MAJESTIC APARTMENTS

DATA PROTECTION POLICY

Our vision of personal data protection

Given the relationship of trust that exists between Les Hôtels Baverez and their customers and partners, Les Hôtels Baverez have wished to set out a personal data protection policy in accordance with the requirements laid down in the European General Data Protection Regulation (“GDPR”) .

Les Hôtels Baverez undertake to protect the privacy of their customers and partners (“data subjects”) within the framework of their activities by ensuring the protection, confidentiality and security of the personal data collected.

The main objective of this data protection policy is to concentrate in a single document clear, simple and precise information concerning the data processing operations carried out by Les Hôtels Baverez, in order to enable the data subjects to understand what information and personal data (“personal data”) are collected, how they are used and what their rights are with regard to these personal data.

Les Hôtels Baverez have also appointed an internal Data Protection Lead and an external Data Protection Officer (DPO). They can be contacted by any interested person by post by writing to: “Service DPO, Les Hôtels Baverez, 2 place des pyramides, 75001, Paris” or electronically by sending an email to: “contact- DPO@hotels-baverez.com”.
The designated external DPO is the Lexing - Alain Bensoussan Avocats law firm.

1. Definitions

‐ “collect” means to obtain personal data. Data may be collected at the time of booking, during the stay(s), or during the contractual relationship between Les Hôtels Baverez and the data subjects;
‐ “consent” means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
- “controller” means the person or body which, alone or jointly with others, determines the purposes and means of the processing of your personal data;
- “online services” means digital services offered by Les Hôtels Baverez, such as websites, applications, or associated services;
- “partners” should be construed in the broadest sense and means in particular service providers, subcontractors, intermediaries, and suppliers working with Les Hôtels Baverez;
- “processing of personal data”: means any operation or set of operations in relation to data, whatever the mechanism used;
- “products or services” means all products and services, including technological products and services (websites, applications and associated services) offered or to be offered by the Les Hôtels Baverez;
- “prospect” means any person who has contacted Les Hôtels Baverez to obtain information about a product or service offered by Les Hôtels Baverez.

2. When do we collect personal data?
Personal data may be collected primarily in the context of:
‐ the entry into contact with Les Hôtels Baverez;
‐ the reservation of products and services offered by Les Hôtels Baverez;
‐ the data subject’s use of any Les Hôtels Baverez’s products and services, including technological services (website, application, and associated services);
‐ the provision of products or services to meet specific customer requests;
‐ the relationship between Les Hôtels Baverez, their prospects, customers and partners;
‐ the performance of contracts;
‐ the performance of legal or regulatory obligations relating to the activity of Les Hôtels Baverez and having an impact on the protection of personal data (such as police records for foreign customers, tourist taxes, obligations in relation to tax, audit, or anti-fraud, anti-money laundering and anti-terrorist financing, judicial requisition);
‐ and those relating to the management of the commercial relationship in particular in relation to complaints or satisfaction surveys.
- the personalized advertising proposition according to your purchasing intentions using our Oraculo profiling and marketing tool

3. What categories of data do we process?
Personal data means any information relating to a natural person which permits to identify him or her, directly or indirectly.
Personal data may include an individual’s first and last name, telephone number, photograph, video recording, postal address, email address, occupation, hobbies, location data, computer’s IP address.

The data collected by Les Hôtels Baverez may be divided into the following main categories:

3.1 Declarative personal data
Declarative personal data are those provided by the data subjects and collected by Les Hôtels Baverez in the context of commercial or contractual relationships.
The data come mainly from the data subjects and the persons authorized by the data subjects to transmit them to Les Hôtels Baverez.
For example, the data subject may be asked to provide personal data relating to his or her preferences (e.g. in terms of food or press) or to his or her family, economic, property and financial situation, or data which may potentially allow to deduce information relating to his or her health, religious affiliation (food allergy, accessories for the practice of a religion) to be deduced.

Personal data may also be collected as part of the hosting service.

3.2 Personal data related to the functioning of Les Hôtels Baverez’s products and services
Personal data may arise from the use by the data subjects of Les Hôtels Baverez’s products and services or may relate to operations carried out via the products and services offered by Les Hôtels Baverez in the context of their relationship with the data subject.
For example, information is collected on the services provided during the data subject’s stay in order to improve customer knowledge, the comfort of the stay or the organization of future stays.

