Privacy policy
ARTICLE 1: PREAMBLE
The purpose of this privacy policy is to inform users of the website:
- About how their personal data is collected. Personal data is defined as any information that enables a user to be identified. This may include: their full name, age, postal or email address, location or IP address (this list is not exhaustive);
- About the rights they have in relation to this data;
- About the person responsible for processing the personal data collected and processed;
- About the recipients of this personal data;
- About the website’s cookie policy.
This policy supplements the legal notices and the General Terms and Conditions of Use, which users can view at the following address: hotels-centre-nantes.fr
ARTICLE 2: PRINCIPLES GOVERNING THE COLLECTION AND PROCESSING OF PERSONAL DATA
In accordance with Article 5 of Regulation (EU) 2016/679, personal data are:
- Processed lawfully, fairly and in a transparent manner in relation to the data subject;
- Collected for specified (see Article 3.1 of these terms), explicit and legitimate purposes, and not further processed in a manner incompatible with those purposes;
- Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
- Accurate and, where necessary, kept up to date. All reasonable steps must be taken to ensure that personal data which are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;
- Retained in a form which permits identification of the data subjects for no longer than is necessary for the purposes for which they are processed;
- Processed in such a way as to ensure the appropriate security of the data collected, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
ARTICLE 3 : DONNÉES À CARACTÈRE PERSONNEL COLLECTÉES ET TRAITÉES DANS LE CADRE DE LA NAVIGATION SUR LE SITE
Article 3.1: Data collected
The personal data collected in the course of our business activities are as follows:
- Surname and first name
- Postal address
- Email address
- Telephone number
- Food allergies and/or intolerances
- Bank details (see Article 3.1.1 for further details)
The collection and processing of this data serves the following purpose(s):
- Processing bookings
- Monitoring service quality
- Sending accounting information (quotes, invoices)
- Preparing meals
Article 3.1.1: Bank details
The Payment Card Industry Data Security Standard (PCI DSS) is a global information security standard designed to prevent raud through enhanced controls over credit card data. Organisations must comply with PCI DSS if they accept payment cards from the five major credit card brands, namely Visa, MasterCard, Express, Discover and the Japan Credit Bureau (JCB). Compliance with PCI DSS is mandatory for any organisation that stores, processes or transmits payment and cardholder data.
The PCI DSS standard defines four levels of compliance based on transaction volume. Our service provider uses the Microsoft Azure infrastructure, which is certified as compliant under PCI DSS version 3.2 as a Level 1 service provider, with the highest transaction volume of over 6 million per year.
Similarly, our service provider does not need to hold a PCI compliance certificate , as its payment service provider is audited by a PCI-certified auditor and is certified as a PCI Level 1 Service Provider.
Article 3.2: Method of data collection
When you use our website, the following data is collected automatically:
- A first name and a surname
- An email address
- IP address
This data is retained by the data controller under reasonable security conditions for a period of: We retain this data until the service ends
The company may retain certain personal data beyond the time limits stated above in order to fulfil its legal or regulatory obligations.
Article 3.3: Data hosting
The Hôtel de la Cité website is hosted by: OVH, 2 rue Kellermann, PO Box 80157, 59100 Roubaix. Website: www.ovh.com
Article 3.4: Disclosure of data to third parties
Data may be disclosed to our partners, listed below:
- Mews – https://www.mews.com : Booking
- GetWelcome – https://www.getwelcom.com : Stay management system
- Stripe – https://www.stripe.com : Secure online payment platform
ARTICLE 4: DATA CONTROLLER AND DATA PROTECTION OFFICER
Article 4.1: The data controller
Personal data is collected by SAS Anolisa, with a share capital of €5,000, registered under number 842 477 408 in Nantes.
The data controller may be contacted as follows: suivante : By post at the following address:
SAS Anolisa
11 rue Guibal
44000 Nantes
By telephone on 02 40 47 05 57;
By email: matthieu.demontferrand@anolisa.fr
If, after contacting us, you feel that your data protection rights have not been respected, you may report this to the CNIL.
ARTICLE 5: THE USER’S RIGHTS REGARDING THE COLLECTION AND PROCESSING OF DATA
Any data subject whose personal data is being processed may exercise the following rights, in accordance with European Regulation 2016/679 and the French Data Protection Act (Law No. 78-17 of 6 January 1978):
- The right of access, rectification and erasure of data (set out in Articles 15, 16 and 17 of the GDPR respectively);
- The right to data portability (Article 20 of the GDPR);
- The right to restriction of processing (Article 18 of the GDPR) and the right to object to the processing of data (Article 21 of the GDPR);
- The right not to be subject to a decision based solely on automated processing; ;
- The right to determine the fate of data after death;
- The right to lodge a complaint with the competent supervisory authority (Article 77 of the GDPR).
To exercise your rights, please send your letter to:
In order for the data controller to comply with your request, you may be required to provide certain information, such as: your full name, your email address and your booking number, personal account number or subscriber number.
Visit cnil.fr for further information on your rights.
ARTICLE 6: TERMS AND CONDITIONS FOR AMENDING THE PRIVACY POLICY
The publisher of the Hôtel de la Cité website reserves the right to amend this Policy at any time in order to ensure that it complies with applicable law for users of the website.
Any amendments shall not affect purchases made previously on the website which remain subject to the Policy in force at the time of purchase and as accepted by the user upon confirmation of the purchase.
Users are advised to review this Policy each time they use our services, without the need for formal notification.
This Policy was published on 1 September 2023.