Personal Data Protection Policy

Hôtel Belloy is committed to protecting your personal data and strives to ensure a high level of protection for your personal data in accordance with the European Regulation 2016/679 and the Data Protection Act No. 78-17. 

Below, you will find our personal data protection policy which explains in particular what personal data we collect, the processing carried out on it and on what basis, its retention and your personal rights. We invite you to take note of it. 

Our Data Protection Officer is available to answer all your questions, you can contact him at the following address: RGPD@madeho.fr
You can find the text of the applicable European Regulation here: https://eur-lex.europa.eu/legal-content/FR/TXT/?uri=CELEX%3A32016R0679 or contact the regulatory authority (CNIL) via their website www.CNIL.fr. 

This version of the personal data policy may be modified by us if necessary and you will be informed. 

Your Data Controller

Hôtel Belloy is the data controller of your personal data and whose contact details you will find below: 2 rue Racine, 75006 Paris, France; it is referred to by its name or "We" herein. 

Your personal data and their collection by Hôtel Belloy

Your personal data may be collected during: 

• your visit to our site,

• our communications, 

• our prospecting actions, 

• the formation or execution of our contracts. 

We do not collect any data that is not necessary for the processing purpose mentioned at the time of collection or data prohibited by law or regulation. 

The collection of certain data may be mandatory or optional, and you are informed of the mandatory information. Your personal data may be collected by third-party service providers or partners, who commit to be in compliance with European and national data protection regulations. 

Our policy is not to transfer your data outside the European Union; if by exception we proceed, this transfer can only occur with a country or organization subject to an adequacy decision (art.45 GDPR) or providing sufficient appropriate safeguards (art.46 GDPR). 

We do not make any automated decisions.

We may potentially collect the following personal data from you: 

• Civil status, identity, contact details, images 

• Personal life

• Professional life

• Economic and financial personal data 

• Connection data 

• Unique national identification number 

• Health data 

• Criminal convictions or offenses 

Our processing of your personal data

We process your personal data by entering them into databases; they are stored, retained, and as the case may be corrected, deleted, archived, anonymized or pseudonymized, transferred to trusted third parties. 

We process your personal data for the following processing purposes or for purposes specified at the time of collection: 

• Your information on our commercial (products, services...) and promotional offers – Communicate with you 

We may use your personal data for commercial prospecting purposes, including to send you information on our products/services, our commercial and promotional offers, quotes, and other pre-contractual documents, our news by email, mail, or phone. 

• The execution of your ongoing contracts and customer support 

We use your personal data to ensure the execution of ongoing contracts in accordance with your requests. We may also send you all information about your order or ongoing contracts, their execution, your invoices and contractual documents, advice, the execution of our guarantees, if applicable, and our legal obligations. We also use your personal data to manage our customer relationship, your requests or complaints, if necessary, disputes, and to track your customer history. 

• Improving the use of our services and improving our offers 

We process your personal data to allow you optimal use of our services, improve our offers and products/services, and to follow your user journey, conduct satisfaction surveys, anonymous surveys and statistics. 

• Your payments 

Your banking details may be collected either directly by us or by a dedicated and selected provider, which guarantees complete confidentiality of your banking data, and these details are retained only for the time necessary for the duration of the contractual relationship or within legal limits. 

• Protection against fraudulent initiatives 

Collected personal data may be used to fight against fraud, particularly on payments or debits made. For this purpose, our payment security providers may receive these data. 

• Ensuring compliance with the law and court decisions 

Your Data may be used to: 

• respond to a request from an administrative or judicial authority, a law representative, a judicial officer, or comply with a court decision; 

• ensure compliance with our general terms of sale/service; 

• protect our rights and/or seek compensation for damages we may suffer or limit their consequences; 

• prevent any action contrary to current laws, particularly in the context of fraud risk prevention. 

We may also process your personal data for the following purposes: 

• Commercial relationship:
  Sending marketing campaigns by email, mail, or phone (including through a provider) 

• Miscellaneous:
  Electronic signature

• Internet:
  Create and manage your user account 

• Cookies management:

  • Performance cookies: allowing the establishment of anonymous statistics and traffic levels on the site and tracking and customization collecting information on your site use, allowing the customization of our offers,

  • Third-party cookies: to target ads likely to interest you based on your detected interests. These cookies fall under the policy applied by the third parties and not Hôtel Belloy's policy, 

  • Analytical cookies: allowing us to understand and analyze your navigation on our site. 

The basis for processing your personal data

In accordance with regulations, the processing of your personal data by us is based on one of the following foundations: 

• Your consent to the processing of your data by us: you agree to the processing of your personal data through an express consent. You can withdraw this consent at any time with our DPO; or 

• The existence of a contract between you and us: the processing of data is then justified by the needs of executing the contract; or 

• Our legitimate interest in processing your personal data, provided that this proportionate interest respects your fundamental rights and privacy; or 

• The law or applicable regulations when it requires the processing and retention of your personal data. 

