I. SCOPE OF APPLICATION AND DEFINITIONS
Evok collection L (hereinafter “Evok”) is a French société en nom collectif registered at the Commercial and Companies Registry of Paris under the number 809 374 994, whose registered office is located at 17, avenue de l’Opéra – 75001 Paris, providing advisory, management and executive management services in the high-end hotel and restaurant sectors, including the usually associated services (spa, fitness and wellness, venues), for and within the framework of several establishments which are members of the Evok collection group – branded “members of the Evok collection” – , that is to say:
Bast, Courchevel, comprising two chalets: Nanuq, Les Bastidons
Nolinski Paris, 1st arrondissement of Paris
Palais Royal Restaurant, 1st arrondissement of Paris
Brach Paris, 16th arrondissement of Paris
Brach Paris Fitness Club, 16th arrondissement of Paris
Cour des Vosges, 4th arrondissement of Paris
Nolinski Venezia, Venice, Italy
and of various websites published by the Evok group to promote and operate its establishments and activities:
Within the framework of the business activities of the group, Evok inner processes personal data within the meaning of the French Act of 6 January 1978 on computer technology, computer files and civil liberties and of the European Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data which entered into force on 25 May 2018, hereinafter “Processing”.
Personal data: personal data is any and all information relating to an identified or identifiable natural person, directly or indirectly, by reference to an identification number or to one or more factors specific to that natural person. To determine whether a person is identifiable, account should be taken of all the means enabling his or her identification which are available or accessible to the controller or to any other person.
Processing: Processing of personal data means any operation or set of operations performed on such data, whatever the means used, and in particular the collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, as well as locking, erasure or destruction.
Data Subject: a person concerned by the processing of personal data is the person to whom the data which is the subject of a processing relates.
The purpose of this Personal Data Processing Policy Charter is to set out for the benefit of those persons coming into contact, or wishing to come into contact, in one way or another, with the Evok group, and in particular users of the websites of the Evok group, the conditions according to which their personal data will be subject to Processing, and the rights of the Data Subjects in this regard.
II. DATA PROCESSED
1°) Categories of Data:
Without prejudice to the provisions specific to the activities relating to Bast (see below the section on Bast), the Data processed by Evok, from whatever source they are collected, are the following:
Personal-related data: marital status, first name, second name, majority, country of origin or of residence possibly revealed by the Contact Data or the other Personal-related data ;
Contact data: e-mail address, land line and mobile phone numbers, postal address, social media identifiers;
Login data: details of the connection terminal such as IP address, IMEI number or mobile phone number; nature and model of the terminal; location of terminal; access software and operating systems; connection dates and times;
Browsing data: pages visited on the website or before logging on to the website; browsing time and duration; browsing history; saving of personal preferences.
2°) Data Subjects:
Personal-related data and Contact data processed by Evok are collected from all persons engaging in a contact with Evok or with the establishments which are members of the Evok group: customers, prospective clients, suppliers, trade partners, press, job seekers etc., whether by visiting or browsing the websites of the group, by sending contact forms, via booking forms, e-mails or other correspondence, or verbally by phone or actual physical contact, directly or by providing a business card or of any other materials containing said data.
Login data and Browsing data processed by Evok are collected from all persons that continue browsing the websites of the group after having accepted the use of cookies other than mere functional cookies (find out more about Cookies) ;
Minors. The websites of the Evok group are designed for majors. Legal guardians of minors must take responsibility to monitor and supervise their use of communication tools, and in particular their web browsing behaviour.
3°) Data collected directly by Evok:
Evok will collect directly itself certain data in certain configurations, as follows:
On or via the websites: evokhotels.com and hameaudelavoliere.com
where the user confirms that he or she is a major, before continuing browsing the website: Personal-related data;
where the user of the website fills in and sends a subscription form for the newsletter “EVOK NEWS”: marital status, first name, second name; e-mail address, or for other Evok group news feeds: e-mail address;
where the user of the website fills in and sends a contact form on the website hameaudelavoliere.com using the “Situation” thumbnail: second name and e-mail address;
The data referred to above, where their disclosure is required by Evok from the website user, are necessary to the performance and delivery of the requested service, in keeping with the purposes of the Processing.
