Privacy policy

This Privacy Policy (the “Privacy Policy”) sets out how RR HOTELS ET FINANCE processes personal data, as well as the various rights that data subjects hold over such data. This Privacy Policy may be amended; any changes will take effect on the date their update is published on the website rr-hotelsetfinance.fr (the “Sites”), without prejudice to rights acquired before such change.

ARTICLE 1 – DATA CONTROLLER

The data controller is the person who determines the purposes and means of the processing of personal data, that is, the person who defines the objectives for which such data are processed.

RR HOTELS ET FINANCE, a single-shareholder simplified joint-stock company (SASU) with a share capital of 1,000 euros, registered with the Paris Trade and Companies Register under number B 895 161 560, whose registered office is located at 9, rue du 4 septembre – 75002 Paris (hereinafter the “Company”), publishes the RR HOTELS ET FINANCE websites and acts as data controller.

For any question or request relating to personal data, you may contact us by post at RR HOTELS ET FINANCE, Legal Department, 9, rue du 4 septembre, or by email at <direction@rr-hotelsetfinance.fr>.

ARTICLE 2 – NATURE OF PERSONAL DATA

Personal data is any information relating to an identified or indirectly identifiable natural person (in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person).

ARTICLE 3 – COLLECTION OF PERSONAL DATA

In the course of providing our services, we collect personal data directly from you when you fill in personal data collection forms and use the features made available to you on the Sites.

We may also collect personal data from third parties acting in connection with the provision of our services (in particular for the payment of our services).

We may also collect and obtain, directly or indirectly, personal data following the analysis of your behaviour when you interact with our Sites, in accordance with the rules applicable to cookies.

The personal data we collect may include, in particular, your surname, first name, username, gender, email address, signature, photograph, postal address, details of your professional life, your exchanges and comments on our Sites, web pages and applications, your IP address, and the type and language of your browser.

We do not collect personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, nor do we process genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a person’s sex life or sexual orientation.

As our Sites are not intended for minors under fifteen (15) years of age, we do not knowingly collect such data and reserve the right to delete it should we become aware that such data has been transmitted.

If you provide us with personal data relating to a third party, it is your responsibility to ensure that all such data has been collected lawfully, fairly and transparently and that the third party does not object to its transmission.

ARTICLE 4 – PROCESSING OPERATIONS

In addition to the personal data processed in connection with your requests to exercise your rights, we carry out, in connection with the publication of our Sites, processing operations for the following purposes:

4.1 Handling your requests for information

In order to manage our responses to your requests for information, we process the personal data you provide to us in this context.
Data: identity, personal data relating to requests for information.
Retention period: requests and responses are kept for two years from the last contact.
Legal basis: consent (your expressed wish to provide us with this data so that it can be processed in order to respond).

4.2 Handling job applications

In order to manage applications for vacancies at RR HOTELS ET FINANCE, we process the personal data relevant to the review and selection of applications.
Data: identity (surname, first name, address, photograph), professional data contained in CVs, cover letters and exchanges, job interviews and interview notes, wishes expressed by applicants regarding employment, assessment of professional skills based on objective criteria directly and necessarily related to the position sought.
Retention period: destruction after rejection of the application, or retention for two years with the applicant’s consent.
Legal basis: such processing is necessary for our legitimate interest in recruiting potential new employees.

4.3 Managing our supplier community

We collect and process the personal data relevant to monitoring our relationships and agreements with our suppliers, internal and external communication and the production of statistics.
Data: identity, contact details, projects followed, exchanges relating to project implementation, statistics.
Retention period: supplier data is kept for the duration of the contractual relationship and for five years after it ends (limitation period).
Legal basis: such processing is necessary for the performance of a contract or of pre-contractual measures.

4.4 Managing our relationships with clients and prospects

In order to manage our relationships with our clients and prospects, we collect the personal data relevant to client management, the management of unpaid invoices, sales statistics, prospecting and information operations for prospecting purposes, and the management of rights of access, rectification and objection.
Data: identity, address, email, telephone, fax, internal processing code, data relating to the follow-up of the business relationship (orders, contracts, client exchanges and comments), data relating to loyalty, prospecting and prospect selection actions, client reviews and ratings of services, data relating to transactions, data relating to means of payment, invoices, transactional data.
Retention period: client data is kept for the duration of the contractual relationship and for five years after it ends (limitation period). Prospect data is kept for three years from the end of the business relationship or from the last contact initiated by the prospect.
Legal basis (clients): such processing is necessary for the performance of a contract or of pre-contractual measures.
Legal basis (prospecting): such processing is necessary for our legitimate interest in promoting our products and services on the market.

4.5 Managing our websites

We collect and process the personal data relevant to the management of our websites and the protection of their cybersecurity.
Data: identity, positions, contact details, browsing data (IP address, timestamps, cookies) and data on digital platforms via sharing buttons and media, user contact management data, data relating to the management of technical service providers, and audience and usage data for the online services offered by RR HOTELS ET FINANCE.
Retention period: log data is kept for six months, data required to produce audience and usage statistics for online services is kept for thirteen months, and data exchanged with service providers is kept for five years after the end of the contract concerned.
Legal basis: such processing is necessary for our legitimate interest in monitoring the operation and use of our Sites.
Legal basis for cookies that are not strictly technical: consent.