3.3 Personal data from third parties
The personal data processed may also come from:
- booking intermediaries;
- loyalty programs to which the customer has subscribed;
- subcontractors, partners of Les Hôtels Baverez or third parties to Les Hôtels Baverez if their personal data protection policies allow it;
- third parties (hotels, associations, police services, etc.) in relation to the fight against fraud, unpaid bills and bad behavior;
- other products or services provided by third parties to which the data subjects have subscribed and/or for which they have authorized sharing with Les Hôtels Baverez.

3.4 Public personal data
Les Hôtels Baverez may collect public personal data concerning the data subjects and use such public information or personal data where permitted by law or regulation and in compliance with the specific rules of communication and re-use specified by such law or regulation.

3.5 Personal data calculated or inferred by Les Hôtels Baverez
Les Hôtels Baverez may generate or calculate new personal data on the basis of declarative personal data or data related to the functioning of the products and services, in particular to adapt their products and services and personalize the offers that can be made to customers.

3.6 Exclusion of special categories of data
As a matter of principle, special categories of personal data are not collected. Special categories of personal data are data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, personal genetic data, personal biometric data for the purpose of uniquely identifying a natural person, personal data concerning health or personal data concerning a natural person’s sex life or sexual orientation.
It may happen that these special categories of personal data, which must be subject to special attention, are processed by Les Hôtels Baverez, in compliance with the conditions laid down by the regulations relating to the protection of personal data.
For example, certain requests for products or services may potentially allow information relating to health or religious affiliation (food allergy, accessories for the practice of a religion) to be deduced.

4. What personal data do we process?
Les Hôtels Baverez process the following main personal data:
For customers and their accompanying persons:

- Title;
- Surname / First name;
- Sex;
- Date of birth / age;
- Languages;
- Nationality / place of origin;
- Contact information (mailing address and email address, telephone number);
- Employer (in the event of a business booking);
- Profession (business cards);
- Duration and date of booking, and stays;
- Preferences or specific requests expressed during the booking and/or stay;
- Special points of attention necessary for the smooth running of the stay (such as the risk of allergies or medical information about contraindications to spa treatments).

For prospects:
- Surname / First name;
- Sex;
- Date of birth / age;
- Languages;
- Contact information (mailing address and email address, telephone number);
- Bank details;
- Connection data (IP, Logs, tracers);
- Logs.

For partners:
- Title;
- Identity;
- Sex;
- Home address;
- Business address;
- Name of the legal representative;
- Name of the employer;
- Telephone (Landline, Mobile, Business);
- Business email address;
- Internal identification code;
- Accountant;
- Contract;
- Business bank details;
- VAT number;
- Data date of entry;
- Data update date.

5. How do we share the data we collect?
The personal data collected, as well as those that will be obtained later, are intended for Les Hôtels Baverez in their capacity as the data controller.
Les Hôtels Baverez ensure that the personal data of the data subjects are only accessed by authorized persons and only when necessary for the performance of their tasks.
Some personal data may be sent to third parties to comply with legal, regulatory or contractual obligations or to legally authorized authorities (such as prefecture de police, Paris City Hall, obligations under the AML/CFT (Anti-Money Laundering/Combating the Financing of Terrorism) area, Tracfin declaration).
At the request of their customers, Les Hôtels Baverez may transmit personal data to third parties in order to subscribe to products and services from these third parties (book a restaurant, a private car, travels or tickets for a show). Customers are informed that Les Hôtels Baverez are only responsible for their own processing; customers are therefore invited to contact the third party recipients to be informed of the terms and conditions of any processing carried out in that context.
Finally, your data may be transmitted to our subcontractor The Hotel Network, with your express consent, to allow us to offer you personalized advertising according to your purchasing intentions.

6. How long do we keep personal data?
Personal data are stored in Les Hôtels Baverez’s information systems or those of their subcontractors or providers.
As a matter of principle, Les Hôtels Baverez undertake to choose subcontractors and providers who meet the best quality and security criteria and provide sufficient guarantees in terms of reliability, security and resources to implement technical and organizational measures.

7. What guiding principles do we apply for the protection of personal data?
Regulations on the protection of personal data set out several key principles that Les Hôtels Baverez undertake to observe scrupulously.

7.1 Lawfulness of processing
Les Hôtels Baverez and each of their employees undertake that they will not process data collected unlawfully.
Processing is lawful to the extent that at least one of the following applies:
- the data subject has given consent to the processing of his or her personal data for one or more specific purposes (such consent may be given by a written statement, including by electronic means, or an oral statement, or when using the services);
- processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
- processing is necessary to comply with a legal obligation to which Les Hôtels Baverez are subject;
- processing is necessary in order to protect the vital interests of the data subject or of another natural person;
- processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in Les Hôtels Baverez;
- processing is necessary for the purposes of the legitimate interests pursued by Les Hôtels Baverez or by a third party.
The processing operations carried out by the Hotels Baverez are only carried out if at least one of the above conditions is met.

