1. Processing of Your Personal Data

Description of the Processing of Your Personal Data

In accordance with applicable laws and regulations, the Company, acting as the data controller, collects certain personal data during your visit to the Site:

When booking a stay at our establishment, we may collect your personal data, including: arrival and departure dates, number of travelers, location, and any additional services (related to lifestyle: alcoholic beverages or not).

For the payment of your stay, we collect your contact information and banking details, in compliance with security standards.

If you need to contact us, you may provide your name, surname, phone number, and email via a form accessible through our “Contact Us” section.

If you wish to follow our latest news, you may subscribe to the newsletter by providing your email address. This will allow you to receive updates and offers, with the possibility to unsubscribe at any time.

To join our teams, you may submit a spontaneous application by clicking on “Careers”: this allows us to collect personal data such as your name, surname, email address, CV, and cover letter. This data will be used to manage your application.

Please note that when you log in to the Site, the Company, acting as the data controller, also collects the following personal data: your connection logs; your login information; your IP address.

The Company uses your personal data for the following purposes:

Purpose	Legal Basis	Retention Period
Management of your bookings, including any modifications, cancellations, payment, or prepayment	Processing is based on the performance of the contract concluded with you when booking your stay	5 years from the end of your stay or your last contact with us
Management of requests for access, portability, deletion, restriction of processing, rectification, and objection	Processing is necessary to respond to your requests to exercise your rights and is based on your consent	Up to 1 year from the date of your request
Management of requests to object to marketing communications	Processing is necessary to respond to the exercise of your right to object	Up to 3 years from the exercise of your right to object
Recruitment management	Processing is based on your consent	3 years from the end of the contractual relationship
Customer relationship management	Processing is based on the performance of contractual relations between you and the Company	5 years from the conclusion of the contract between you and the Company
Management of job applications	Processing is based on pre-contractual measures and your consent	Immediate deletion if not selected; up to 2 years from last contact if you agreed to keep the file
Management of newsletter subscriptions	Processing is based on your consent	Until withdrawal of consent or 3 years from the last contact

2. Recipients / Transfers of Your Personal Data

Access to your personal data is restricted to authorized personnel, including the communication, HR, and sales departments, and IT/technical service providers.

For bookings, data related to your stay and payment may be shared with teams responsible for reservation management, billing, customer support, and after-stay services.

Your personal data may also be shared with third parties if required by law or judicial procedures, or if necessary for safety and public protection.

Transfers outside the European Economic Area include:

Cloudflare (Site hosting) – Canada
Namastay (Online payment management)

The Company ensures GDPR-level protection and has concluded Standard Contractual Clauses, implementing additional security measures per the CJEU “Schrems II” ruling.

Social media buttons collect data according to the third party's privacy policies. Users are encouraged to review these policies.

1. Security of Personal Data

The Company implements appropriate technical and organizational measures to ensure security, including:

Pseudonymization and encryption of data
Measures to ensure confidentiality, integrity, availability, and resilience of processing systems
Regular testing and evaluation of the effectiveness of security measures

2. Retention of Personal Data

Personal data is kept only for as long as necessary to achieve the processing purpose, comply with legal obligations, exercise rights, or for statistical/historical purposes.

After the retention periods, data is either deleted or anonymized.‍

3. Your Rights

You have the following rights regarding your personal data:

Access & Rectification: Request access or correction of inaccurate or incomplete data
Deletion: Request deletion when data is no longer needed, consent is withdrawn, objection to processing, unlawful processing, legal obligation, or compliance with retention rules
Objection: Object to data processing within legal limits
Restriction: Request restriction if accuracy is contested or processing is no longer necessary
Automated Decision-Making: Right not to be subject to decisions solely based on automated processing, including profiling
Portability: Receive data in a machine-readable format or transfer to another controller
Post-Mortem Instructions: Set instructions for data handling after death
Withdrawal of Consent: Withdraw consent for future processing
Complaints: Lodge complaints with CNIL or inform the Company’s Data Protection Officer (DPO) first. Requests can be sent to:
Email: gdpr@expegroup.com
Address: 14-16 Boulevard Poissonnière, 75009, Paris, France

Identity verification may require a government-issued ID, deleted after the request is processed.

4. Links to Third-Party Sites

The Site may contain links to third-party websites with independent privacy policies. Users should consult these policies separately.

5. Language

The Privacy Policy is written in French. In case of translation, only the French version is legally binding.

6. Cookies

Cookie-related provisions are available in the Site’s Cookie Policy.

7. Changes to the Privacy Policy

The Company may modify this Privacy Policy at any time. Users are encouraged to consult the page regularly. Significant changes will be communicated.

Privacy Policy