CHARTER OF PERSONAL DATA

I. SCOPE OF APPLICATION AND DEFINITIONS

 Cour des Vosges is a French société par actions simplifiée registered at the Commercial and Companies Registry of Paris under the number 827 781 584, whose registered office is located at 17, avenue de l’Opéra – 75001 Paris, whose business activity is the operation and management of high-end hotels, spas and restaurants including related events associated with or hosted by these establishments.

Cour des Vosges is a member of the hotel group known as Evok Hôtels Collection (hereinafter the “Evok Group”), which is coordinated by the partnership known as Evok Hôtels Collection SNC, located at 17, avenue de l’Opéra in the 1^st arrondissement of Paris (hereinafter “Evok”)

Cour des Vosges currently conducts its business within the framework of the following establishment (hereinafter the “Establishment”) and bespoke website (hereinafter the “Website”):

• Cour des Vosges Paris, located at 19, place des Vosges in the 4^th arrondissement of Paris, comprising a hotel, a bar, a restaurant and a spa;
• courdesvosges.com

Within the framework of its business activities, Cour des Vosges processes personal data within the meaning of the French Act of 6 January 1978 on computer technology, computer files and civil liberties and of the European Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data which entered into force on 25 May 2018, hereinafter “Processing”.

Personal data: personal data is any and all information relating to an identified or identifiable natural person, directly or indirectly, by reference to an identification number or to one or more factors specific to that natural person. To determine whether a person is identifiable, account should be taken of all the means enabling his or her identification which are available or accessible to the controller or to any other person.

Processing: Processing of personal Data means any operation or set of operations performed on such Data, whatever the means used, and in particular the collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, as well as locking, erasure or destruction.

Data Subject: a person concerned by the Processing of personal Data is the person to whom the Data which is the subject of a Processing relates.

The purpose of this Personal Data Processing Charter is to set out for the benefit of those persons coming into contact, or wishing to come into contact, in one way or another, with Cour des Vosges, and in particular users of the Website, the conditions according to which their Personal Data will be subject to Processing, and the rights of the Data Subjects in this regard.

 

1. DATA PROCESSED

1°) Categories of Data:

The Data liable to be processed by Cour des Vosges, from whatever source they are collected, are the following:

• Data relating to vital statistics: first name*, second name*, marital status*; date of birth*;
• Contact data: e-mail address*, land line and mobile phone numbers*, postal address, social media identifiers;
• Login data: details of the connection terminal such as IP address, IMEI number or mobile phone number: nature and model of the terminal; location of terminal; access software and operating systems; connection dates and times;
• Browsing data: pages visited on the Website or before logging on to the Website; browsing time and duration; browsing history; saving of personal preferences;
• Personal-related data: nationality*, country of residence*, copy of identity card* supplied when checking in to the hotel; other information contained on that card: date and place of birth, height, eye colour; family status and composition, age of children; lifestyle habits: beverages, food preferences, pets, other specific personal information disclosed by the Data Subjects ;
• Professional-related data, if a contact, request, booking or purchase is made or a service received on professional grounds or in a professional context and the data disclosed by the Data Subjects ;
• Specific data relating to or liable to reveal, even allegedly:
• personal health, if the Data is volunteered by the Data Subjects in view of specific services or support from the Establishment (for instance in the case of a disability, special eating requirements, specific measures of hygiene);
• political opinions, trade-union membership, philosophical or religious beliefs of persons, if the Data is volunteered by the Data Subjects due to specific demands or to the denomination for which the booking was made or the invoice established (for instance: booking by a political, trade union or religious organisation or association; preparing special meals) ;

Cour des Vosges will only process specific Data where such are combined with a request presented by a Data Subject and that the Processing is necessary to the performance of the services thus requested. Specific Data which is revealed incidentally or allegedly by other non specific Data processed by Cour des Vosges shall not be, per se, subject to Processing.

• Location data: place* and dates* of stays; places visited when ordering taxis or other similar services;
• Payment data*: as appropriate and depending on the customer’s chosen method of payment: RIB (bank identity statement), IBAN, name or corporate name of account holder, credit card details or details of other payment cards accepted by Cour des Vosges (American express, Diners etc.) ; amounts paid for services and billing details.

