Privacy Policy

Introduction

 

The General Data Protection Regulation (GDPR) came into force on 25 May 2018. Chapitre Six informs its guests and visitors that protecting your privacy is a priority for us, and we are committed to complying with the regulations in force.

Chapitre Six and the operating companies of the properties in the collection attach particular importance to the protection of your personal data. Depending on the processing concerned, Chapitre Six, the operating company of the relevant property, or these entities jointly act as data controller(s), under the conditions set out in section 1 of this Policy.


1. Data controller

 

The identity of the data controller depends on the processing concerned:

  • – Guest data of each hotel (booking, stay, invoicing, customer relations): each property in the collection determines the purposes and means of processing the data of its own guests. The operating company of the hotel concerned is therefore the data controller; its full identity is set out in the legal notice of the Site.
  • – Operation of the group Site (Site management, browsing, overall statistics): Chapitre Six (SAS, 4 rue Lamennais, 75008 Paris – Paris Trade and Companies Register no. 818 755 779) is the data controller.
  • – Cross-property marketing (see section 7): Chapitre Six and the operating companies concerned act as joint controllers within the meaning of Article 26 of the GDPR.
  •  

2. Why do we use your personal data?

 

  Your personal data is collected for the following purposes:  


Purpose Legal basis
Client relationship management Performance of a contract
Management of hotel and restaurant bookings Performance of a contract
Additional services Performance of a contract
Handling of data subject requests Legal obligation
Loyalty programme Prior consent, in particular for cross-property marketing
Marketing communications Legitimate interest, under the conditions permitted by applicable regulations
Internet access service Consent

3. What types of data do we collect?

 

We collect your personal data directly when you make a booking by email, by telephone, on site or via the form on our hotels’ websites. This data may also be collected indirectly, i.e. through our booking processors.

Depending on the services requested, and only where this information is necessary, we may process the following categories of data:


  • – Identification data: surname, first name, postal address, telephone number, email address, country of residence, national identity card, vehicle registration number, nationality and data relating to your previous bookings.
    • – Professional data: company (optional).
    • – Financial data: bank details (RIB), credit card number and expiry date.
    • – Personal life data: surname, first names and ages of children, as well as their tastes and habits (optional, in order to personalise the guest experience as far as possible).
    • – Data relating to food allergies or intolerances voluntarily provided by the guest where necessary to deliver a suitable service: intolerances, smoker or non-smoker.

4. Who do we share your personal data with?

 

Service providers may assist us in our activities on behalf of Chapitre Six (booking and PMS providers; payment providers; IT and hosting providers; CRM and customer relations tools; marketing providers where applicable; group companies where sharing is based on an appropriate legal basis; administrative or judicial authorities where required by law). In this context, we may disclose your personal data to the service providers we use.

Under the terms of their contract, our processors acting on our behalf may neither use nor disclose this data, except to the extent necessary to provide the services or to comply with legal obligations. Such processing may involve a transfer of your data outside the European Economic Area.

Where data is transferred outside the European Economic Area, such transfers are based, as the case may be, on an adequacy decision of the European Commission or on appropriate safeguards, in particular the standard contractual clauses adopted by the European Commission. Information on the applicable safeguards may be obtained from the DPO.

Where your data is transferred to countries outside the European Union, appropriate safeguards, such as standard contractual clauses approved by the European Commission, are put in place to ensure a level of protection equivalent to that provided within the EU.  


5. How long do we keep your personal data?

 

Your personal data is kept strictly for the time necessary to carry out the required processing, including management of the full data lifecycle from collection to deletion or archiving, and in accordance with applicable legal requirements (3 years after the end of the business relationship for guests, and 3 years after collection or last contact for prospects).

Once the purposes have been achieved and the legal retention periods have expired, your data is deleted or anonymised.