the installation or reading of Cookies and trackers directly by Evok– find out more about Cookies: Personal-related data, Contact data, Login data, Browsing data,
upon receipt of all other correspondence or miscellaneous contacts (by letter, e-mail, text message, fax, telephone, social media invitation, internet sharing etc.) on the part of any persons having contacted Evok by any means whatsoever, and in particular on any address using “@evok.com” : etc. : Personal-related data and Contact data, according to the contents disclosed by the person and to the chosen means of communication; and, if the contact is made via the internet: Login data and Browsing data;
on the occasion of any meeting between people within a professional or commercial context giving rise to voluntary disclosure by the data subject of such data, whether verbally, or through the exchange of business cards, brochures or any other materials containing the data: Personal-related data and Contact data depending on the contents disclosed by the person;
4°) Data collected by members of the Evok group other than Evok:
Evok processes Personal-related data, Contact data, Login data and Browsing data collected by the following persons which are members of the Evok collection group:
SAS Brach Paris – RCS Paris 803 406 685, having its registered office at 1-7 rue Jean Richepin – 75116 Paris ; see the Personal data processing charter of Brach Paris
SAS Brach Paris Fitness Club – RCS Paris 823 711 239, having its registered office at 17, avenue de l’Opéra – 75001 Paris ; see the Personal data processing charter of Brach Paris Fitness Club
SAS Nolinski Paris – RCS Paris 803 406 909, having its registered office at 16, avenue de l’Opéra – 75001 Paris ; see the Personal data processing charter of Nolinski
SAS Palais Royal Restaurant – RCS Paris 400 398 715, having its registered office at 41-43 rue de Valois – 75001 Paris ; see the Personal data processing charter of Restaurant du Palais Royal
SAS Cour des Vosges – RCS Paris 827 781 584 having its registered office at 17, avenue de l’Opéra – 75001 Paris, see the Personal data processing charter of Cour des Vosges
S.R.L Nolinski Venezia – P.IVA: IT04707740272 – C.F.: 04707740272 having its registered at Calle Larga XXII Marzo-S. Marco 2032 – 30124 – Venezia, see the Personal data processing charter of Nolinski Venezia
S.L Brach Madrid – NIF : B67341891 having its registered at Gran Vía, 20– Madrid, see the Personal data processing charter of Brach Madrid
5°) Data collected by the Evok group’s trade partners:
Evok processes Personal-related data, Contact data, Login data and Browsing data collected by the following persons which are Evok group partners:
La Fourchette SAS, via the booking module.lafourchette.com accessible by activating the restaurant booking form on the websites: restaurantdupalaisroyal.com, rejaneparis.com and brachparis.com; see the Privacy Policy of La Fourchette SAS
TravelClick Inc., an American company, via the hotel room booking module reservations.travelclick.com, accessible by activating the booking form on the websites: nolinskiparis.com and brachparis.com ; see Privacy Policy of TravelClick Inc.
Cimalpes SAS, publisher of the website cimalpes.ski including a booking module, for Bast ; see the Personal Data and Cookies policy of Cimalpes
Evok also processes the same categories of Data that are disclosed to it by booking operators, in particular on-line booking operators, which people use and supply Data to for the purpose of making a booking in an establishment of the Evok group. Persons are required to check on the websites of these operators, or by any other means available, their policies or terms applicable to personal data processing (such as, for instance, but not limited to: Bookatable Limited, website publisher for restaurant.michelin.fr including a booking module, see Privacy Policy of Bookatable Limited ; Booking.com BV; see Privacy Statement of Booking.com).
6°) Data collected via third-party Cookies enabled on the websites of the Evok group
Evok processes Login data and Browsing data collected by the Cookies enabled by Evok and implemented on the websites evokhotels.com and hameaudelavoliere.com by Google, via Google Analytics and Adwords which are used by Evok.
Find out more about Cookies.
7°) Publicly accessible Data:
Evok also processes publicly accessible Personal-related data and Contact data, such as for instance, data supplied on a website, a telephone messaging service, the masthead in print publications, publicly available professional registers etc.
