Privacy notice

Vistas Beach Cafe is run by Vazon Bay Café Limited, registered in Guernsey with company number 54187, at Vazon Rd, Guernsey GY5 7BF.

We are the data controller for the information described below. That means we decide what is collected and why, and we are responsible for looking after it.

Nothing. This website has no forms, no accounts and no shopping basket. There is no tracking, no advertising and no analytics on it either — we do not know who visits the site or which pages they look at.

What we do have is our email address and our phone number, printed on the page. If you write to us or ring us, we hold what you choose to tell us, and the rest of this notice explains what happens to it.

Depending on why you get in touch, that is likely to include:

• Identity information — your name, and anything else you choose to tell us about yourself.
• Contact information — your email address and phone number.
• Your enquiry or message — whatever you write to us, including the details of an event you are planning.
• Your application and CV, if you write to us about a job — your employment history, education, qualifications and whatever else your CV contains.

Where we rely on legitimate interests, you have the right to object. See Your rights below.

Our website and services are not aimed at children.

If you are a parent or guardian of a child under 16 and you become aware that your child has used our website, or otherwise given us their information without your consent, please contact us at info@lagrandemare.com. In addition to the rights set out below, we will delete or otherwise stop using your child’s information within a reasonable time.

If you are under 16, please ask your parent or guardian’s permission before giving us your information or using our website.

Your information is kept in the website’s own database, which only the cafe and our website provider can sign into. It is not sold, rented or shared for marketing, ever.

These companies process information on our behalf, under contract and on our instructions:

None of them is allowed to use your information for their own purposes.

Some of the companies above are in the United States, which means your information may be handled there as well as in Europe:

• Vercel Inc. — the website runs on Vercel’s servers in the United States. Governed by Vercel’s Data Processing Addendum, which incorporates the Standard Contractual Clauses.
• Resend — notification emails are sent through Resend in the United States. Governed by Resend’s Data Processing Agreement, which incorporates the Standard Contractual Clauses.
• Google — loading a page with a map on it sends your IP address to Google in the United States. Governed by Google’s Data Processing Terms, which incorporate the Standard Contractual Clauses.

The database itself is held in Frankfurt, Germany, and our email is hosted within the European Union.

The Find us and Contact pages include a Google map. When one of those pages loads, Google receives your IP address and may set its own cookies. That is Google’s processing rather than ours, and is covered by Google’s own privacy policy. The rest of the site works normally if your browser blocks it.

This website does not use cookies to track you, and sets no cookies at all for ordinary visitors.

The only cookie it sets is for cafe staff signing in to update the website, and it does nothing except keep them signed in.

When a period ends, the information is deleted. If you would like us to delete something sooner, just ask.

We take reasonable steps to keep your information safe. Our email accounts are protected by the provider’s own security, the website’s database is not publicly accessible, and signing in to the part of the site where we keep records needs both a password and a code sent to an approved address.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Office of the Data Protection Authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, as required by The Data Protection (Bailiwick of Guernsey) Law, 2017. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay.

Under the Data Protection (Bailiwick of Guernsey) Law, 2017 you have the right to:

• be informed about how we use your information — which is what this page is for
• ask what we hold about you, and get a copy of it
• have it corrected if it is wrong or incomplete
• have it deleted
• restrict how we use it while a question about it is resolved
• object to us using it, including where we rely on legitimate interests
• data portability — ask us to provide the information you gave us in a commonly used electronic format, or to send it to someone else, where that applies
• withdraw consent at any time, where we rely on your consent
• complain about how we have handled your information

To exercise any of these, email hello@vistas.gg or write to us at the address below. We will respond within one month.

If you are not satisfied with our response, you can complain to the Office of the Data Protection Authority, which regulates data protection in Guernsey — odpa.gg.

If we change how the website handles your information, we will update this page and change the date at the top.