7.2 Legitimate purpose
Personal data are collected and processed by Les Hôtels Baverez for specified, explicit and legitimate purposes at all times.
Committed to guaranteeing the ethics and security of the personal data of their customers, Les Hôtels Baverez use personal data in accordance with the terms of this data protection policy, and the general terms and conditions of the products and services subscribed by the customer.
Les Hôtels Baverez use all or part of the personal data for the following main purposes:

- the proposition of personalized advertising according to your purchasing intentions using our profiling tool;
- taking steps at the request of the data subject prior to entering into a contract;
- executing and performing services;
- managing their customers’ reservations and stays;
- managing relationships with their partners;
- managing contracts entered into with the data subjects;
- managing their activities;
- managing their websites;
- measuring the quality and satisfaction of their customers;
- ensuring customer satisfaction;
- continuously improving the quality of their products and services;
- improving knowledge of their customers;
- compiling statistics.

7.3 Fairness and transparency
Les Hôtels Baverez undertake to provide fair, clear and transparent information.
Les Hôtels Baverez have the means to provide any necessary clarification regarding their data protection
policy upon request of the data subject.

7.4 Rights of data subjects
The individuals whose data are processed are granted the following rights, unless otherwise legally
required from Les Hôtels Baverez:
- the right of information;
- the right of access;
- the right to rectification;
- the right to erasure or the right to be forgotten;
- the right to portability;
- the right to object;
- the right to restriction of processing;
- the right to question.

7.4.1 Procedures for exercising these rights
For any questions or requests regarding the processing of personal data by Les Hôtels Baverez, data subjects can contact the internal Data Protection Lead at: “contact-DPO@hotels-baverez.com”.

7.4.2 Right of information
The data subjects acknowledge that this data protection policy provides them with information about the purposes, the legal framework, the legitimate interests pursued by Les Hôtels Baverez, the recipients or categories of recipients with whom their personal data are shared, and the possibility of a data transfer data to a third country or international organization.
However, regarding the right of information, Les Hôtels Baverez are not required to provide information if the data subjects already possess the information, if the recording or disclosure of their personal data is expressly laid down by law, or if the provision of information proves to be impossible or would involve a
disproportionate effort.

7.4.3 Right of access and to rectification
The data subjects have a right to access and rectify their personal data, which they can exercise with Les Hôtels Baverez.
In this respect, the data subjects may obtain confirmation as to whether or not personal data concerning them are being processed, and, where that is the case, access to those personal data:
Data subjects may ask Les Hôtels Baverez, as the case may be, to rectify or complete their personal data that are inaccurate, incomplete, equivocal or expired.
Any request for exercising the right of access and rectification must be made in writing by sending a letter together with a copy of an identity document.

7.4.4 Right to erasure or right to be forgotten
Data subjects may ask Les Hôtels Baverez to erase their personal data where one of the following grounds applies:
- the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
- the data subject withdraws his or her consent;
- the data subject objects to the processing of his or her personal data;
- the processing of personal data does not comply with the provisions of the applicable legislation and regulations.
However, data subjects are informed that the exercise of this right will not be possible when the retention of their personal data is necessary for compliance with statutory or regulatory provisions and in particular for example for exercising the right of freedom of expression and information, or for the establishment, exercise or defense of legal claims.

7.4.5 Right to portability
In view of the nature of the products and services offered by Les Hôtels Baverez, the exercise of this right is not applicable insofar as the personal data collected by Les Hôtels Baverez are not affected by the right to portability.

7.4.6 Right to object
The data subject has the right to object, on grounds relating to his or her particular situation, at any time, to processing of personal data concerning him or her.
In particular, you can object to our personalized advertisements being offered to you using our profiling tool by refusing this processing through the dedicated banner or by exercising your rights in accordance with this confidentiality policy.
If the right to object is exercised, Les Hôtels Baverez will stop the processing unless there are compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of a legal claim.

7.4.7 Right to restriction of processing
The data subjects may request restriction of processing of their personal data in the cases provided for by law and regulation regarding the protection of personal data.