The Data above marked with an asterisk (*) are indispensable, to the extent they are required by Cour des Vosges, to the conclusion and efficacy of bookings, stays or services ordered, which cannot be validated or provided without disclosing such Data.

The other Data are necessary only to the extent where the Data Subject intends to procure performance of services whose contents or nature are dependent on the relevant Data; their supply is therefore strictly a matter of appraisal by the Data Subjects.

 

2°) Data Subjects:

Data relating to vital statistics and Contact data processed by Cour des Vosges are collected from all persons coming or wishing to come into contact with Cour des Vosges or with the Establishment: customers, prospective clients, suppliers, trade partners, press, job seekers etc., whether by visiting or browsing the Website, by sending contact forms, subscribing to news feeds or to the newsletter or joining the Cour des Vosges, community, via booking forms, e-mails or other correspondence, or verbally by phone or actual physical contact.

Login data and Browsing data processed by Cour des Vosges are collected from all persons that continue browsing the Website after having accepted the use of Cookies other than mere functional Cookies (find out more about Cookies) ;

Personal-related data, Professional-related data, Specific data, Location data and Payment data are collected, as appropriate, according to what is stated in 2°), from all persons making a booking or a stay or other experience (meals, receptions, events, spa) within the Establishment, or more generally receiving a service or goods from the Establishment.

Minors. The Website is designed for majors. Legal guardians of minors must take responsibility to monitor and supervise their use of communication tools, and in particular their web browsing behaviour.

 

3°) Data collected directly by Cour des Vosges:

Cour des Vosges will collect directly itself certain data in certain configurations, as follows:

• On or via the Website
• where the person confirms he or she is a major, before continuing browsing the Website: Data relating to vital statistics (majority) ;
• where the user of the Website fills in and sends a membership form to join the Cour des Vosges community: Contact data (e-mail address) ;

These Data are necessary to the performance and delivery of the service requested, in agreement with the purpose of the Processing.

• via the installation or reading of Cookies and trackers directly installed by Cour des Vosges – find out more about Cookies (see below) : Data relating to vital statistics, Contact data, Login data, Browsing data;
• upon receipt of all other correspondence or miscellaneous contacts (by letter, e-mail, text message, fax, telephone, social media invitation, internet sharing etc.) on the part of any persons having contacted Cour des Vosges by any means whatsoever, and in particular on any address using “@courdesvosges.com” : etc. : Data relating to vital statistics, Contact data, Personal-related data, Professional-related data, Specific data, Location data and Payment data, according to the contents disclosed by the person and to the chosen means of communication; and if the contact is made via the internet: Login data and Browsing data;
• on the occasion of any meeting between people within a professional or commercial context giving rise to voluntary disclosure by the Data Subject (whether public or professional) of such Data, whether verbally, or through the exchange of business cards, brochures or any other materials containing the data: Data relating to vital statistics, Contact data, Professional-related data;
• where the Data Subject makes a booking via e-mail, over the phone or on the spot, or provides such Data when checking in to the hotel: Data relating to vital statistics, Personal-related data, Professional-related data, Specific data, Location data, Payment data, according to the contents disclosed by the person; if contact via internet : Login data and Browsing data ;

 

4°) Data collected by Cour des Vosges’s trade partners:

Cour des Vosges processes Data relating to vital statistics, Contact data, Personal-related data, Professional-related data, Specific data, Location data, Payment data collected by the following persons which are Cour des Vosges partners:

• La Fourchette SAS, via the booking module.lafourchette.com accessible by activating the restaurant booking form on the Website, and on the lafourchette.com website; see the Privacy Policy of La Fourchette SAS
• TravelClick Inc., an American company, via the hotel room booking module reservations.travelclick.com, accessible by activating the booking form on the Website; see Privacy Policy of TravelClick Inc.