III. CHARACTERISTICS OF PROCESSING
1°) Controller:
Evok is the Controller, that is to say the person who determines the purposes and means of Processing, which are set out in this Charter.
2°) Activities giving rise to Processing:
The personal Data described in II are used and processed by Evok within the framework of the following activities:
Activities(i) :
development of hotel establishments, restaurants and wellness centres;
conception of promotional strategies and tools, and diffusion of the group and of the establishments of the group;
development of commercial packages of the group and of the establishments of the group;
creation of events, in particular around and within the framework of the establishments of the group;
communications regarding the previous activities: offers, events and miscellaneous news, directed at prospective customers, press, partners, operators in the same business sector.
3°) Processing purposes:
Personal-related data and Contact data. The purpose of the Processing of such Data is communications, promotional and prospecting services relating to the development of the activities of the Evok group, as well as to implement loyalty programs, and for instance:
to provide a news feed relating to the Evok group, in particular via the newsletter;
invitations to public relations events;
communications relating to commercial packages;
by means of e-mailing and text messaging campaigns.
Login data and Browsing data: see the Cookies section.
4°) Basis for Processing:
Personal-related data and Contact data. The Processing is based:
where the Data Subject sends a contact or subscription form for a newsletter (“EVOK NEWS”) or for other group news feeds or any other means of correspondence by virtue of which he or she provides data, on at least one of the following grounds: the satisfaction of the request expressly formulated by the Data Subject, the consent thus granted by the Data Subject;
where the Data Subject discloses his or her data without a form, on: the consent of the Data Subject; and the achievement of the legitimate interests pursued by Evok on account of its activities and of its corporate purpose, for disclosure to Evok clients or to professionals related or interested in Evok’s business sector
The legitimate interests pursued by Evok lie in the achievement of its corporate purpose via communications on the development of its establishments, the response and responsiveness to requests of members of the public and of professionals, the diffusion, media exposure and commercial attraction of its offerings and activities, particular to the extent they imply attraction of the public and public traffic.
Login data and Browsing data. The Processing is based on the consent of the Data Subject, which is solicited from the very first visit to the website from which the data are collected.
5°) Data retention period:
Personal-related data and Contact data will be kept in a form which permits identification of Data Subjects for no longer than is necessary for the purposes for which they are processed.
Where Processing is based on the Data Subject’s consent, the Data processed will only be kept by Evok for as long as the consent prevails.
Any new disclosure of Data, even where such have already been disclosed beforehand by the Data Subject, according to one or the other of the means of collection mentioned under section II “Data processed” will trigger a new retention period, irrespectively of the previous retention periods.
6°) Recipients of the Data and processors:
The performance of certain operations necessary to the Processing implemented within the framework of the Activities (ii) (database formatting and maintenance, storage of Personal data and Contact data) are carried out on behalf of Evok by the company known as Sarbacane Software SAS, registered at the Commercial and Companies Registry of Lille no. 509 569 598, whose registered office is located at 3 avenue Antoine Pinay – Industrial Estate (ZA) “des Quatre Vents” – 59510 HEM, and Experience Hotel Software SAS, RCS Paris B 798 181 699 whose registered office is located at 128 avenue La Boétie 75008 Paris, acting in a processor capacity.
See Sarbacane’s Personal Data Processing Charter.
See Experience Hotel’s Personal Data Processing Charter
The Data collected or received by Evok are not transmitted by Evok, to any other recipient apart from, as applicable, the legally empowered authorities, within the framework of a specific assignment or of the exercise of a right of communication
IV. BAST
In addition to what is stated in the foregoing sections, within the framework of its booking management and hotel services activity for Bast and for the purposes of concluding and delivering said services, Evok will carry out Processing with the following characteristics, and which comes in addition to the other Processing otherwise mentioned in this Charter.
1°) Data Subjects Concerned by the Processing:
Any person booking or staying, or wishing to book or stay in one of the two chalets part of Bast : Nanuq and Les Bastidons.
