Data protection policy

Our philosophy and commitments

L'Hôtel du Savoir is committed to the protection of your personal data and is committed to ensuring a high level of protection of your personal data in accordance with European Regulation 2016/679 and the Data Protection Act No. 78-17.

As such, you will find below our personal data protection policy explaining to you in particular what personal data we collect, how it is processed and on what basis, their conservation and your personal rights. We invite you to read it.

Our Personal Data Protection Officer is at your disposal to answer all your questions, you can contact him at the following address: RGPD@madeho.fr
You can find the text of the applicable European Regulation here: https://eur-lex.europa.eu/legal-content/FR/TXT/?uri=CELEX%3A32016R0679 or question/contact the regulatory authority (CNIL) via its website www.cnil.fr.

‍
This version of the personal data policy may be amended by us if necessary and you will be informed.
‍

Your data controller

The Hôtel du Savoir is the data controller responsible for processing your personal data and whose contact details you will find below: 1, rue Racine, 75006 Paris, France; it is referred to by its name or “We” herein.

Your personal data and their collection by Hôtel du Savoir

Your personal data may be collected when:

your visit to our site,
our exchanges,
our prospecting actions,
the formation or execution of our contracts.

We do not collect any data that is not necessary for the processing purpose mentioned during the collection or data prohibited by law or regulation.

The collection of certain data may be mandatory or optional and you are informed of the mandatory information. Your personal data may be collected by third party service providers or partners, who are committed to complying with European and national regulations on personal data.

Our policy is not to transfer your data outside the European Union; if, by exception, we do so, this transfer can only take place to a country or an organization subject to an adequacy decision (art.45 RGPD) or offering sufficient appropriate guarantees (art.46 RGPD).

We don't make any automated decisions.

We are potentially required to collect your following personal data:

Civil status, identity, contact details, images
Personal life
Professional life
Personal economic and financial data
Login data
Unique national identification number
Health data
Criminal convictions or offenses

Our processing of your personal data

We process your personal data by entering them into the databases; they are stored, retained and, if necessary, rectified, deleted, archived, anonymized or pseudonymized, transferred to trusted third parties.

We are required to process your personal data for the following processing purposes or for purposes specified to you at the time of collection:

Your information on our commercial offers (products, services...) and promotional offers — Communicating with you

We may use your personal data for commercial prospecting purposes, and in particular in order to send you information on our products/services, our commercial and promotional offers, quotes and other pre-contractual documents, our news by email, post or telephone.

The execution of your current contracts and customer follow-up

We use your personal data to ensure the execution of current contracts in accordance with your requests. We are also likely to send you any information about your order or your current contracts, their execution, your invoices and contractual documents, advice, the execution of our guarantees if applicable and our legal obligations. We still use your personal data to manage our customer relationship, your requests or complaints, if any disputes and to monitor your customer history.

Improving the use of our services and improving our offers

We process your personal data to allow you to make optimal use of our services, to improve our offers and products/services, and to follow your user journey, to carry out satisfaction surveys, surveys and anonymous statistics.

Your payments

Your bank details can be collected either directly by us or by a dedicated and selected service provider, which guarantees the complete confidentiality of your banking data and these details are only kept for the time necessary for the duration of the contractual relationship or within legal limits.

Protection against fraudulent initiatives

The personal data collected can be used to fight against fraud, in particular on payments or withdrawals made. As such, our payment security providers can be made recipients of this data.

Ensuring respect for the law and court decisions

Your data can be used to:

respond to a request from an administrative or judicial authority, a legal representative, a judicial officer or comply with a court order;
ensure compliance with our general conditions of sale/service;
protect our rights and/or obtain compensation for any damage we may suffer or limit the consequences;
prevent any action contrary to the laws in force, in particular in the context of the prevention of fraud risks.

We may still need to process your personal data for the following purposes:

Business relationship
Sending marketing campaigns by email, post or telephone (including via a service provider)
Various
Electronic signature
Internet
Create and manage your user account
Managing cookies
- Performance cookies — (allowing anonymous statistics and level of traffic on the site to be established) and tracking and personalization cookies collecting information on your use of the site and allowing the individualization of our offers,
- Third-party cookies — to target advertisements that may interest you based on your identified interests (these cookies are issued and processed under the policy applied by third parties and not the policy of Hôtel Petit Belloy),
- Analytical cookies — allowing us to understand and analyze your browsing on our site.