Cour des Vosges also processes the same categories of Data that are disclosed to it by booking operators, in particular on-line booking operators, which people use and supply Data to for the purpose of making a booking in the Establishment. Data subjects are required to check on the websites of these operators, or by any other means available, their policies or terms applicable to personal data processing (such as, for instance, but not limited to: Bookatable Limited, website publisher for restaurant.michelin.fr including a booking module, see Privacy Policy of Bookatable Limited ; Booking.com BV; see Privacy Statement of Booking.com).

5°) Data collected via third-party Cookies enabled on the Website

Cour des Vosges processes Login data and Browsing data collected by the Cookies enabled by Cour des Vosges and implemented on the Website by Google, via Google Analytics and Adwords which are used by Cour des Vosges.

Find out more about Cookies.

6°) Publicly accessible Data:

Cour des Vosges also processes publicly accessible Data relating to vital statistics and Contact data, such as for instance, data supplied on a website, a telephone messaging service, the masthead in print publications, publicly available professional registers etc.   

III. CHARACTERISTICS OF PROCESSING

1°) Activities giving rise to Processing:

The personal Data described in II 1° are processed by Cour des Vosges within the framework of the following activities:

Activities(i) :

– Hotel, bar and restaurant services delivered by the Establishment, spa, beauty care and wellness services associated with the Establishment;

– Establishment Venues: organisation of cultural, artistic and entertainment or public relations venues;

– Correspondences with people coming into contact with Cour des Vosges (enquiries, candidacies, offers for goods or services etc.)

All categories of Data according to what is necessary to perform the service or to process the request and what is disclosed by the Data Subject.

Activity (ii) : Involvement of Cour des Vosges and of the afore mentioned activities, in the business activity of the Evok Group (comprising: development of hotel establishments, restaurants, art of living, fitness and wellness centres, conception of promotional strategies and tools, diffusion and communication of the Group, development of commercial packages, creation of events) in its development, in its communications, media exposure and commercial attraction strategy: Data relating to vital statistics, Contact data, Login data and Browsing data.

 

2°) Processing purposes:

Activities (i): the purposes of the Processing are:

– As a general rule: to satisfy, handle, process requests or offers of any kind addressed to Cour des Vosges; to perform, improve, diversify and anticipate services requested by Cour des Vosges’s clients in relation to their stay or experience at the Establishment:

– As concerns the hotel, bar and restaurant services and the spa, beauty care and wellness services associated with the Establishment, and as concerns Establishment Venues: to manage the capacity, organisation, reception desk and customer access services at the accommodation or at the Establishment; to satisfy specific customer requests during their stay or experience at the Establishment (meals, receptions, spa, valet parking, supply of smartphones, pet hospitality, etc.), to personalise or provide customer courtesy or loyalty services, to plan Cour des Vosges’s resources and supplies, to pay for services;

– As concerns other solicitations received by Cour des Vosges: to respond to the contact, to possibly satisfy their request or accept their offer, even at a later date.

Activities (ii): The purpose of the Processing by Cour des Vosges is the transmission of Data to the partnership known as Evok Hôtels Collection SNC, with the following purposes:

Data relating to vital statistics and Contact data: to provide trade communications, promotional and prospecting services relating to the development of the activities of the Evok Group, to implement loyalty programs (to provide a news feed relating to the Evok Group, in particular via the newsletter, invitations to public relations and communications events relating to commercial packages) by means of e-mailing and text messaging campaigns.

Login data and Browsing data: See the Cookies section.

For further details: see Evok’s Personal Data Processing Charter.

 

3°) Controller:

Activities (i) : Cour des Vosges is the Controller.

Activities (ii) : Evok is the Controller.

See Evok’s Personal Data Processing Charter.

 

4°) Basis for Processing:

Activities (i) : The Processing is based:

For the hotel, bar and restaurant services delivered by the Establishment; the spa, beauty care and wellness services associated with the Establishment; Establishment Venues, comprising the organisation of cultural, artistic and entertainment or public relations venues: on performance of the contractual or pre-contractual service requested by the Data Subject ; on the implementation of the legal requirements of the Controller in particular as concerns account keeping and the archiving of business records and invoices; in addition, on the achievement of the legitimate interests pursued by  Cour des Vosges* in any case.

