications about an order.
- Tour data: chosen experience, date, time, party size, preferred language and information you provide about children, non-drinkers, dietary restrictions or accessibility arrangements.
- Payment data: payment status, transaction reference, amount, payment method type and refund or dispute information. Château Shuette does not store your full card number or card-security code.
- Messages: the subject and content of contact forms, emails, trade enquiries, complaints and customer-service communications.
- Newsletter data: your email address and subscription or unsubscription status when you join Letters from the Farm through the homepage form.
- Technical and interaction data: IP address, browser and device information, language, session and security data, page requests, consent status, necessary cookie identifiers, page journeys, button and link interactions, booking and shop funnel steps, scroll depth, engagement time, site performance and general error information.
Required fields are marked on the relevant form. Without data needed to take payment, deliver an order or manage a booking, we may be unable to provide that service.
03
WHY WE USE IT.
| Purpose | Main legal basis |
|---|---|
| Answer enquiries and take steps you request before buying or booking. | Pre-contract steps and our legitimate interest in responding. |
| Manage accounts, orders, delivery, tours, cancellations, returns and customer service. | Performance of our contract with you. |
| Process payments, refunds, chargebacks and payment-security checks. | Contract, legal obligations and legitimate interests in preventing fraud. |
| Keep invoices, tax records and evidence required by law. | Legal obligation. |
| Protect the site, accounts, transactions and our legal rights. | Legitimate interests in security, fraud prevention and defending claims. |
| Analyse enquiries, sales, bookings and use of our services; produce business reports and aggregated statistics; and improve our website, offers and operations. | Our legitimate interests in understanding and improving the business, using proportionate data and privacy safeguards. |
| Measure detailed website journeys, interaction events, bookings, baskets, checkouts, sales, advertising effectiveness and audiences through optional analytics and marketing technologies. | Your consent. Optional technologies remain denied until you choose them, and you can withdraw your choice at any time. |
| Send Letters from the Farm and other requested or legally permitted customer communications. | Your consent, or legitimate interests where direct marketing law permits; every marketing message offers an opt-out. |
| Adapt a visit using health-related dietary or accessibility information. | Your explicit consent, in addition to arranging the service you requested. |
Marketing choices
We send electronic marketing to private individuals when they have actively subscribed or where the limited existing-customer exception allows us to promote our own similar products and services. Relevant professional communications to trade contacts may be based on our legitimate interests. Every marketing email provides an unsubscribe route, and you may object at any time. Declining marketing does not prevent you from making an enquiry, booking a visit, creating an account or placing an order.
Château Shuette does not sell personal data. Where you allow marketing technologies, we may use website activity to measure advertising, create audiences and make our own advertising more relevant. We do not send names, email addresses, telephone numbers, form answers or payment-card details in our analytics events. We do not make decisions about you solely by automated means that produce legal or similarly significant effects. Payment providers may run their own automated security and fraud checks under their policies.
04
ORDERS, DELIVERY AND TOURS.
Orders and delivery
We use customer, billing and delivery details to accept an order, calculate tax, take payment, send confirmations, fulfil the order, arrange age-appropriate delivery, handle returns and meet accounting and tax requirements. We give a carrier only the information reasonably needed to deliver and support the shipment.
Tour bookings
We use the booker’s name, email, telephone number, chosen time, party size, language and answers to booking questions to organise and provide the experience. If you give us information about another guest, you must be authorised to do so and should tell them about this notice.
DIETARY & ACCESS NEEDS
Allergy, dietary or accessibility information can reveal health or other sensitive details. Share only what we need to adapt the visit. By voluntarily providing it, you expressly consent to our using it for that purpose. You may withdraw that consent, although we may then be unable to make the requested adaptation.
Bookings must be made by an adult. We do not ask children to create accounts or provide data directly, and the adult booker should avoid sending unnecessary information about children.
05
PAYMENTS THROUGH STRIPE.
Online payments are provided by Stripe. Payment details are entered into Stripe’s payment interface and processed by Stripe and its financial partners. Château Shuette receives the transaction status and the information needed to match, account for, refund or dispute a payment, but does not receive or store your full payment-card details.
Stripe acts as our processor for parts of the payment service and may also act as an independent controller for activities such as regulatory compliance, service security and fraud prevention. Stripe explains those roles and its processing in the Stripe Privacy Policy.
06
COOKIES AND THIRD-PARTY CONTENT.