4.6 Managing disputes

We collect and process the personal data relevant to the preparation, exercise and follow-up of disciplinary actions or legal proceedings and, where applicable, to the enforcement of the decision rendered.
Data: identification data of the persons implicated, victims, witnesses and officers of the court (surnames, first names, gender, date and place of birth, nationality, address, telephone, email), data relating to offences, convictions or security measures (disputed facts, information, documents and evidence gathered to establish the facts that may be alleged, characteristics of the dispute (findings, testimonies, certificates, procedural documents, case documents), characteristics of the dispute, convictions, follow-up of proceedings.
Retention period: for the duration of the dispute and after all avenues of appeal have been exhausted, then archived on a separate and secure medium if of historical interest.
Legal basis: such processing is necessary for the performance of a contract or of pre-contractual measures, in the event of a dispute relating to a contract.
Legal basis: such processing is necessary for our legitimate interest in exercising our rights of defence, in the event of a dispute not relating to a contract.

4.7 Managing partnerships

We collect and process the personal data relevant to monitoring partnership agreements, carrying out joint projects, internal and external communication and the production of statistics.
Data: identity, contact details, projects followed, exchanges relating to project implementation, statistics.
Retention period: partner data is kept for the duration of the contractual relationship and for five years after it ends (limitation period).
Legal basis: such processing is necessary for the performance of a contract or of pre-contractual measures.

4.8 Managing communication and events

We collect and process the personal data relevant to the management of our marketing and communication events (registrations, logistics, evaluation, statistics) and the sending of our commercial communications.
Data: identity, contact details, exchanges relating to project implementation, statistics.
Retention period: data used to send newsletters is kept until the data subject unsubscribes, press relations data is kept for five years, event data is kept for five years after the event concerned, and data from social media pages is kept for as long as the social media account concerned exists (subject to the right to erasure or objection).
Legal basis: such processing is necessary for our legitimate interest in carrying out communication actions to promote our services.
Legal basis: your consent (which may be withdrawn at any time), for sending newsletters.

ARTICLE 5 – MANDATORY OR OPTIONAL NATURE OF PROVIDING PERSONAL DATA

In personal data collection forms, we indicate which personal data must be provided for the processing purpose concerned. If these fields are not completed, RR HOTELS ET FINANCE cannot carry out the actions required for that processing purpose (for example, creating an account without an identity that can be attached to it).

ARTICLE 6 – TRANSMISSION OF PERSONAL DATA

As a general rule, we do not transmit your personal data to third parties, but we may transmit your personal data to our processors (who process such data on our behalf, such as our hosting provider), to our partners involved in the proper performance of our services, to our partners responsible for auditing the business activities of RR HOTELS ET FINANCE (statutory auditor, internal control departments, lawyer, bailiff) and to bodies, officers of the court and ministerial officers in the course of their debt recovery or dispute management duties.

RR HOTELS ET FINANCE may also be required to disclose your personal data by order of public authorities, in particular to comply with requirements relating to data protection law, national security or, more generally, law enforcement.

RR HOTELS ET FINANCE implements organisational and technical security measures appropriate to the sensitivity of your personal data in order to protect it against any malicious intrusion, loss, alteration or disclosure to unauthorised third parties.

Your personal data is hosted and processed within the European Union. RR HOTELS ET FINANCE may, however, use certain service providers located abroad, or who use processors located abroad, including outside the European Economic Area (EEA). In such cases, the transfer of your personal data outside the EEA will be subject to appropriate safeguards in accordance with applicable data protection legislation, in particular through the signature, on a case-by-case basis, of contractual clauses based on the European Commission’s model or any other mechanism compliant with the GDPR.

ARTICLE 7 – YOUR RIGHTS OVER YOUR PERSONAL DATA

Within the limits defined by law, you have the following rights:

• Right of access: you may obtain information about the processing of your personal data and a copy of that data;
• Right to rectification: you may request the correction of personal data that you consider incomplete or inaccurate;
• Right to erasure: you may request the erasure of your personal data;
• Right to restriction of processing: you may request that the processing of your personal data be restricted;
• Right to data portability: you have the right to have the personal data you have provided to us returned to you or, where technically possible, transferred to a third party, in a machine-readable format;
• Right to withdraw your consent at any time where processing is based on your consent (for example for sending newsletters or for cookies that are not strictly technical);
• Right to lodge a complaint with the French data protection authority, the Commission Nationale de l’Informatique et des Libertés (cnil.fr);
• Right to set instructions regarding the retention, erasure or disclosure of your personal data after your death;
• Right to object: the right to object to the processing of your personal data on grounds relating to your particular situation.

ARTICLE 8 – HOW TO EXERCISE YOUR RIGHTS

If you have any question or comment about the content or application of our Privacy Policy, please contact us (direction@rr-hotelsetfinance.fr) for any clarification or further information.

To exercise your rights, you may send us a request, together with a copy of proof of identity, to either of the following addresses: by post to RR HOTELS ET FINANCE, Legal Department, 9, rue du 4 septembre – 75002 PARIS, or by email to <direction@rr-hotelsetfinance.fr>.

A response will be sent to you within one (1) month of receipt of your request. This period may be extended by two (2) months depending on the complexity and/or number of requests.

ARTICLE 9 – COOKIES

A “cookie” is a small piece of information, usually identified by a name, that may be sent to your browser by a website you visit. Your web browser stores it for a certain period and sends it back to the web server each time you reconnect to it.

Where a cookie is purely functional (remembering information entered in forms, managing and securing access to restricted areas), its use does not require your prior consent. If it is not purely functional, its use requires your prior consent.

The rr-hotelsetfinance.fr website does not place any audience measurement or advertising cookies on your device. You remain free to configure your browser at any time to refuse or delete cookies.

Personal data resulting from cookies placed on your device is kept for a maximum of 13 months.