7.4.8 Right to lodge a complaint
The data subjects have the right to lodge a complaint under the conditions set out in the paragraph “Right of access and to rectification” above, without prejudice to any other administrative or judicial remedy.

7.5 Proportionality
For each processing operation, Les Hôtels Baverez undertake to ensure that the processing operations are adequate and to collect and process only data that are strictly necessary for the aim pursued.

7.6 Automated decision-making
There is no automated decision in the context of the processing carried out by Les Hôtels Baverez.

7.7 Storage period and restriction
Les Hôtels Baverez undertake that they will not keep personal data longer than is necessary to fulfil the purposes for which they are stored or no longer than the period provided for by the regulations relating to the protection of personal data.

7.8 Data accuracy
Les Hôtels Baverez are committed to ensuring that the data collected are complete and as up-to-date as circumstances permit.

7.9 Framework for transfers outside the European Union
The personal data that data subjects in the territory of the EU have transmitted to Les Hôtels Baverez in accordance with the agreed purposes may be transferred to countries inside the European Union or outside the European Union.
In case of transfers to a country outside the European Union, rules have been put in place to ensure the protection and security of the data.
In all cases, but exclusively for the processing for which they are the controller or joint controller, Les Hôtels Baverez undertake to take all necessary and appropriate measures to ensure the security of personal data.
These personal data may be communicated, at the request of the data subjects, to official bodies and to authorized administrative or judicial authorities, or to third parties. In this case, the data subjects are invited to contact the third parties concerned to obtain information on the conditions under which their data will be processed.

7.10 Commitment to security and confidentiality
Les Hôtels Baverez undertake to implement security measures appropriate to the degree of sensitivity of the personal data to protect them against any malicious intrusion, loss, alteration or disclosure to unauthorized third parties.
All personal data are confidential. Thanks to technical devices implemented in the electronic system, access to personal data is limited to authorized persons only, on a need-to-know basis, for performing their tasks. All persons having access to the data are subject to a duty of confidentiality and will be subject to disciplinary measures and/or other penalties if they do not comply with those obligations.

However, the security and confidentiality of personal data are based on everyone’s good practices and data subjects are invited to be vigilant.

8. Profiling
In order to provide you with exceptional and personalized offers, Les Hôtels Baverez uses the Oraculo tool which is based on a profiling algorithm to determine your buyer profiles, and thus allows us to propose to you our best offers . This algorithm is based on your navigation on our website and the collection of your connection data which, once pseudonymized, will allow us to send you the most relevant opportunities according to your profile.
Furthermore, you can, if you wish, request human intervention relating to the use of this technology.
As a reminder, you have the right to object at any time by writing to us as described above.

9. What about professional secrecy?
In accordance with the regulations in force, persons who process the data of the data subjects managed by Les Hôtels Baverez under an employment contract or a contract are required to keep confidential from third parties everything they learn during their professional activity.

10. What about special processing?
As part of their security measures, Les Hotels Baverez use video surveillance systems in some of their premises in accordance with applicable regulations.
Data subjects are informed that these images are recorded and stored and that they may lead to the identification of the filmed persons either by the systems implemented or by the authorized persons having access to the images.
Signs in the filmed areas inform the data subjects about the existence of this type of device, the person in charge, and the procedures for exercising their right of access to the visual recordings concerning them.

11. How to contact us?
If you have question, or in case of difficulty in understanding or applying the rules set out in this policy, you can contact the internal Data Protection Lead liaising with the external DPO at: “contact-DPO@hotels-baverez.com”.

Consent for the collection of personal data

I agree to the use of my last name, first name, and e-mail address by the Baverez Hotels and its affiliates to send me newsletters about their activities.

Mandatory information is marked with an asterisk. If I refuse to communicate this information I won’t receive the newsletters.

These data are stored as long as I have not withdrawn my consent and are intended to the services of Baverez Hotels in charge of the relationship with customers.
I have been informed that I have the rights to information, access, rectification, erasure, restriction of processing and data portability.
I also have the right to object on grounds relating to my particular situation and to object to processing for direct marketing purposes.

These rights can be exercised through the unsubscribe link embedded in the newsletters or from the data protection officer, by e-mail contact-dpo@hotels-baverez.com or by mail to the following address Les Hôtels Baverez SA, Relais interne du DPO sis 2, place des pyramides 75001 Paris, with a signed copy of your ID.

The data protection policy of Baverez Hotels is available on the website: https://www.leshotelsbaverez.com.
In case of dispute, you can contact the supervisory authority: CNIL (www.cnil.fr)