Necessary website cookies
Odoo uses cookies and similar storage that are necessary for functions such as security, session continuity, sign-in, language choice, the shopping basket and checkout. Blocking those technologies may stop parts of the site working correctly.
Analytics and advertising
We use Odoo-hosted Plausible Analytics for aggregate audience measurement and broad page-use reporting. This helps us understand overall demand and improve the site using proportionate data and without optional advertising cookies.
With your permission, we also load Google Analytics for detailed page journeys, interaction events, booking steps, shop funnels and website performance. If you also allow marketing measurement, we load our Google Tag Manager container so that enabled advertising and conversion tags can measure campaigns, sales and audiences. The event layer may record page category, internal and outbound links, call-to-action use, file downloads, contact method, form start and submission, product and basket actions, checkout stage, completed purchase reference and value, visit choices, scroll depth, engaged time, web performance and general script-error source. It is designed not to send form values, names, email addresses, telephone numbers or payment-card details.
Optional analytics and marketing storage default to denied. The consent panel gives equal access to reject, accept or make a granular choice. You can reopen it at any time using Cookie choices in the website footer. Our consent-choice cookie records your settings for six months. Google Analytics cookies are configured for a maximum of thirteen months. Withdrawing consent stops optional measurement and removes known Google and Meta measurement cookies from this site where technically possible.
Google Maps and website fonts
Our website fonts are hosted by Odoo. The Find Us page includes an interactive Google Map.
When the map loads, or when you follow a Google Maps directions link, Google may receive technical information such as your IP address, device, browser and the page requested, and may use cookies or similar technologies under its own terms. See the Google Privacy Policy.
You can delete or block cookies through your browser. Necessary site functions may then be unavailable. Where a consent control is displayed, you can use it to accept, refuse or later change optional choices.
07
WHO RECEIVES DATA.
Access is limited to people and organisations that need the information for the purposes above. Depending on the transaction, recipients may include:
- authorised Château Shuette staff;
- Odoo, which provides the website, shop, customer accounts, booking, email and business-management platform;
- Stripe, payment-method providers, banks and fraud-prevention partners involved in a transaction;
- delivery, logistics and fulfilment providers;
- Google when the embedded map loads, you follow a Google Maps link or you allow Google Analytics and advertising measurement;
- Meta, where a Meta measurement tag is activated through the marketing container after your consent;
- IT, hosting, email, accounting and professional advisers bound by appropriate duties;
- CM2C, courts, regulators, tax, customs, law-enforcement or other authorities where required or necessary for a complaint, claim or legal obligation.
We require service providers acting for us to process personal data only for agreed purposes and with appropriate protection. Their own independent processing is governed by their privacy information.
08
INTERNATIONAL TRANSFERS.
Some providers and their subprocessors operate internationally. This means personal data may be accessed or processed outside France or the European Economic Area.
Where the destination is not recognised as providing adequate protection, the transfer must rely on an approved safeguard such as the European Commission’s standard contractual clauses, together with additional measures where required. Provider details are available through the Odoo Privacy Policy, Stripe Privacy Policy, Google Privacy Policy and Meta Privacy Policy.
09
HOW LONG WE KEEP IT.
We keep data only for the period needed for the stated purpose, then delete or anonymise it unless a longer period is required to comply with law or establish, exercise or defend a legal claim.
| Record | Normal period |
|---|---|
| Contact or trade enquiry that does not become a customer relationship | Up to 3 years after the last meaningful contact. |
| Customer account and relationship data | For the active relationship, then up to 3 years after the last activity, subject to legal records below and valid deletion requests. |
| Invoices, order accounting, tax and refund records | 10 years from the close of the relevant accounting year. |
| Tour and customer-service records needed for contractual claims | For the service, then up to 5 years where needed to establish or defend a claim; invoice data remains subject to the 10-year period. |
| Dietary or accessibility notes | Deleted within 30 days after the visit unless a safety incident, complaint or legal claim requires the minimum necessary information to be kept longer. |
| Marketing records | Until you withdraw or object, or after 3 years without relevant interaction. |
| Consent choice | Six months, unless you change or withdraw it sooner. |
| Optional website analytics and advertising measurement | Google Analytics cookies are configured for a maximum of 13 months. Reporting and event data are retained under our provider settings and deleted or aggregated when no longer required for measurement. |
| Technical and security logs | For the limited period required for security, troubleshooting and provider operation; longer only where needed to investigate an incident or comply with law. |
Stripe, Odoo, Google, Meta and carriers apply their own retention periods to data they process as independent controllers.
