INFORMATION & PRIVACY
Privacy policy
Updated: 8 novembre 2026
Data controller and contact
SAS W&Y détermine l’utilisation des données recueillies sur ce site. Son identité juridique figure dans les legal notice.
For questions or to exercise your rights: contact form, subject “Personal data”, or write to the restaurant at 7 avenue Philippe Auguste, 75011 Paris.
What data is used, and why?
| Purpose | Data | Legal basis |
|---|---|---|
| Responding to your message | Name, email address, message subject and content; date received. | Legitimate interest in handling general enquiries; pre-contractual measures taken at your request when preparing a service. |
| Maintaining the session and protecting the form | Session identifier, anti-forgery token, CAPTCHA challenge and temporary result. | Legitimate interest in securing the website and form. |
| Ensuring technical operation | IP address required for the connection, date, requested path, response code and any technical errors. | Legitimate interest in ensuring service availability and security. |
All form fields are required to handle a request through this channel. Without them, the message cannot be sent. You may also telephone. Avoid including sensitive or confidential information in your message.
Recipients and technical environment
People authorised to respond to enquiries and maintain the website may access data necessary for their duties. Messages are not used for newsletters or advertising, and data is not sold.
Hosting and email providers act only within the services required, in accordance with the applicable contracts and settings.
Direct reservations
The restaurant uses your name, email address, phone number, visit date and time, number of guests and comment to handle your request and inform you of its decision. The request remains pending until accepted. A receipt and then the decision are sent by email. Access is restricted to people authorised to manage reservations.
Requests and their technical messages become eligible for deletion after the retention period configured by the restaurant, currently 90 days after the visit. Cleanup runs when new requests are received. Copies of emails held in inboxes follow their own retention rules. Avoid including sensitive information in your comment.
Retention periods
- Joomla session: expires after 15 minutes of inactivity; the cookie is a session cookie. Expired sessions are physically removed during Joomla's technical cleanup.
- Unsent messages: if validation fails, fields may be temporarily retained in the session to avoid re-entry; they are cleared from the session after successful sending.
- CAPTCHA : valid for 10 minutes; a validated response cannot be reused. Challenge data is linked to the session.
The retention periods for messages and production logs must be confirmed with the operator.
Cookies, CAPTCHA and external services
The etoiles_language cookie remembers your language for 30 days only if you enable this option in “Manage cookies”. You can still change language during your visit without this option. This cookie is not used for advertising tracking. cookie policy.
Images, fonts and displayed components are served locally. Google Maps and TheFork are accessible through links: no map, review widget or tracking tool from these platforms loads automatically. Following an external link takes you away from this website, where the chosen service's rules apply. No referrer header is sent to these destinations.
Public review excerpts
The website displays selected short excerpts from public TheFork reviews, with the author's abbreviated public name, rating and source link. This relies on the legitimate interest of informing visitors about restaurant feedback. No customer profiles are created from these reviews. Authors may request correction or removal through the same rights-request channel; excerpts are reviewed when updated or upon request.
Your rights
Subject to the GDPR's conditions, you may request access, rectification, erasure or restriction of processing of your data, and object to processing based on legitimate interest. Portability applies to automated processing based on your consent or a contract when its conditions are met. You may also give instructions about your data after your death.
Requests are answered within one month. For complex or numerous requests, this may be extended by two months; you will be informed within the first month. Proportionate identity verification may be requested where there is reasonable doubt. Do not send a copy of your identity document unsolicited.
You may lodge a complaint with the CNIL. This website carries out no profiling or automated decision-making producing legal effects.
Security and transfers
The form uses server-side validation, anti-forgery tokens and a CAPTCHA. Messages are not stored in a publicly accessible file.
The arrangements for data processing and transfers by hosting and email providers must be confirmed with the operator.