6. Cookie policy

 

  When the site is visited, cookies and other trackers may be placed on or read from the user’s device. Trackers that are strictly necessary for the operation and security of the site, for remembering the user’s choices and for the operation of the booking service are placed without consent, in accordance with Article 82 of the French Data Protection Act (“Informatique et Libertés”). Audience measurement, personalisation, social media, advertising and campaign measurement trackers are subject to the user’s prior consent. Audience measurement trackers may, however, be exempt from consent where they meet all the conditions set by the CNIL, in particular where they are strictly limited to audience measurement on behalf of the publisher alone, namely SAS Chapitre Six. On the first visit, the cookie banner allows the user to accept or refuse non-essential trackers with the same degree of ease, or to configure them by purpose. Continuing to browse, closing the banner or scrolling a page does not constitute consent. No tracker subject to consent is placed before a positive choice has been expressed. Users may change their preferences or withdraw their consent at any time via the “Cookie settings” link available HERE. Their choice, whether acceptance or refusal, is kept for six months.

The user may change their choices or withdraw their consent at any time via the “Cookie settings” link permanently available on the Site. The choice expressed by the user is kept for a period of six months, unless they change their preferences. The retention period of each tracker is determined according to its purpose and is specified in the cookie management module.

Some trackers are placed by third-party partners — in particular the booking engine, audience measurement tools, social networks or platforms displaying external content — which apply their own retention periods, within the limits of the above caps. This is notably the case for Google Analytics (audience measurement) and Meta (social networks and advertising), which act in part as data controllers and whose retention periods and processing conditions are described in their own privacy policies. Where these partners transfer data outside the European Economic Area, such transfers are governed in accordance with Articles 44 et seq. of the GDPR.

Browser settings also allow cookies to be blocked or deleted. However, doing so may impair certain features of the site, in particular the booking service.


7. Cross-property marketing

 

Subject to your prior, freely given, specific, informed and unambiguous consent, some of your personal data, in particular your identification data, contact details and stay preferences, may be used by Chapitre Six and the operating companies of the properties in the collection to send you commercial communications about the offers, services and news of other properties in the Chapitre Six collection.

This consent is obtained through a separate affirmative action and does not result from acceptance of the General Terms and Conditions of Sale or from the mere making of a booking.

In the context of this processing, Chapitre Six and the operating companies concerned jointly determine certain purposes and means of the processing and, as such, act as joint controllers within the meaning of Article 26 of Regulation (EU) 2016/679.

A joint controllership agreement sets out, in particular, their respective roles and responsibilities with regard to informing data subjects, the exercise of rights, security and data management. The essence of this agreement may be obtained on request from the Data Protection Officer (DPO).

You may withdraw your consent at any time, without giving reasons and without affecting the lawfulness of processing carried out before withdrawal, in particular by using the unsubscribe link included in each commercial communication or by contacting the DPO using the contact details set out in section 8.

Outside this cross-property marketing processing, each operating company remains responsible for the processing it carries out to manage its own guests and maintains its own guest database, subject to the other processing operations and data sharing provided for in this Policy.  


8. Data Protection Officer (DPO)

 

  A single Data Protection Officer has been appointed at group level. For any question relating to your data or to exercise your rights, you may contact them: DPO – Chapitre Six Ms Marie Helynck Address: 4 rue Lamennais – 75008 Paris Email: dpo@chapitresix.com  


9. What are your rights and how can you exercise them?

 

In accordance with the GDPR, you have the following rights:


  • – Right of access: obtain a copy of the personal data we hold about you.
  • – Right to rectification: request the correction of inaccurate or incomplete data.
  • – Right to erasure: request the deletion of your data.
  • – Right to object: object to the processing of your data on legitimate grounds.
  • – Right to restriction of processing: request the suspension of the processing of your data in certain cases.
  • – Right to data portability: receive your personal data in a structured, commonly used format.
  • – Right to withdraw your consent at any time, for processing based on consent, without affecting the lawfulness of processing carried out previously.

These rights are exercised under the conditions and within the limits laid down by applicable regulations; their scope may vary in particular depending on the legal basis and purpose of the processing concerned.

To exercise your rights, please send your request to the group’s Data Protection Officer (contact details in section 8) or directly to the property concerned. You may be asked to provide proof of identity.

For any further information, complaint or to exercise your right of appeal, you may contact the Commission Nationale de l’Informatique et des Libertés (CNIL), the French data protection authority (more information at www.cnil.fr).


10. Data security

 

  We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure or destruction.