10
YOUR RIGHTS.
Depending on the processing and applicable law, you may ask us to:
- give you access to personal data we hold about you;
- correct inaccurate or incomplete data;
- erase data where there is no lawful reason to keep it;
- restrict how data is used;
- provide eligible data in a portable format;
- stop processing based on legitimate interests, including direct marketing;
- withdraw consent at any time, without affecting earlier lawful processing.
Email contact@shuette.com with enough information for us to identify the relevant records and understand your request. We may ask for proportionate proof of identity where necessary. We normally respond within one month; the period may be extended by up to two further months for a complex or numerous request, and we will tell you if that applies.
COMPLAINTS
You may complain to the Commission nationale de l’informatique et des libertés (CNIL). We ask that you contact us first so we can try to resolve the issue. Submit or prepare a CNIL complaint.
11
SECURITY AND ACCURACY.
We use proportionate organisational and technical measures, including restricted access, authenticated accounts, encrypted website connections and specialist platforms for website hosting and payment processing. No system is completely risk-free; we investigate suspected incidents and notify affected people or authorities where the law requires it.
Please keep account credentials confidential, give us accurate information and contact us promptly if you believe an account, payment or message has been misused.
12
CHANGES TO THIS NOTICE.
We may update this notice when the website, our services, providers or legal duties change. The effective date at the top identifies the current version. Material changes will be highlighted where appropriate.
Questions or privacy requests: contact@shuette.com.
CHÂTEAU SHUETTE · YOUR DATA
PRIVACY & COOKIES.
What we collect, why we use it, who receives it and the choices you have when you visit, shop, book or contact Château Shuette.
Effective · 19 September 2026 · Updated · 21 September 2026
CONTROLLER
Château Shuette SAS, Saint-Loubès, France.
YOUR REQUESTS
TRACKING
Aggregate measurement is active. Detailed analytics and advertising measurement load only after your choice.
01
WHO THIS NOTICE COVERS.
This notice explains how Château Shuette SAS handles personal data when you use this website, create an account, buy products, book a tour, submit a form, contact us or otherwise deal with us as a customer, visitor or trade contact.
Château Shuette SAS
37 Chemin du Caderot
33450 Saint-Loubès, France
Société par actions simplifiée with share capital of €1,000
RCS Bordeaux · SIREN 922 137 849
SIRET 922 137 849 00027
VAT number FR40 922137849
Privacy requests: contact@shuette.com
Telephone: +33 6 12 51 42 62
Château Shuette is the controller for the processing described here. We have not appointed a data-protection officer; privacy requests are handled through the address above.
02
THE DATA WE COLLECT.
Depending on how you use the site or deal with us, we may collect:
- Identity and contact details: name, email address, telephone number, billing address and delivery address.
- Account data: account identifier, authentication and account preferences managed through Odoo.
- Order data: products, quantities, prices, tax, delivery method, delivery status, returns, refunds and communications about an order.
- Tour data: chosen experience, date, time, party size, preferred language and information you provide about children, non-drinkers, dietary restrictions or accessibility arrangements.
- Payment data: payment status, transaction reference, amount, payment method type and refund or dispute information. Château Shuette does not store your full card number or card-security code.
- Messages: the subject and content of contact forms, emails, trade enquiries, complaints and customer-service communications.
- Newsletter data: your email address and subscription or unsubscription status when you join Letters from the Farm through the homepage form.
- Technical and interaction data: IP address, browser and device information, language, session and security data, page requests, consent status, necessary cookie identifiers, page journeys, button and link interactions, booking and shop funnel steps, scroll depth, engagement time, site performance and general error information.
Required fields are marked on the relevant form. Without data needed to take payment, deliver an order or manage a booking, we may be unable to provide that service.
