Introduction

  The General Data Protection Regulation (GDPR) came into force on 25 May 2018. Chapitre Six informs its clients and visitors that protecting your privacy is a priority for us, and we are committed to complying with the regulations in force. Chapitre Six, acting as data controller for its hotel activities, fulfils its duty to inform its clients and visitors. The purpose of this notice is to inform you clearly and transparently of how your personal data is collected, used, stored and protected. Your personal data (hereinafter “your Data”) is processed by Chapitre Six, whose registered office is located at 4 rue Lamennais, 75008 Paris.

1. Data controller

  The data controller depends on the processing concerned:

• Client data of each hotel (booking, stay, invoicing, client relations): each establishment of the collection determines the purposes and means of processing the data of its own clients. The company operating the hotel concerned is therefore the data controller; its full identity is set out in the Site’s legal notice.
• Operation of the group Site (Site management, browsing, overall statistics): the company Chapitre Six (SAS, 4 rue Lamennais, 75008 Paris – RCS Paris 818 755 779) is the data controller.
• Cross-property marketing (see section 7): Chapitre Six and the operating companies concerned act as joint controllers within the meaning of Article 26 of the GDPR.
• 
  

2. Why do we use your personal data?

  Your personal data is collected for the following purposes:  

Purpose	Legal basis
Client relationship management	Performance of a contract
Management of hotel and restaurant bookings	Performance of a contract
Additional services	Performance of a contract
Handling of data subject requests	Legal obligation
Loyalty programme	Consent
Marketing communications	Legitimate interest
Internet access service	Consent

3. What types of data do we collect?

  We collect your personal data directly when you book by email, by telephone, on site or via the form on our hotels’ websites. This data may also be collected indirectly, i.e. by our booking processors. In carrying out the processing operations mentioned above, we collect the following personal data, which is necessary for their performance:

• Identification data: surname, first name, postal address, telephone number, email address, country of residence, national identity card, vehicle registration plate, nationality and data relating to your previous bookings.
• Professional data: Company (optional).
• Financial data: bank details (RIB), credit card number and expiry date.
• Personal life data: names and ages of children, as well as their tastes and habits (optional, in order to personalise the client experience as best we can).
• Health data: allergies, intolerances, smoker or non-smoker.
• 
  

4. Who do we share your personal data with?

  Service providers may assist us in our activities on behalf of Chapitre Six (institutional and commercial partners, payment processors, booking management processors). In this context, we may disclose your personal data to the service providers we use. Under their contracts, these providers may neither use nor disclose this data, except to the extent necessary to provide the services or to comply with legal obligations. This processing may involve a transfer of your data outside the European Union. Where your data is transferred to countries outside the European Union, appropriate safeguards, such as standard contractual clauses approved by the European Commission, are put in place to ensure a level of protection equivalent to that provided within the EU.  

5. How long do we keep your personal data?

  Your personal data is kept strictly for the time necessary to carry out the required processing, including full management of the data life cycle, from collection to deletion or archiving, and in accordance with applicable legal requirements (e.g. for 5 years from the end of the commercial relationship for Chapitre Six clients). Once the purposes have been achieved and the legal periods have expired, your data is deleted or anonymised.  

6. Cookie policy

  When the site is visited, cookies and other trackers may be placed on or read from the user’s device. Trackers that are strictly necessary for the operation and security of the site, for remembering the user’s choices and for the operation of the booking service are placed without consent, in accordance with Article 82 of the French Data Protection Act (“Informatique et Libertés”). Audience measurement, personalisation, social media, advertising and campaign measurement trackers are subject to the user’s prior consent. Audience measurement trackers may, however, be exempt from consent where they meet all the conditions set by the CNIL, in particular where they are strictly limited to audience measurement on behalf of the publisher alone, namely SAS Chapitre Six. On the first visit, the cookie banner allows the user to accept or refuse non-essential trackers with the same degree of ease, or to configure them by purpose. Continuing to browse, closing the banner or scrolling a page does not constitute consent. No tracker subject to consent is placed before a positive choice has been expressed. Users may change their preferences or withdraw their consent at any time via the “Cookie settings” link available HERE. Their choice, whether acceptance or refusal, is kept for six months. Trackers subject to consent have a lifetime of 6 months. The information collected through them is kept for no longer than twenty-five months. When these periods expire, the user’s consent is requested again. Some trackers are placed by third-party partners — in particular the booking engine, audience measurement tools, social networks and platforms broadcasting external content — which apply their own retention periods, within the limits of the above ceilings. This is the case, in particular, for Google Analytics (audience measurement) and Meta (social networks and advertising), which act in part as data controllers and whose processing periods and conditions are described in their own privacy policies. Where these partners transfer data outside the European Economic Area, such transfers are governed in accordance with Articles 44 et seq. of the GDPR. Browser settings can also be used to block or delete cookies. However, this may impair certain features of the site, in particular the booking service.  

7. Cross-property marketing

  With your consent, certain data (identity, contact details, stay preferences) may be shared between the operating companies of the collection and Chapitre Six in order to offer you offers relating to other establishments of the group. This processing is carried out under joint controllership within the meaning of Article 26 of the GDPR; an agreement concluded between the entities concerned defines their respective roles, and its main terms are available on request from the DPO. You may withdraw your consent at any time. Outside these operations, each hotel keeps its own client database.  

8. Data Protection Officer (DPO)

  A single Data Protection Officer has been appointed at group level. For any question relating to your data or to exercise your rights, you may contact them: DPO – Chapitre Six Ms Marie Helynck Address: 4 rue Lamennais – 75008 Paris Email: dpo@chapitresix.com  

9. What are your rights and how can you exercise them?

  In accordance with the GDPR, you have the following rights:

• Right of access: obtain a copy of the personal data we hold about you.
• Right to rectification: request the correction of inaccurate or incomplete data.
• Right to erasure: request the deletion of your data.
• Right to object: object to the processing of your data on legitimate grounds.
• Right to restriction of processing: request the suspension of the processing of your data in certain cases.
• Right to data portability: receive your personal data in a structured, commonly used format.
• Right to withdraw your consent at any time, for processing based on consent, without affecting the lawfulness of processing carried out previously.

The exercise of these rights depends on the context and may vary according to the specific situation in which the personal data is processed (e.g. a request by an active employee of the company to delete their personnel file cannot be granted). To exercise your rights, send your request to the group Data Protection Officer (contact details in section 8) or directly to the establishment concerned. You may be asked to prove your identity. For any further information, complaint or to exercise your right of appeal, you may contact the French data protection authority, the Commission Nationale de l’Informatique et des Libertés (more information on its website www.cnil.fr).  

10. Data security

  We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure or destruction. © Chapitre Six – Last updated: 1 October 2026