For all other solicitations received by Cour des Vosges: on the achievement of the legitimate interests pursued by Cour des Vosges or on the processing of the solicitation.

*The legitimate interests of Cour des Vosges are in particular to successfully develop, maintain and constantly improve customer relations, to achieve their satisfaction, as well as to diversify and give incentive to its customer base, to maintain the quality of and renew its offering, to maintain an image and brand of luxury hotels, restaurants and venues which are viewed both as very high-end, and cultural, refined and diverse;

Activities (ii):

Data relating to vital statistics and Contact data. The Processing is based on the consent of the Data Subject and, for communication requirements directed at Cour des Vosges’s customers and professionals affiliated with or interested in the business sector of Cour des Vosges and Evok, on the achievement of the legitimate interests pursued by Cour des Vosges and Evok*.

Login data and Browsing data. The Processing is based on the consent of the Data Subject, which is solicited from the very first visit to the Website from which the Data are collected.

*The legitimate interests of Cour des Vosges and Evok are in particular to develop the Evok Group and its establishments, to promote media exposure, commercial attraction, the quality and diversification of its offering and of its key achievements, to maintain and develop an image, a brand and a label of luxury or very high-end amenities.

It is recalled that the Controller in charge of the Processing carried out within the framework of the Activities (ii) is Evok. See Evok’s Personal Data Processing Charter.

 

5°) Contractual requirement of Data:

Only Data relating to vital statistics, certain Contact data (e-mail address and mobile phone number, postal address as appropriate), certain Personal-related data, certain Location data and the Payment data are necessarily required to conclude a booking and to perform a service; they are marked with an asterisk above and are specified to the Data Subject prior to each booking, purchase or solicitation.

Other Data may be freely and voluntarily disclosed by Data Subjects within the framework of their specific requests.

 

6°) Recipients of the Data:

Data relating to vital statistics, Contact data, Login data and Browsing data collected or received by Cour des Vosges are transmitted to Evok within the framework of the aforementioned Processing for which Evok is the Controller. See Evok’s Personal Data Processing Charter.

For Processing operations whose purpose is the management and performance of hotel services, Cour des Vosges uses a platform provided by the German company known as protel hotelsoftware GmbH whose registered office is at Europaplatz 8 – 44269 Dortmund (Germany), which also ensures the storage of the Data collected within the framework of this activity, acting as a processor. See protel’s Privacy Policy.

The performance of certain operations necessary to the Processing implemented within the framework of the Activities (ii) (database formatting and maintenance, storage of Personal data and Contact data) are carried out on behalf of Evok by the company known as Sarbacane Software SAS, registered at the Commercial and Companies Registry of Lille no. 509 569 598, whose registered office is located at 3 avenue Antoine Pinay – Industrial Estate (ZA) “des Quatre Vents” – 59510 HEM, and Experience Hotel Software SAS, RCS Paris B 798 181 699 whose registered office is located at 128 avenue La Boétie 75008 Paris, acting in a processor capacity.
See Sarbacane’s Personal Data Processing Charter. 
See Experience Hotel’s Personal Data Processing Charter

The Data collected or received by Cour des Vosges are not transmitted by Cour des Vosges, or by Evok, to any other recipient apart from, as applicable, the legally empowered authorities, within the framework of a specific assignment or of the exercise of a right of communication.

 

7°) Data retention period:

The Data will be kept in a form which permits identification of Data Subjects for no longer than is necessary for the purposes for which they are processed.

Where Processing is based on the Data Subject’s consent, the Data processed will only be kept by Cour des Vosges for as long as the consent prevails.

Any new disclosure of Data, even where such have already been disclosed beforehand by the Data Subject, according to one or the other of the means of collection mentioned under section II “Data processed” will trigger a new retention period, irrespectively of the previous retention periods.

Personal-related data, Professional-related data, Specific data, Location data and Payment data are kept for the period necessary to the performance of the contractual and pre-contractual services requested by Data Subjects and for which such Data are disclosed.