03
WHY WE USE IT.
| Purpose | Main legal basis |
|---|---|
| Answer enquiries and take steps you request before buying or booking. | Pre-contract steps and our legitimate interest in responding. |
| Manage accounts, orders, delivery, tours, cancellations, returns and customer service. | Performance of our contract with you. |
| Process payments, refunds, chargebacks and payment-security checks. | Contract, legal obligations and legitimate interests in preventing fraud. |
| Keep invoices, tax records and evidence required by law. | Legal obligation. |
| Protect the site, accounts, transactions and our legal rights. | Legitimate interests in security, fraud prevention and defending claims. |
| Analyse enquiries, sales, bookings and use of our services; produce business reports and aggregated statistics; and improve our website, offers and operations. | Our legitimate interests in understanding and improving the business, using proportionate data and privacy safeguards. |
| Measure detailed website journeys, interaction events, bookings, baskets, checkouts, sales, advertising effectiveness and audiences through optional analytics and marketing technologies. | Your consent. Optional technologies remain denied until you choose them, and you can withdraw your choice at any time. |
| Send Letters from the Farm and other requested or legally permitted customer communications. | Your consent, or legitimate interests where direct marketing law permits; every marketing message offers an opt-out. |
| Adapt a visit using health-related dietary or accessibility information. | Your explicit consent, in addition to arranging the service you requested. |
Marketing choices
We send electronic marketing to private individuals when they have actively subscribed or where the limited existing-customer exception allows us to promote our own similar products and services. Relevant professional communications to trade contacts may be based on our legitimate interests. Every marketing email provides an unsubscribe route, and you may object at any time. Declining marketing does not prevent you from making an enquiry, booking a visit, creating an account or placing an order.
Château Shuette does not sell personal data. Where you allow marketing technologies, we may use website activity to measure advertising, create audiences and make our own advertising more relevant. We do not send names, email addresses, telephone numbers, form answers or payment-card details in our analytics events. We do not make decisions about you solely by automated means that produce legal or similarly significant effects. Payment providers may run their own automated security and fraud checks under their policies.
04
ORDERS, DELIVERY AND TOURS.
Orders and delivery
We use customer, billing and delivery details to accept an order, calculate tax, take payment, send confirmations, fulfil the order, arrange age-appropriate delivery, handle returns and meet accounting and tax requirements. We give a carrier only the information reasonably needed to deliver and support the shipment.
Tour bookings
We use the booker’s name, email, telephone number, chosen time, party size, language and answers to booking questions to organise and provide the experience. If you give us information about another guest, you must be authorised to do so and should tell them about this notice.
DIETARY & ACCESS NEEDS
Allergy, dietary or accessibility information can reveal health or other sensitive details. Share only what we need to adapt the visit. By voluntarily providing it, you expressly consent to our using it for that purpose. You may withdraw that consent, although we may then be unable to make the requested adaptation.
Bookings must be made by an adult. We do not ask children to create accounts or provide data directly, and the adult booker should avoid sending unnecessary information about children.
05
PAYMENTS THROUGH STRIPE.
Online payments are provided by Stripe. Payment details are entered into Stripe’s payment interface and processed by Stripe and its financial partners. Château Shuette receives the transaction status and the information needed to match, account for, refund or dispute a payment, but does not receive or store your full payment-card details.
Stripe acts as our processor for parts of the payment service and may also act as an independent controller for activities such as regulatory compliance, service security and fraud prevention. Stripe explains those roles and its processing in the Stripe Privacy Policy.
06
COOKIES AND THIRD-PARTY CONTENT.
Necessary website cookies
Odoo uses cookies and similar storage that are necessary for functions such as security, session continuity, sign-in, language choice, the shopping basket and checkout. Blocking those technologies may stop parts of the site working correctly.
Analytics and advertising
We use Odoo-hosted Plausible Analytics for aggregate audience measurement and broad page-use reporting. This helps us understand overall demand and improve the site using proportionate data and without optional advertising cookies.
With your permission, we also load Google Analytics for detailed page journeys, interaction events, booking steps, shop funnels and website performance. If you also allow marketing measurement, we load our Google Tag Manager container so that enabled advertising and conversion tags can measure campaigns, sales and audiences. The event layer may record page category, internal and outbound links, call-to-action use, file downloads, contact method, form start and submission, product and basket actions, checkout stage, completed purchase reference and value, visit choices, scroll depth, engaged time, web performance and general script-error source. It is designed not to send form values, names, email addresses, telephone numbers or payment-card details.
Optional analytics and marketing storage default to denied. The consent panel gives equal access to reject, accept or make a granular choice. You can reopen it at any time using Cookie choices in the website footer. Our consent-choice cookie records your settings for six months. Google Analytics cookies are configured for a maximum of thirteen months. Withdrawing consent stops optional measurement and removes known Google and Meta measurement cookies from this site where technically possible.
Google Maps and website fonts
Our website fonts are hosted by Odoo. The Find Us page includes an interactive Google Map.
When the map loads, or when you follow a Google Maps directions link, Google may receive technical information such as your IP address, device, browser and the page requested, and may use cookies or similar technologies under its own terms. See the Google Privacy Policy.