2°) Categories of Data collected:
Data relating to vital statistics: first name*, second name*, marital status*, copy of identity card supplied when checking in*, nationality* ; country of residence* ; other information contained on the identity card: date* and place of birth, height, eye colour, photograph; shoe size and weight if request to rent ski-ing equipment;
Personal-related data: family status and composition*, age of children; lifestyle habits: beverages, food preferences, other specific personal information disclosed by the data subjects ;
Professional-related data, if booking is made on professional grounds as disclosed by the data subjects ;
Specific data relating to or liable to reveal, even allegedly:
personal health, if the Data is volunteered by the data subjects in view of specific services or support (for instance in the case of a disability, special eating requirements, specific measures of hygiene);
political opinions, trade-union membership, philosophical or religious beliefs of persons, if the Data is volunteered by the data subjects due to specific demands or to the denomination for which the booking was made or the invoice established (for instance: booking by a political, trade union or religious organisation or association; preparing special meals within the framework of the half-board option) ;
Evok will only process specific Data where such are combined with a request presented by a Data Subject and that the Processing is necessary to the performance of the services thus requested. Specific Data which is revealed incidentally or allegedly by other non specific Data processed by Evok shall not be, per se, subject to Processing.
Location data: place* and dates* of stays; ski areas visited if request for supply of ski-lift passes;
Payment data*: as appropriate and depending on the customer’s chosen method of payment: RIB (bank identity statement), IBAN, name or corporate name of account holder, credit card details or details of other payment cards accepted by Evok (American express, Diners etc.) ; amounts paid for services and billing details.
The Data above marked with an asterisk (*) are indispensable to the conclusion of the bookings and to the efficacy of stays, which cannot be take place without disclosing such Data.
The other Data are necessary only to the extent where the Data Subject intends to procure performance of services whose contents or nature are dependent on the relevant Data; their supply is therefore strictly a matter of appraisal by the Data Subjects.
3°) Collection of Data:
The Data processed by Evok within the framework of the management of hotel bookings and services relating to Hameau de la Volière are collected:
directly by Evok, where it is contacted via e-mail, using the booking contact form available on the website www.hameaudelavoliere.com, or by telephone ;
via booking or tourism networks or operators that data subjects may use and to which they supply Data to make a booking in the Nanuq and Les Bastidons chalets, and which transmit the collected data to Evok. Data subjects are required to check on the websites of these operators, or by any other means available, their policies or terms applicable to personal data processing (such as, for instance, but not limited to: Cimalpes SAS, website publisher of cimalpes.ski including a booking module for Bast ; see Personal Data and Cookies policy of Cimalpes).
4°) Contractual requirement of Data:
Only Data relating to vital statistics, certain Personal-related data, certain Location data and the Payment data are necessarily required to conclude a booking and to perform a service; they are marked with an asterisk above. Other Data may be freely and voluntarily disclosed by Data Subjects within the framework of their specific requests.
5°) Processing purposes:
The purpose of the Processing referred to in this section is the performance of the services requested by Evok’s customers in relation to their stay at Hameau de la Volière and :
to manage the capacity and to organise accommodation at the chalets ;
to manage customer access to the chalets ;
to plan and supply the services requested by the customers in relation to their stay, and the resources and supplies accordingly;
to ensure payment of the services.
6°) Basis for Processing:
The Processing referred to in this section is based on one or more of the following grounds:
– the need for performance of the contractual or pre-contractual services requested by the Data Subjects;
– the implementation of the legal requirements of the Controller in particular as concerns account keeping and the archiving of business records and invoices.
7°) Data retention period:
The Data referred to in this section “Bast” will be kept for no longer than is strictly necessary to the performance of the contractual or pre-contractual services requested by the Data Subjects within the framework of their booking and stay.
Data relating to vital statistics, Professional-related data, Personal-related data, can be kept for an additional period of one year from the end of the stay.
Specific data are only kept for the period strictly necessary to the performance of the service requested or to adherence to legal requirements (in particular storage and archiving of nominal invoices, book keeping and other accounting or tax requirements).
Payment data are kept for the period strictly necessary to each payment in view of which they are disclosed or to adherence to legal requirements (in particular storage and archiving of nominal invoices, book keeping and other accounting or tax requirements).
8°) Recipients of the Data and processors:
For Processing operations relating to the management of hotel services, Evok uses a platform provided by the German company known as protel hotelsoftware GmbH, which also ensures the storage of the Data disclosed by Evok and, in this latter respect, acting as a processor. See protel’s Privacy Policy.