Personal-related data and Professional-related data, can be kept for an additional period of one year from the end of the Data Subject’s stay or experience within the Establishment.

Specific data are only kept for the period strictly necessary to the performance of the contractual or pre-contractual services requested by Data Subjects and for which such Data are disclosed, or to Cour des Vosges’ adherence to legal requirements (in particular storage and archiving of nominal invoices, book keeping and other accounting or tax requirements).

Payment data are kept for the period strictly necessary to each payment in view of which they are disclosed and to Cour des Vosges’ adherence to legal requirements (in particular storage and archiving of invoices, book keeping and other accounting or tax requirements).

 

1. COOKIES

1°) Definition :

A Cookie is a tracking tool which consists of a small computer file or a short alphanumeric combination, which is automatically installed or read by a network provider or a website on the terminal device (computer, mobile phone, tablet, video games console) of the Data Subject, that can access the data already stored in said terminal, or write or store information on that device.

2°) Purposes to the use or enabling of Cookies and information transmitted by Cookies:

Website operation requires the implementation of the following Cookies, which are presented according to the functionalities provided by each type of Cookie :

– Implementation and facilitation of electronic communication and supply of online communication services, exclusively: Functional cookies;

– Improvement of Website browsing experience; organisation of visualized content (including Google Maps interactive maps and YouTube videos), saving of personal data already entered by the Data Subject, tracking of user preferences and options, for instance for the efficiency of a booking, saving services already requested: Efficiency cookies;

– Measuring web traffic: Web traffic cookies;

– Monitoring browsing habits (websites and pages visited, search history and search terms used) and preferences of Data Subjects in view of customized ads: Advertising cookies; Advertising cookies are also installed by Google via YouTube videos and Google Maps interactive maps accessible on the Website: the data collected (login, location and browsing data) are not processed by Cour des Vosges but by Google ;

– Promotion of the Website and improvement of its user-friendliness, via social media sharing functionalities (Facebook, Twitter, Instagram, Google+, Pinterest, Linkedin), by means of the share button enabling web browsing to be tracked by the websites of these social media, whether or not these buttons or links are hit by the Website user: Social media cookies. The Data collected by these Cookies are not processed by Cour des Vosges, but by the aforementioned social media operators.

 

3°) Consent of Data Subjects:

The use of Efficiency cookies, Advertising cookies, Web traffic cookies and Social media cookies, that is to say all Cookies apart from functional Cookies, implies the consent of the Data Subject.

In accordance with article 32 II of the act of 6 January 1978, the consent of the Data Subject can result from his or her connection settings. Website users are prompted to check or alter their settings before pursuing their browsing experience on the Website. By continuing to browse the Website, that is to say by visiting another page of the Website from the Website or by clicking on any item of the Website (image, link, thumbnail etc.), the Data Subject expresses his or her consent to the use of the above mentioned Cookies.

The user can object to the use of Cookies or withdraw at any moment his or her consent: see Blocking or Managing Cookies.

 

4°) Cookies’ validity period:

Save exercise by the Data Subject of his or her right of objection or of withdrawal of consent, the consent to the installation of the Cookies is granted for a period of thirteen (13) months. On the expiry of this period, the Data Subject’s consent will have to be re-obtained to enable the use of Cookies. As a consequence, Cookies are only active for thirteen months after their initial installation on the terminal device of the user having consented to such. The validity period of Cookies is not extended by new visits to the Website.

 

5°) Blocking or Managing Cookies:

The Website user can object to the use of Cookies or of certain Cookies on his or her terminal and in particular benefits from the following means to this effect.