The basis for processing your personal data

In accordance with the regulations, the processing of your personal data by us is based if it is based on one of the following bases:

Your consent to the processing of your data by us: you agree to the processing of your personal data by means of express consent. You can withdraw this consent at any time with our DPO; or
The existence of a contract between you and us: the processing of the data is then justified by the needs of the execution of the contract; or
Our legitimate interest in processing your personal data as long as this proportionate interest respects your fundamental rights and your privacy; or
The law or regulations in force when they require us to process and store your personal data.

Methods and periods of storage of your personal data

We manage your personal data in three phases:

An active phase where the data is kept for the time indicated below in an “active” database: your personal data is then accessible only by persons who have an operational need to access it in order to carry out authorized treatments
An archiving phase (for an additional time than the storage in an “active” database) when a legitimate reason justifies it: your personal data is then archived with restricted access and for a limited period of time.
A deletion or anonymization phase: at the end of the additional archiving within the time limits below, your personal data is deleted or anonymized (so that they can no longer constitute personal data identifying you).

Your personal data is kept for the time necessary for the purposes of their processing, our customer relationship if applicable and the execution of contracts and within the limits specifically established by regulation; we are likely to keep your personal data in archiving for the purposes of maintaining accounting, fiscal or evidentiary supporting elements for the duration of the applicable requirements. As an example, we indicate below the storage periods applying to the following treatments (subject to regulations requiring a differentiated storage period):

Withdrawal of your consent to the collection or processing of your personal data

Your consent granted for the collection of your personal data can be withdrawn by writing to our DPO by email or by post to the addresses on the header by mentioning your name, first name, email and address with the nature and the precise purpose of your withdrawal request.
You can also send us any comments on your personal data to Hôtel du Savoir, 1, rue Racine, 75006 Paris, France.

Exercising your rights over your personal data

You have:

A right of access, which allows you to obtain:
Confirmation whether or not data concerning you is being processed;
The communication of a copy of all the personal data held by the data controller.
The right to request the portability of certain data: it allows you to retrieve your personal data in a structured, commonly used and machine-readable format.
A right of opposition: it allows you to no longer be the subject of commercial prospecting by us or our partners, or, for reasons relating to your particular situation, to stop the processing of your data for the purposes of research and development, the fight against fraud and prevention.
A right of correction: it allows you to have information concerning you corrected when it is obsolete or erroneous. It also allows you to have incomplete information about yourself completed.
A right of deletion: it allows you to obtain the deletion of your personal data subject to the legal retention periods. In particular, it may apply in the event that your data is no longer necessary for processing.
A right of limitation: It allows you to limit the processing of your data in the following cases:

In case of unlawful use of your data;
If you dispute the accuracy of your information;
If you need to have the data to ascertain, exercise or defend your rights.
They will then no longer be subject to active treatment, and cannot be modified during the exercise of this right.
A right to obtain human intervention: data controllers can use automated decision-making in order to subscribe or manage your contract. In this case, you can ask the Data Protection Officer what were the determining criteria for the decision.

You can exercise these rights by email to the attention of DPO: RGPD@madeho.fr or by letter to the following address: 1, rue Racine, 75006 Paris, France by indicating your name, first name, address and e-mail (if applicable your customer references) as well as the subject of your request in clear and legible terms. The Hotel du Savoir undertakes to respond to your verified request within one month of receiving it.
In case of difficulty, you can contact our personal data protection officer directly by email: RGPD@madeho.fr or contact the National Commission for Information Technology and Freedoms (CNIL).

Our subcontractors and partners

L'Hôtel du Savoir is likely to transmit your personal data to subcontractors providing services involving the processing of your data and in compliance with the purposes referred to herein; these subcontractors must give your personal data the same level of confidentiality as the Hôtel du Savoir and are committed to being in perfect compliance with the regulations on personal data, in particular with the RGPD.

We do not trade your personal data; if you want to know more and specifically know the identity of the service providers or partners to whom your personal data has been transmitted, you can contact our DPO at the following address: RGPD@madeho.fr

The service providers or partners likely to access your personal data may in particular be:

service providers likely to manage outsourced services for the execution of our services and contracts,
service providers who help us improve our services, conduct data analyses and optimize our offers, conduct surveys and statistics,
auditors, accountants, consultants, consultants, lawyers, lawyers, audit firms, IT and outsourcing providers, security providers,
investors and buyers.

We may also be required to transmit your personal data to the French authorities, administrations and courts, in particular in the context of legal action or legal formalities requiring this communication.