For Processing operations relating to the invoicing and payment of services, Evok will transmit the Payment data as well as the Data relating to vital statistics and Personal-related data strictly necessary to invoicing and payment, to the company known as Cimalpes SAS mentioned above (see the Personal Data and Cookies policy of Cimalpes).
The Data collected or received by Evok are not transmitted by Evok, to any other recipient apart from, as applicable, the legally empowered authorities, within the framework of a specific assignment or of the exercise of a right of communication.
V. COOKIES
1°) Definition :
A Cookie is a tracking tool which consists of a small computer file or a short alphanumeric combination, which is automatically installed or read by a network provider or a website on the terminal device (computer, mobile phone, tablet, video games console) of the Data Subject, that can access the data already stored in said terminal, or write or store information on that device.
2°) Purposes of the Cookies used and information transmitted by Cookies:
The operation of the websites evokhotels.com and hameaudelavoliere.com requires the implementation of the following Cookies, which are presented according to the functionalities provided by each type of Cookie :
– Implementation and facilitation of electronic communication and supply of online communication services, exclusively: Functional cookies;
– Improvement of website browsing experience; organisation of visualized content (including Google Maps interactive maps), saving of personal data already entered by the Data Subject, tracking of user preferences and options, for instance for the efficiency of a booking: Efficiency cookies;
– Measuring web traffic: Web traffic cookies;
– Monitoring browsing habits (websites, pages visited, search history and search terms used etc.) and preferences of the data subject in view of customized or targeted ads: Advertising cookies. Advertising cookies are also installed by Google via Google Maps interactive maps accessible on the websites: the Data collected (login, location and browsing Data) are not processed by Evok but by Google ;
– Promotion of websites and improvement of their user-friendliness, via social media content sharing functionalities (Facebook, Twitter, Instagram, Google+, Pinterest, Linkedin), by means of the share button enabling web browsing to be tracked by the websites of these social media, whether or not these buttons or links are hit by the Website user: Social media cookies.
3°) Consent of subjects:
The use of Efficiency cookies, Advertising cookies, Web traffic cookies and Social media cookies, that is to say all Cookies apart from functional Cookies, implies the consent of the Data Subject, and if the latter is a minor, the consent of his or her legal guardian of which the minor Data Subject is required to supply the e-mail address.
In accordance with article 32 II of the act of 6 January 1978, the consent of the subject can result from his or her connection settings. Users of the website are prompted to check or alter their settings before pursuing their browsing experience on the website. By continuing to browse the website, that is to say by visiting another page of the website from the website or by clicking on any item of the website (image, link, “search” button for instance), the data subject expresses his or her consent to the use of the above mentioned Cookies.
The user can object to the use of Cookies or withdraw at any moment his or her consent: see Blocking or Managing Cookies.
4°) Cookies’ validity period:
Save exercise by the Data Subject of his or her right of objection or of withdrawal of consent, the consent to the installation of the Cookies is granted for a period of thirteen (13) months. On the expiry of this period, the Data Subject’s consent will have to be re-obtained to enable the use of Cookies. As a consequence, Cookies are only active for thirteen months after their initial installation on the terminal device of the user having consented to such. The validity period of Cookies is not extended by new visits to the websites.
5°) Blocking or Managing Cookies:
The website user can object to the use of Cookies or of certain Cookies on his or her terminal and in particular benefits from the following means to this effect.