Browser settings:

Click on the browser menu (Safari, Mozilla etc.), then choose “Preferences” or “Settings” or “Tools”; then proceed as follows depending on your web browser:

Safari: “Privacy” > “Cookies and website data”: choose the desired options; to block cookies entirely, select: “Always block” and check the box “Website tracking: Ask websites not to track me” if not already checked; >also, to manage Data and Cookies already stored on the terminal: “Manage website data”: make the desired data deletions by selecting the Data and Cookies sources and categories in the panel then by clicking the “delete” button;

Mozilla Firefox: “Privacy and Security” > “Cookies and site data”: make the desired settings, after consulting the “Learn more” section;

– to block all Cookies : click the button “Block Cookies and site data (may cause websites to break)” ;

– to manage Cookies: click on the button “Enable Cookies (recommended)” and select among the proposed options (i) keep Cookies: to limit to the maximum extent possible, select “until I close Firefox”, (ii) accept third-party Cookies: to limit to the maximum extent possible, select “Never” ;

– also, with the use of the three buttons “Clear Data”, “Manage Data” or “Manage Permissions”, the user can delete all (“Clear”) or part (“Manage”) of the Data and Cookies already stored on the terminal or authorise certain Websites only to use these Cookies (“Manage Permissions”) ;

Internet Explorer: “Internet Options” > Thumbnail “Privacy” > “Advanced” button to prompt the window “Advanced Privacy Settings” > check the box “Override automatic cookie handling”, then select the desired option: accept, block or be prompted to determine the desired configuration for first-party and third-party Cookies.

Chrome: “Show advanced settings” (at the bottom), then in the Privacy Section click on “Content settings” then “Cookies” section, then:

– to delete all or specific Cookies : “All cookies and site data” > “Remove all”; or mouse over the name of the website and Delete

– to change the default settings relating to Cookies: turn “Allow sites to safe and read cookie data” on or off; turn on “Block third-party cookies” to block third-party Cookies;

to block Cookies for a specific site only: next to “Block”, “Clear on exit” or “Allow” click “Add”, then enter the Website address and click “Add”.

Other specific solutions:

Besides the general settings of your browser, there are solutions to control, manage or personalise, depending on their purpose or the entity using the Cookies.

Advertising cookies. These Cookies are implemented by Cour des Vosges via Adwords provided by Google (Google services). To disable these: https://policies.google.com/technologies/product-privacy?hl=fr, then “Control your ads settings” and select the desired options.

Advertising Cookies used by Google can be disabled on: https://policies.google.com/technologies/cookies?hl=fr&gl=fr, and by clicking on “ad settings”, or further still on: https://policies.google.com/privacy?hl=fr&gl=fr then “Your privacy controls”.

As a general rule, most advertising Cookies can also be controlled via an online choice platform: www.youronlinechoices.eu, http://optout.aboutads.info/?c=2&lang=EN (USA) or https://youradchoices.ca/.

Google Maps and You Tube Cookies: go to: https://policies.google.com/technologies/product-privacy, then select the desired options in each menu. The Google Maps terms of service are also available by clicking on the link on the interactive map.

Web traffic cookies. These Cookies are implemented using the Google Analytics tool provided by Google. Users can disable these by installing the opt-out browser add-on at: https:// support.google.com/analytics/answer/181881 ?hl=fr.

Social media cookies, implemented via the share buttons accessible on the Website. Social media networks generally provide for the possibility to block, manage or personalise Social media cookies via an add-on available to all, network members and non-members alike, as well as via the settings of the member’s account. To manage the Cookies, go to: Facebook and Instagram (and other Facebook products) : https ://www.facebook.com/policies/cookies/ ;

Twitter: https ://support.twitter.com/articles/20170518-utilisation-des-cookies-et-des-technologies-similaires-par-twitter ;

Pinterest : https ://policy.pinterest.com/fr/cookies ;

LinkedIn : https ://www.linkedin.com/legal/cookie-policy?_l=fr_fr ;

Google + : https ://policies.google.com/technologies/cookies?hl=fr.

Cookies personalisation page. Users can also visit, on the Website, the page devoted to the Personalisation of Cookies.

6°) Consequences of a refusal or objection:

Objections to Functional cookies, in particular if the user objects to all Cookies, will make operation of the communication service impossible. The user will not be able to browse the Website.

Objection to Efficiency cookies will not bar access to the Website and its functionalities, but may lead to a less efficient and less seamless browsing experience and to the reduced performance of the Website’s functionalities and services, including booking services.

