Desk Concierge
Home / Legal / Privacy Charter

Comprehensive Privacy Policy & Data Charter

Effective Date: January 1, 2026 • Last Reviewed: February 2026 • GDPR, UK-GDPR & CCPA Compliant

1. Introduction & Data Controller Identification

At Finderstoryshlf.com (operated by Finderstoryshlf Architectural Travel Ltd., Registered Company No. HRB-8492019-B, with its corporate seat at 14 Quai du Port-Rhu, 29100 Douarnenez, France), we hold the privacy of our readers, patrons, and hotel partners in the highest regard. This Privacy Policy details our operational protocols concerning the collection, storage, encryption, processing, and deletion of personal data collected through your interaction with our digital publication, interactive tools, and concierge dispatch systems.

For the purposes of Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation or "GDPR"), our appointed Data Protection Officer (DPO) can be contacted directly at [email protected].

2. Personal Data We Collect & Acquisition Channels

We adhere strictly to the principle of data minimization. We only collect personal data that is strictly necessary to fulfill editorial services, concierge inquiries, and essential website functionality:

  • Directly Provided Data: When you complete our Concierge Dispatch form or request direct coordinates for secluded properties, we collect your full name, email address, phone number (optional), travel preferences, and specific message contents.
  • Automatically Collected Technical Metadata: When you navigate Finderstoryshlf.com, our edge network logs truncated (anonymized) IP addresses, browser user-agent tokens, operating systems, referring URLs, time spent per page, and interaction events with our Seclusion Filter UI.
  • Preference & Consent Tokens: Stored locally on your device via HTML5 localStorage to remember your cookie consent preferences (e.g. finderstoryshlf_cookie_consent).

3. Lawful Bases for Processing Under GDPR (Article 6)

We process your personal information strictly within the bounds of defined lawful bases:

  • Consent (Art. 6(1)(a)): Explicit consent provided when subscribing to field notes, saving preference filters, or accepting non-essential analytical cookies.
  • Contractual Performance (Art. 6(1)(b)): Necessary processing to fulfill concierge itinerary inquiries and facilitate booking introductions between you and vetted boutique hotel partners.
  • Legitimate Interests (Art. 6(1)(f)): Securing our web infrastructure against Distributed Denial of Service (DDoS) attacks, fraud detection, and optimizing editorial site architecture.

4. Third-Party Processors & International Data Transfers

Finderstoryshlf does not sell, rent, or trade your personal data to programmatic ad brokers or data aggregators. Data is shared exclusively with audited infrastructure sub-processors under strict Data Processing Agreements (DPAs):

  • Hosting & Edge Delivery: Cloudflare Inc. (EU/US Privacy Framework compliant) for edge caching and web application firewall security.
  • Transactional Email Dispatch: Postmark / AWS SES for encrypted transmission of concierge replies.
  • Mapping Infrastructure: OpenStreetMap / Static vector tile providers for rendering isolated coastal terrain maps.

Where data transfers occur outside the European Economic Area (EEA), they are safeguarded by Standard Contractual Clauses (SCCs) approved by the European Commission.

5. Data Retention & Erasure Protocols

We retain personal data only for as long as necessary to fulfill the specific purposes outlined in this Charter. Concierge correspondence logs are archived securely for a maximum duration of 24 months to assist returning patrons, after which they are permanently expunged or anonymized. Analytical telemetry logs are aggregated and anonymized after 90 days.

6. Your Statutory Rights Under GDPR & CCPA

Depending on your jurisdiction, you possess enforceable rights regarding your personal information:

  • Right of Access (Art. 15 GDPR): The right to request copies of all personal data held about you.
  • Right to Rectification (Art. 16 GDPR): The right to correct inaccurate or incomplete records.
  • Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR): The right to request the complete deletion of your data from our active databases.
  • Right to Restrict Processing (Art. 18 GDPR): The right to pause specific data processing activities.
  • Right to Data Portability (Art. 20 GDPR): The right to receive your data in a structured, machine-readable format (JSON/CSV).
  • California Consumer Privacy Act (CCPA/CPRA) Rights: California residents have the explicit right to know what personal categories are collected and the right to opt-out of any hypothetical sale of data (which we do not perform).

To exercise any of these rights, submit a written dispatch to [email protected]. We will fulfill all verified requests within thirty (30) calendar days free of charge.

7. Data Security Safeguards

We implement robust technical and organizational security measures, including Transport Layer Security (TLS 1.3) encryption for all in-transit communications, strict HTTP Strict Transport Security (HSTS) headers, automated vulnerability scanning, and role-based access controls for editorial staff.

8. Updates to this Policy

We may periodically revise this Privacy Charter to reflect regulatory amendments or architectural changes to our services. Any substantial revisions will be highlighted on our homepage or communicated directly via email prior to becoming effective.