Personal data retention methods and durations 

We manage your personal data through three phases: 

• An active phase where the data is kept for the time indicated below in the “active” database: your personal data is then accessible only to people with an operational need to access it to carry out the authorized processing 

• An archiving phase (for additional time in the “active” database) when there is a legitimate reason: your personal data is then archived with restricted access and for a limited duration. 

• A deletion or anonymization phase: at the end of the additional archiving within the time limits below, your personal data is deleted or anonymized (so that they can no longer constitute a personal data identifying you). 

Your personal data is retained for the time necessary for their processing, our customer relationship, if applicable, and contract execution within specifically regulated limits; we may retain your personal data in archives for the purpose of retaining accounting, fiscal, or evidential elements as long as the applicable prescription periods. For example, we indicate below the retention durations applying to the following processing (subject to regulation requiring a different retention time): 

Processing purpose	Processing basis	Retention of personal data in “active” database	Additional archiving
Prospecting	Your consent	3 years if you have not actively responded to any solicitation. The period resumes in case of your active solicitation.	X
Execution of our contractual obligations to you / services	Contract	The time necessary for contract execution and 3 years from the end of the commercial relationship (last activity such as end of contract execution (purchase, service...), login to the site as a registered user)	5 years at the end of the contractual relationship
Client relationship	Contract	3 years from the end of the commercial relationship (last activity by you with us)	5 years at the end of the contractual relationship

Withdrawal of your consent for the collection or processing of your personal data 

Your consent granted for collecting your personal data can be withdrawn by writing to our DPO by email or by mail at the addresses listed in the heading, mentioning your first name, last name, email, and address with the precise nature and object of your withdrawal request. 
You can also send any comment on your personal data to Hôtel Belloy, 2 rue Racine, 75006 Paris, FRANCE.

Exercising your rights on your personal data

You have:

• A right of access, which allows you to obtain: 

  • Confirmation that data concerning you is being processed or not; 

  • A copy of all personal data held by the data controller. 

• A right to request the portability of certain data: it allows you to retrieve your personal data in a structured, commonly used, and machine-readable format. 

• A right of opposition: it allows you to no longer be subject to commercial prospecting by us or our partners, or, for reasons related to your particular situation, to stop the processing of your data for research, development, fraud prevention, or similar purposes. 

• A right of rectification: it allows you to have an information concerning you corrected when it is outdated or erroneous. It also allows you to complete incomplete information concerning you. 

• A right of erasure: it allows you to obtain the erasure of your personal data subject to legal retention periods. It may particularly apply if your data is no longer needed for treatment. 

• A right of limitation: It allows you to limit the processing of your data in the following cases: 

  • In case of unlawful use of your data;

  • If you dispute the accuracy of these; 

  • If you need the data to assert, exercise, or defend your rights.
    They will then no longer be subject to active processing and cannot be modified during the duration of this rights exercise. 

• A right to obtain human intervention: Data controllers may resort to automated decision-making for subscribing to or managing your contract. In this case, you can request from the Data Protection Officer what were the decisive criteria for the decision.

You can exercise these rights by email: RGPD@madeho.fr or by mail at the following address: 2 rue Racine, 75006 Paris, FRANCE by indicating your name, first name, home address, and email (your client references if applicable) as well as the object of your request using clear and readable terms. Hôtel Belloy commits to responding to your verified request within one month from its receipt. 
In case of difficulty, you can directly contact our personal data protection officer by mail: RGPD@madeho.fr or contact the National Commission for Computing and Liberties (CNIL). 

Our subcontractors and partners

Hôtel Belloy may transmit your personal data to subcontractors performing services involving the processing of your data while respecting the purposes set forth herein; these subcontractors must confer the same level of confidentiality to your personal data that Hôtel Belloy does and have committed to being in full compliance with data protection regulation, particularly with the GDPR. 

We do not commercialize your personal data; if you wish to know more and specifically know the identity of the service providers or partners to whom your personal data has been transmitted, you can contact our DPO at: RGPD@madeho.fr.

The service providers or partners who may access your personal data can in particular be: 

• the providers who may manage externalized services for the execution of our services and contracts,

• the providers helping us improve our services, conduct data analyses and optimize our offers, conduct surveys and statistics,

• account auditors, accountants, consultants, lawyers, audit firms, IT providers and outsourcing, security providers,

• investors and buyers. 

We may also be required to transmit your personal data to French authorities, administrations and courts, particularly in the context of legal actions or formalities requiring such communication.