 

1. RIGHTS OF THE DATA SUBJECT

 

1°) Right of access:

The Data Subject, providing proof of identity, shall have the right to question the Controller in view of obtaining:

• confirmation of whether or not the personal Data concerning him or her have been subject to Processing;
• information relating to the purposes of the Processing, to the categories of personal Data processed and to recipients or categories of recipients to which the Data are disclosed;
• where applicable, information relating to contemplated transfers of personal Data to countries outside the European community;
• disclosure, in accessible form, of the personal Data which concern him or her as well as any and all information available as regards the origin thereof;
• information enabling him or her to know and challenge the logic involved in any automatic personal data processing in the event of a decision made on the grounds of the latter and producing legal effects with regard to the interested party.

At the request of the Data Subject, a copy of the personal Data which concerns him or her will be sent to him or her by the Controller. For any further copies, the costs associated with the reproduction and delivery thereof will be for the account of the Data Subject.

The Controller will not respond to manifestly unreasonable requests, in particular due to their number, or because of their repetitive or systematic character.

 

2°) Right to rectification:

The Data Subject, providing proof of identity, shall have the right to obtain, without undue delay, the rectification of inaccurate personal Data concerning him or her. Taking into account the purposes of the Processing, the Data Subject shall have the right to have incomplete personal Data completed, including by means of providing a supplementary statement.

 

3°) Right to erasure:

The Data Subject, providing proof of identity, shall have the right to obtain from the Controller the erasure, without undue delay, of personal Data concerning him or her, where one of the following grounds applies:

• the Data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
• the data subject has withdrawn consent and where is no other legal ground for the processing of the Data;
• the data subject exercises his or her right to object to processing;
• the Data have been collected from the Data Subject when he or she was a child.

 

4°) Right to restriction of Processing:

The Data Subject, providing proof of identity, shall have the right to obtain restriction of Processing where one of the following cases applies:

• the accuracy of the Data retained is contested by the Data Subject, for a period enabling the Controller to verify the accuracy of the Data;
• the Processing is unlawful and the Data Subject opposes the erasure thereof and requests the restriction of their Processing instead;
• the Controller no longer needs the Data but they are required by the Data Subject for the exercise of his or her legal claims;
• the Data Subject has exercised his or her right to object pursuant to 6°) pending the verification whether the legitimate grounds of the Controller override those of the Data Subject.

Where Processing has been restricted under this paragraph, such Data shall, with the exception of storage, only be processed with the Data Subject’s consent, or for the exercise of legal claims, for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

A data subject who has obtained a restriction of Processing pursuant to this paragraph will be informed before the restriction is lifted.

 

5°) Data portability:

Where the Processing is based on the consent of the Data Subject or on performance of the contract or on the pre-contractual measures requested by the Data Subject and that the Processing is carried out by automated means, the Data Subject shall have the right, without prejudice to the right contemplated in 3°) and to the rights and freedoms of third parties, to receive the Data concerning him or her, which he or she provided to the Controller in a structured, commonly used and machine-readable format and to transmit those Data to another Controller, or to have the Data transmitted directly to another Controller, where this is technically feasible.

 

6°) Right to object:

The Data Subject may object at any time, on legitimate grounds, to the Processing of his or her Data that should be based exclusively on the legitimate interests pursued by the Controller or by a third party authorised by the Controller.

The Data Subject shall have the right to object, at no expense, and at any time, to the Data concerning him or her, being used for direct marketing purposes, in particular commercial marketing, including for the purpose of profiling where such is related to such direct marketing, by the current Controller for such processing or the controller for any subsequent processing.

The exercise of this right shall not adversely affect the lawfulness of the Processing carried out prior to the exercise of the right to object.

 

7°) Withdrawal of consent:

Where Processing is based on consent of the data subject, the latter shall have the right to withdraw his or her consent at any time.

The exercise of this right shall not adversely affect the lawfulness of Processing based on consent before its withdrawal.

 

8°) Automated individual decisions, including profiling:

Unless he or she has granted express consent or that the conclusion or performance of the contract so requires, the Data Subject shall have the right not to be subject to a decision based solely on automated Processing, including profiling, which produces legal effects or similarly significantly affects him or her.

