Last updated: 07/09/2026

1. Introduction

The company GRAPE HOSPITALITY FRANCE — (hereinafter "we," "our," or "the Company") places great importance on the protection of your personal data.

This privacy policy aims to inform you, with full transparency, about how we collect, use, store, and protect your personal data when you:

• book a stay (online, by phone, via an agency, or through a third party);
• stay in one of our establishments;
• use our additional services (restaurant, spa, meeting rooms, concierge, etc.);
• sign up for our loyalty program or newsletter;
• visit our website or mobile application;
• contact us (customer service, complaints, information requests).

This policy complies with the General Data Protection Regulation (GDPR – EU 2016/679) and the amended French Data Protection Act.

2. Data controller

The data controller is:

Grape Hospitality France, with its registered office at 17 quai du président Paul Doumer, 92400 Courbevoie, registered under number 815 278 288 with the Nanterre Trade and Companies Register (RCS).

The Data Protection Officer (DPO): dpo@grape-hospitality.com

3. Data we collect

Depending on how you interact with us, we may collect the following categories of data:

3.1 Identification and contact data

Last name, first name, title, date of birth, postal address, email address, phone number.

3.2 Booking and stay-related data

Stay dates, room type, preferences (floor, bedding, reported food allergies), booking history, loyalty card number, license plate number (if parking), check-in/check-out information.

3.3 Payment data

Credit card number (processed securely, generally via a PCI-DSS certified payment provider), billing history. We do not store full credit card details on our own servers.

3.4 Identity data

Copy of ID card or passport, as required by regulations applicable to traveler registration (police forms, hotel registers) in certain countries.

3.5 Video surveillance data

Images captured by video surveillance systems installed in the common areas of our establishments (lobbies, parking lots, hallways) for security reasons.

3.6 Browsing data

IP address, browser type, pages visited, cookies and similar trackers (see section 8).

3.7 Loyalty program and marketing data

Communication preferences, newsletter open history, declared interests.

4. Purposes and legal bases for processing

• Reservation and stay management: Contract performance
• Invoicing and accounting: Legal obligation
• Mandatory guest registration: Legal obligation
• Security of property and individuals (video surveillance): Legitimate interest
• Loyalty program: Performance of the contract / Consent
• Sending newsletters and promotional offers, commercial prospecting, and optimizing our advertising campaigns: Consent (or legitimate interest for existing customers, with the right to object)
• Service improvement and statistics: Legitimate interest
• Complaint management and customer service: Performance of the contract / Legitimate interest
• Fraud prevention: Legitimate interest / Legal obligation

5.Data recipients

Your data may be shared, strictly on a need-to-know basis, with the following categories of recipients:

• authorized personnel at our establishments (front desk, sales department, management);
• our technical service providers (website hosting, property management software (PMS), payment solutions);
• online travel agencies (OTAs) when you book through these channels;
• administrative or judicial authorities, upon legal request (guest register, tax obligations);
• our business partners, service providers, and third-party platforms only with your prior consent where applicable

We never sell your personal data to third parties.

6. Transfers outside the European Union

If any of our service providers (cloud hosting, marketing tools, booking platforms) are located outside the European Union, we ensure these transfers are governed by appropriate safeguards: European Commission standard contractual clauses, adequacy decisions, or other mechanisms recognized by the GDPR.

7. Retention period

• Booking and stay data: Duration of the business relationship + 3 years (for prospecting), legal archiving up to 10 years (for accounting)
• Identity forms / guest register: In accordance with local legal requirements (typically 1 to 5 years)
• Payment data: Not retained after transaction, except for accounting obligations
• Video surveillance footage: 30 days maximum, unless proceedings are ongoing
• Prospecting data (newsletter): 3 years from the last contact, or until consent is withdrawn
• Loyalty program: Membership duration + 3 years

8. Cookies and trackers

Our website and application use cookies to:

• ensure the site functions correctly (technical, essential cookies);
• measure traffic and improve our services (analytical cookies);
• offer you personalized content and offers (advertising cookies, subject to consent).

You can manage your preferences at any time via the cookie banner displayed during your first visit, or through your browser settings.

9. Your rights

In accordance with the GDPR, you have the following rights regarding your personal data:

• Right of access : obtain a copy of the data we hold about you;
• Right to rectification : correct inaccurate or incomplete data;
• Right to erasure : request the deletion of your data, subject to our legal obligations;
• Right to restriction of processing ;
• Right to object, in particular regarding processing for direct marketing purposes;
• Right to data portability of your data;
• Right to withdraw your consent at any time, when processing is based on it;
• Right to provide instructions regarding the handling of your data after your death (French law);
• Right to lodge a complaint with the relevant supervisory authority (in France, the CNIL — www.cnil.fr).

To exercise these rights, you may contact our Data Protection Officer (DPO) at the following address: dpo@grape-hospitality.com

10. Data Security

We implement appropriate technical and organizational measures to protect your data against unauthorized access, loss, alteration, or disclosure, including: encryption of sensitive data, restricted and secure access to systems, staff training, and regular security audits.

11. Minors

Our services are intended for adults. We do not knowingly collect data from minors without parental supervision, except in the normal course of a family stay and with the authorization of the holder of parental authority.

12. Privacy Policy Updates

We may update this policy to reflect changes in legal or regulatory requirements or our own practices. Any significant changes will be communicated to you through an appropriate channel (email or website notification). The date of the last update is indicated at the top of this document.

‍