You can delete or block cookies through your browser. Necessary site functions may then be unavailable. Where a consent control is displayed, you can use it to accept, refuse or later change optional choices.
07
WHO RECEIVES DATA.
Access is limited to people and organisations that need the information for the purposes above. Depending on the transaction, recipients may include:
- authorised Château Shuette staff;
- Odoo, which provides the website, shop, customer accounts, booking, email and business-management platform;
- Stripe, payment-method providers, banks and fraud-prevention partners involved in a transaction;
- delivery, logistics and fulfilment providers;
- Google when the embedded map loads, you follow a Google Maps link or you allow Google Analytics and advertising measurement;
- Meta, where a Meta measurement tag is activated through the marketing container after your consent;
- IT, hosting, email, accounting and professional advisers bound by appropriate duties;
- CM2C, courts, regulators, tax, customs, law-enforcement or other authorities where required or necessary for a complaint, claim or legal obligation.
We require service providers acting for us to process personal data only for agreed purposes and with appropriate protection. Their own independent processing is governed by their privacy information.
08
INTERNATIONAL TRANSFERS.
Some providers and their subprocessors operate internationally. This means personal data may be accessed or processed outside France or the European Economic Area.
Where the destination is not recognised as providing adequate protection, the transfer must rely on an approved safeguard such as the European Commission’s standard contractual clauses, together with additional measures where required. Provider details are available through the Odoo Privacy Policy, Stripe Privacy Policy, Google Privacy Policy and Meta Privacy Policy.
09
HOW LONG WE KEEP IT.
We keep data only for the period needed for the stated purpose, then delete or anonymise it unless a longer period is required to comply with law or establish, exercise or defend a legal claim.
| Record | Normal period |
|---|---|
| Contact or trade enquiry that does not become a customer relationship | Up to 3 years after the last meaningful contact. |
| Customer account and relationship data | For the active relationship, then up to 3 years after the last activity, subject to legal records below and valid deletion requests. |
| Invoices, order accounting, tax and refund records | 10 years from the close of the relevant accounting year. |
| Tour and customer-service records needed for contractual claims | For the service, then up to 5 years where needed to establish or defend a claim; invoice data remains subject to the 10-year period. |
| Dietary or accessibility notes | Deleted within 30 days after the visit unless a safety incident, complaint or legal claim requires the minimum necessary information to be kept longer. |
| Marketing records | Until you withdraw or object, or after 3 years without relevant interaction. |
| Consent choice | Six months, unless you change or withdraw it sooner. |
| Optional website analytics and advertising measurement | Google Analytics cookies are configured for a maximum of 13 months. Reporting and event data are retained under our provider settings and deleted or aggregated when no longer required for measurement. |
| Technical and security logs | For the limited period required for security, troubleshooting and provider operation; longer only where needed to investigate an incident or comply with law. |
Stripe, Odoo, Google, Meta and carriers apply their own retention periods to data they process as independent controllers.
10
YOUR RIGHTS.
Depending on the processing and applicable law, you may ask us to:
- give you access to personal data we hold about you;
- correct inaccurate or incomplete data;
- erase data where there is no lawful reason to keep it;
- restrict how data is used;
- provide eligible data in a portable format;
- stop processing based on legitimate interests, including direct marketing;
- withdraw consent at any time, without affecting earlier lawful processing.
Email contact@shuette.com with enough information for us to identify the relevant records and understand your request. We may ask for proportionate proof of identity where necessary. We normally respond within one month; the period may be extended by up to two further months for a complex or numerous request, and we will tell you if that applies.
COMPLAINTS
You may complain to the Commission nationale de l’informatique et des libertés (CNIL). We ask that you contact us first so we can try to resolve the issue. Submit or prepare a CNIL complaint.
11
SECURITY AND ACCURACY.
We use proportionate organisational and technical measures, including restricted access, authenticated accounts, encrypted website connections and specialist platforms for website hosting and payment processing. No system is completely risk-free; we investigate suspected incidents and notify affected people or authorities where the law requires it.
Please keep account credentials confidential, give us accurate information and contact us promptly if you believe an account, payment or message has been misused.
12
CHANGES TO THIS NOTICE.
We may update this notice when the website, our services, providers or legal duties change. The effective date at the top identifies the current version. Material changes will be highlighted where appropriate.
Questions or privacy requests: contact@shuette.com.