 

9°) Instructions relating to the Processing of Data after death:

Any data subject may issue instructions relating to the storage, erasure and disclosure of his or her personal Data after his or her death. These instructions may be either general or specific. Instructions of a general nature concern all personal Data relating to the Data Subject and can be recorded with a digital trusted third party certified by the Commission nationale de l’informatique et des libertés. Instructions of a specific nature concern the Processing of personal data mentioned by these instructions. They are recorded with the relevant Controllers. General and specific instructions define the manner according to which the data subject intends for the rights mentioned in this section to be exercised after his or her death.

The Data Subject can alter or revoke his or her instructions at any time.

These instructions may appoint any person as an executor. That person will then be entitled, when the Data Subject dies, to examine the instructions and to request the relevant Controller to implement these. Failing such appointment, or, save instruction to the contrary, in the event of death of the appointee, his or her heirs are entitled to examine the instructions upon the death of their predecessor in title and to request the relevant Controller to implement these.

 

10°) Exercise of rights with respect to the Controller

The Data Subjects shall exercise the rights contemplated in this section by sending their requests or instructions by post or e-mail to:

 

– if Evok is the Controller:

Evok Hôtels Collection SNC

Personal Data Protection

17, avenue de l’Opéra – 75001 Paris

or inforgpd@evok.com

 

Requests must include due documentary evidence of the identity of the person responsible for the request. In the event of reasonable doubt, the Controller may ask for additional information necessary to confirm such identity.

That person must indicate in his or her request, the rights that he or she intends to exercise, as well as the Data and the Processing (purposes, basis) to which such exercise pertains and where applicable, the instructions, that he or she intends to send the Controller.

Incomplete requests will not be processed. In any event, the Controller reserves the right to claim any additional information necessary to the implementation of the rights invoked.

 

11°) Complaints with the supervisory authority:

Without prejudice to any other effective judicial or administrative remedy, any Data Subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State in which he or she has his or her habitual residence, his or her place of work or in the location where the violation was allegedly committed, if he or she considers that the personal Data Processing concerning him or her is an infringement of the regulatory framework relating to the protection of personal data.

In France, the supervisory authority is the Commission Nationale de l’Informatique et des Libertés (CNIL) located at 3, place de Fontenoy- TSA 80715 – 75334 Paris Cedex 07.

VII. RIGHT TO OBJECT TO TELEPHONE CANVASSING

This paragraph is intended for people considered to be consumers within the meaning of the French Consumer Code, any natural person acting for purposes that are not part of their commercial, industrial, craft, liberal or agricultural activity.

If you do not wish to be the subject of commercial canvassing by telephone, you can register free of charge on the official list of opposition to telephone canvassing accessible at https://bloctel.gouv.fr

We are prohibited, either directly or through a third party acting on our behalf, from

third party acting on our behalf, to make telephone solicitations to consumers on this list, except in the following cases

– in the context of the performance of an existing contract and in relation to the subject matter of that contract, including offers of products or services related to or complementary to the subject matter of the existing contract or likely to improve its performance or quality;

– or if you have given us your telephone number expressly in order to be called back, for the reason of your request. The ban will take effect no later than thirty days from the effective date of registration, which will be communicated to you by the Bloctel service.

For more information on the right to object to telephone canvassing: https://www.bloctel.gouv.fr/

VIII. PERSONAL DATA PROTECTION OFFICER

Mr Anthony Hamet is appointed as the Personal Data Protection Officer (PDPO) for the entire Evok Group, including Cour des Vosges.

Data Subjects can contact the PDPO regarding any issues relating to the processing of their personal data and to the exercise of the rights they are conferred by the General Data Protection Regulation.

To contact the PDPO:

– by post

Evok Hôtels Collection SNC

Cour des Vosges

Personal Data Protection

For the attention of the Personal Data Protection Officer

17, avenue de l’Opéra – 75001 Paris

– by e-mail: inforgpd@evok.com