Personal Data Protection Policy

Hotel Belloy is committed to protecting your personal data and ensuring a high level of protection for your personal data in accordance with the European Regulation 2016/679 and the Data Protection Act no. 78-17. 

Below is our personal data protection policy, which explains, among other things, what personal data we collect, the processing that is done, and the basis for it, their retention, and your personal rights. We invite you to read it. 

Our Data Protection Officer is at your disposal to answer all your questions. You can contact them at the following address: RGPD@madeho.fr
You can find the text of the applicable European Regulation here: https://eur-lex.europa.eu/legal-content/FR/TXT/?uri=CELEX%3A32016R0679 or consult the regulatory authority (CNIL) via its website www.CNIL.fr. 

This version of the personal data policy may be modified by us if necessary, and you will be informed. 

Your data controller

Hotel Belloy is the data controller of your personal data, whose contact details are as follows: 8 Boulevard Franklin Roosevelt, 85100 Les Sables-d'Olonne, FRANCE; it is referred to by its name or “We” herein. 

Your personal data and its collection by Hotel Belloy

Your personal data may be collected during: 

• your visit to our site,

• our exchanges, 

• our prospecting actions, 

• the formation or execution of our contracts. 

We do not collect any data that is not necessary for the purpose of processing mentioned at the time of collection or data prohibited by law or regulation. 

The collection of certain data may be mandatory or optional, and you are informed of the mandatory information. Your personal data may be collected by third-party providers or partners, who undertake to comply with European and national regulations on personal data. 

Our policy is not to transfer your data outside the European Union; if by exception we do so, this transfer can only take place to a country or organization subject to an adequacy decision (Art.45 GDPR) or providing appropriate safeguards (Art.46 GDPR). 

We do not make any automated decisions.

We may potentially collect your following personal data: 

• Civil status, identity, contact details, images 

• Personal life

• Professional life

• Economic and financial personal data 

• Connection data 

• Unique national identification number 

• Health information 

• Criminal convictions or offenses 

Our processing of your personal data

We process your personal data by inserting it into databases; it is stored, retained, and if necessary, rectified, deleted, archived, anonymized, or pseudonymized, transferred to trusted third parties. 

We are likely to process your personal data for the following processing purposes or for purposes that you are specified at the time of collection: 

• Your information on our commercial (products, services...) and promotional offers – Communicating with you 

We may use your personal data for commercial prospecting purposes, including sending you information about our products/services, our commercial and promotional offers, quotes, and other pre-contractual documents, our news by mail, post, or phone. 

• The execution of your ongoing contracts and customer follow-up 

We use your personal data to ensure the execution of ongoing contracts in accordance with your requests. We may also send you any information about your order or ongoing contracts, their execution, your invoices, and contractual documents, advice, the execution of our guarantees if applicable, and our legal obligations. We also use your personal data to manage our customer relationship, your requests or complaints, if applicable disputes, and track your customer history. 

• Improving the use of our services and enhancing our offers 

We process your personal data to allow you optimal use of our services, improve our offers and products/services, and track your user journey, conduct satisfaction surveys, polls, and anonymous statistics. 

• Your payments 

Your banking details may be collected either directly by us or by a dedicated and selected provider, who guarantees the full confidentiality of your banking data and these details are only retained for the necessary duration of the contractual relationship or within legal limits. 

• Protection against fraudulent initiatives 

The personal data collected may be used to combat fraud, particularly on payments or collections made. To this end, our payment security providers may be the recipients of these data. 

• Ensuring compliance with law and court decisions 

Your data may be used to: 

• respond to a request from an administrative or judicial authority, a law representative, a legal assistant, or comply with a court decision; 

• ensure compliance with our general terms of sale/service; 

• protect our rights and/or obtain compensation for damages we may suffer or limit the consequences; 

• prevent any act contrary to current laws, particularly in the context of fraud prevention. 

We may also process your personal data for the following purposes: 

• Commercial relationship:
  Sending marketing campaigns by email, mail, or phone (including via a provider) 

• Various:
  Electronic signature

• Internet:
  Create and manage your user account 

• Cookie management:

  • Performance cookies: allowing to establish anonymous statistics and site traffic level and tracking and personalization, collecting information on your use of the site, and enabling personalized offers,

  • Third-party cookies: to target ads that may interest you based on your identified interests. These cookies fall under their policy, not Hotel Belloy's, 

  • Analytical cookies: allowing us to understand and analyze your navigation on our site. 

The basis for processing your personal data

In accordance with regulations, processing your personal data by us is based if it is on one of the following grounds: 

• Your consent for us to process your data: you agree to the processing of your personal data through express consent. You can withdraw this consent at any time with our DPO; or 

• The existence of a contract between you and us: the data processing is then justified by the needs of contract execution; or 

• Our legitimate interest in processing your personal data, as long as this proportionate interest respects your fundamental rights and privacy; or 

• The law or current regulation when it obliges us to process and retain your personal data. 

