Privacy Policy
Last updated: April 2026
1. Purpose and Scope
This Privacy Policy aims to inform users of the website ohlalalockers.fr and customers of OHLALA SAS about how their personal data is collected, processed and protected.
It applies to all services offered by OHLALA SAS: automatic luggage storage, Airbnb key box service, powerbank rental and vending machine product sales, accessible at 29 rue Gounod, 06000 Nice and via ohlalalockers.fr.
It is written in compliance with Regulation (EU) 2016/679 of 27 April 2016 (GDPR) and French Law No. 78-17 of 6 January 1978 as amended relating to data processing, files and civil liberties.
2. Data Controller
The controller responsible for personal data collected in the context of OHLALA services is:
Registered office: C/O Flex'O – 470, Promenade des Anglais, 06203 Nice Cedex 3, France
Premises: 29 rue Gounod, 06000 Nice, France
SIRET: 105 586 671 00015 · RCS Nice: 105 586 671
Email: privacy@ohlalalockers.fr
Phone: +33 7 56 98 42 04
OHLALA SAS does not have a designated Data Protection Officer (DPO), as its size and the volume of data processed do not reach the thresholds making such designation mandatory.
3. Data Collected and Processing Activities
OHLALA SAS collects only the data strictly necessary to provide its services.
| Processing | Data Collected | Purpose | Legal Basis | Retention Period |
|---|---|---|---|---|
| Locker Booking | First name, last name, email, phone | Booking management and locker access | Contract performance (Art. 6.1.b) | 3 years after last booking |
| Payment | Bank card data (processed by Stripe) | Payment collection and invoicing | Contract performance + legal obligation (Art. 6.1.b and 6.1.c) | 10 years (accounting obligation) |
| Access Code Delivery | Email, phone | Transmission of unique SMS/email locker access code | Contract performance (Art. 6.1.b) | Duration of the booking |
| Airbnb Key Box Service | Name, email, property address | Subscription management and key box access | Contract performance (Art. 6.1.b) | Duration of subscription + 3 years |
| B2B Commercial Prospecting | Professional email, company name | Outreach to professionals (Airbnb managers, concierge services, hotels) | Legitimate interest (Art. 6.1.f) | 3 years without contact, or until objection |
| Cookies & Analytics | IP address, browsing data | Audience measurement and site improvement | Consent (Art. 6.1.a) | 13 months maximum |
| CCTV | Images recorded on the premises | Security of property and persons | Legitimate interest (Art. 6.1.f) | 30 days maximum |
The premises at 29 rue Gounod, 06000 Nice are equipped with a video protection system authorised by the Prefecture of Alpes-Maritimes, in accordance with Articles L.251-1 et seq. of the French Internal Security Code (Code de la sécurité intérieure). An information notice is displayed inside the premises.
4. Recipients of Data
Your data may be transmitted to technical subcontractors (hosting, payment, locker management software) strictly within the scope of the processing described above. These service providers are bound to OHLALA SAS by contracts compliant with Article 28 of the GDPR and are not authorised to use your data for other purposes.
Your data is never sold to third parties.
5. Transfers Outside the European Union
Payment data is processed by Stripe, Inc., a US company. This transfer is governed by the Standard Contractual Clauses (SCCs) adopted by the European Commission, ensuring an adequate level of protection in accordance with Article 46 of the GDPR. OHLALA SAS never directly stores bank card numbers. You can consult Stripe's privacy policy at: stripe.com/en/privacy.
All other service providers process data exclusively within the European Union.
6. Your Rights
Under the GDPR, you have the following rights regarding your personal data:
- Right of access (Art. 15): obtain a copy of the data held about you.
- Right to rectification (Art. 16): have inaccurate or incomplete data corrected.
- Right to erasure (Art. 17): request deletion of your data, within the limits of legal retention obligations.
- Right to data portability (Art. 20): receive your data in a structured, machine-readable format.
- Right to object (Art. 21): object to processing based on legitimate interest, particularly for commercial prospecting purposes.
- Right to restriction (Art. 18): request temporary suspension of processing.
- Withdrawal of consent (Art. 7.3): withdraw your consent at any time for consent-based processing (e.g. cookies), without retroactive effect.
7. How to Exercise Your Rights
To exercise any of your rights, send your request to OHLALA SAS:
📮 OHLALA SAS — Data Protection, C/O Flex'O – 470, Promenade des Anglais, 06203 Nice Cedex 3, France
We are committed to responding within one (1) month of receiving your request. For complex requests, this period may be extended by a further two months, with prior notification. Proof of identity may be requested to verify your identity.
8. Right to Lodge a Complaint
If you believe that the processing of your data does not comply with applicable regulations, you have the right to lodge a complaint with the competent supervisory authority:
3 Place de Fontenoy — TSA 80715, 75334 Paris Cedex 07, France
www.cnil.fr
9. Data Security
OHLALA SAS implements appropriate technical and organisational measures to protect your data against any loss, alteration or unauthorised access:
- Encryption of all communications (HTTPS / TLS)
- Back-office access restricted and protected by OTP authentication
- Secure hosting on ISO 27001 certified servers
- No direct storage of bank card data (delegated to Stripe, PCI-DSS certified)
- Regular review of access rights and permissions
10. Cookies
The ohlalalockers.fr website uses cookies, which fall into two categories:
Essential cookies (no consent required): session cookie and CSRF security cookie, essential for the functioning of the website and the booking process.
Consent-based cookies: analytics cookies enabling audience measurement (retention period: 13 months maximum). These cookies are only placed after your explicit consent via the cookie management banner.
You can change your preferences at any time via the "Cookie Settings" link accessible from the footer. Refusing analytics cookies does not affect access to our services.
11. Updates to This Policy
This Privacy Policy may be updated to reflect changes in our practices or regulations. The date of the last update appears at the top of this document. In the event of a material change, you will be informed by email if you are an active OHLALA SAS customer.
Document drafted in accordance with Regulation (EU) 2016/679 (GDPR) and French Law No. 78-17 of 6 January 1978. · OHLALA SAS, 29 rue Gounod, 06000 Nice, France.