Methods and durations of retaining your personal data 

We manage your personal data in three phases: 

• An active phase where the data is retained for the time indicated below in "active" base: your personal data is then accessible only to people with an operational need to access it to carry out authorized processing 

• An archiving phase (for an additional time to retention in "active" base) when a legitimate reason justifies it: your personal data is then archived with restricted access for a limited duration. 

• A deletion or anonymization phase: at the end of the additional archiving within the timeframes below, your personal data is deleted or anonymized (in such a way that they can no longer constitute personal data identifying you). 

Your personal data is retained for the necessary time to meet processing needs, our customer relationship where applicable, and contract execution, within regulatory limits specifically stated; we may retain your personal data in archiving for needs of retaining accounting, tax, or probative supporting elements for the duration of applicable prescriptions. For example, we indicate below the retention durations applicable to the following processing (subject to regulations imposing a differentiated retention time): 

Processing purpose	Processing basis	Retention of personal data in "active" base	Additional archiving
Prospecting	Your consent	3 years if you have not actively responded to any solicitation. The period starts anew in case of active solicitation on your part.	X
Execution of our contractual obligations to you / services	Contract	The time necessary for contract execution and 3 years from the end of the commercial relationship (last activity such as end of contract execution (purchase, service...), login to the site as a registered user)	5 years following the contractual relationship
Customer relationship	Contract	3 years from the end of the commercial relationship (last activity on your part with us)	5 years following the contractual relationship

Withdrawal of your consent for the collection or processing of your personal data 

Your granted consent for collecting your personal data can be withdrawn by writing to our DPO by email or mail at the addresses listed at the header, mentioning your name, surname, email, and address with the nature and specific subject of your withdrawal request. 
You can also send us any comments on your personal data to Hotel Belloy, 8 Boulevard Franklin Roosevelt, 85100 Les Sables-d'Olonne, FRANCE.

Exercising your rights over your personal data

You have:

• A right of access, allowing you to obtain: 

  • Confirmation that data concerning you is or is not processed; 

  • Communication of a copy of all personal data held by the data controller. 

• A right to request the portability of certain data: it allows you to recover your personal data in a structured, commonly used and machine-readable format. 

• A right to object: it allows you not to be subject to commercial prospecting from us or our partners, or, for reasons related to your particular situation, to cease the processing of your data for research and development, fraud prevention, and prevention purposes. 

• A right to rectification: it allows you to have information concerning you rectified when it is obsolete or erroneous. It also allows you to complete incomplete information concerning you. 

• A right to erasure: it allows you to obtain the erasure of your personal data subject to legal retention durations. It may apply when your data is no longer necessary for processing. 

• A right to restriction: It allows you to limit the processing of your data in the following cases: 

  • In case of unlawful use of your data;

  • If you dispute their accuracy; 

  • If you need the data to establish, exercise, or defend your rights.
    They will no longer be subject to active processing and cannot be modified during the exercise of this right. 

• A right to obtain human intervention: the data controllers may use automated decision-making for subscription or management of your contract. In this case, you can ask what were the determining criteria of the decision with the Data Protection Officer.

You can exercise these rights by email: RGPD@madeho.fr or by letter to the following address: 8 Boulevard Franklin Roosevelt, 85100 Les Sables-d'Olonne, FRANCE, indicating your name, surname, address, and email (where applicable your customer references) as well as the subject of your request in clear and legible terms. Hotel Belloy pledges to respond to your verified request within one month of its receipt. 
In case of difficulty, you can directly contact our Data Protection Officer by email: RGPD@madeho.fr or contact the Commission Nationale de l'Informatique et des Libertés (CNIL). 

Our subcontractors and partners

Hotel Belloy may transfer your personal data to subcontractors performing services involving the processing of your data and in compliance with the purposes set forth herein; these subcontractors must confer the same level of confidentiality to your personal data as Hotel Belloy and have committed to perfect compliance with personal data regulations, especially GDPR. 

We do not trade your personal data; if you wish to know more and specifically know the identity of the providers or partners to whom your personal data has been transmitted, you can contact our DPO at the following address: RGPD@madeho.fr.

The providers or partners likely to access your personal data may include: 

• the providers likely to manage outsourced services for executing our services and contracts,

• the providers helping us to improve our services, perform data analysis, and optimize our offers, conduct surveys and statistics,

• the auditors, accountants, consultants, lawyers, audit firms, IT and outsourcing providers, security providers,

• the investors and acquirers. 

We may also transmit your personal data to French authorities, administrations, and courts, particularly in the context of legal action or formalities requiring this communication.