Browser settings:
Click on the browser menu (Safari, Mozilla etc.), then choose “Preferences” or “Settings” or “Tools”; then proceed as follows depending on your web browser:
Safari: “Privacy” > “Cookies and website data”: choose the desired options; to block cookies entirely, select: “Always block” and check the box “Website tracking: Ask websites not to track me” if not already checked;
> also, to manage Data and Cookies already stored on the terminal: “Manage website data”: make the desired data deletions by selecting the Data and Cookies sources and categories in the panel then by clicking the “delete” button;
Mozilla Firefox: “Privacy and Security” > “Cookies and site data”: make the desired settings, after consulting the “Learn more” section;
– to block all Cookies : click the button “Block Cookies and site data (may cause websites to break)” ;
– to manage Cookies: click on the button “Enable Cookies (recommended)” and select among the proposed options (i) keep Cookies: to limit to the maximum extent possible, select “until I close Firefox”, (ii) accept third-party Cookies: to limit to the maximum extent possible, select “Never” ;
– also, with the use of the three buttons “Clear Data”, “Manage Data” or “Manage Permissions”, the user can delete all (“Clear”) or part (“Manage”) of the Data and Cookies already stored on the terminal or authorise certain Websites only to use these Cookies (“Manage Permissions”) ;
Internet Explorer: “Internet Options” > Thumbnail “Privacy” > “Advanced” button to prompt the window “Advanced Privacy Settings” > check the box “Override automatic cookie handling”, then select the desired option: accept, block or be prompted to determine the desired configuration for first-party and third-party Cookies.
Chrome: “Show advanced settings” (at the bottom), then in the Privacy Section click on “Content settings” then “Cookies” section, then:
– to delete all or specific Cookies : “All cookies and site data” > “Remove all”; or mouse over the name of the website and Delete
– to change the default settings relating to Cookies: turn “Allow sites to safe and read cookie data” on or off; turn on “Block third-party cookies” to block third-party Cookies;
to block Cookies for a specific site only: next to “Block”, “Clear on exit” or “Allow” click “Add”, then enter the Website address and click “Add”.
Other specific solutions:
Besides the general settings of your browser, there are solutions to control, manage or personalise, depending on their purpose or the entity using the Cookies.
Advertising cookies. These Cookies are implemented via Adwords provided by Google. To disable these: https://policies.google.com/technologies/product-privacy?hl=fr, then “Control your ads settings” and select the desired options. The user may also install a plug-in browser sot that the personalised Google ads remain disabled even after deleting the Cookies by clicking on “Find out more”
Advertising Cookies used by Google can be disabled on: https://policies.google.com/technologies/cookies?hl=fr&gl=fr, and by clicking on “ad settings”, or further still on: https://policies.google.com/privacy?hl=fr&gl=fr then “Your privacy controls”.
As a general rule, most advertising Cookies can also be controlled via an online choice platform: www.youronlinechoices.eu, http://optout.aboutads.info/?c=2&lang=EN (USA) or https://youradchoices.ca/.
Google Maps Cookies: go to: https://policies.google.com/technologies/product-privacy, then select the desired options in the Google Maps menu. The Google Maps terms of service are also available by clicking on the link on the interactive maps available on the websites.
Web traffic cookies. These Cookies are implemented using the Google Analytics tool provided by Google. Users can disable these by installing the opt-out browser add-on at: https:// support.google.com/analytics/answer/181881 ?hl=fr.
Social media cookies, implemented via the share buttons accessible on the evokhotels.com and hameaudelavoliere.com websites. Social media networks generally provide for the possibility to block, manage or personalise Social media cookies via an add-on available to all, network members and non-members alike, as well as via the settings of the member’s account. To manage the Cookies, go to: Facebook and Instagram (and other Facebook products) : https ://www.facebook.com/policies/cookies/ ;
Twitter: https ://support.twitter.com/articles/20170518-utilisation-des-cookies-et-des-technologies-similaires-par-twitter ;
Pinterest : https ://policy.pinterest.com/fr/cookies ;
LinkedIn : https ://www.linkedin.com/legal/cookie-policy?_l=fr_fr ;
Google + : https ://policies.google.com/technologies/cookies?hl=fr.
Cookies personalisation page. Users can also visit the websites’ page devoted to the Personalisation of Cookies.
6°) Consequences of blocking:
Objections to Functional cookies, in particular if the user objects to all Cookies, will make operation of the communication service impossible. The user will not be able to use or browse the website.
Objection to Efficiency cookies will not bar access to the websites and their functionalities, but may lead to a less efficient and less seamless browsing experience and to the reduced performance of the websites’ functionalities and services, including booking services.
VI. RIGHTS OF THE DATA SUBJECT
1°) Right of access:
The Data Subject, providing proof of identity, shall have the right to question Evok in view of obtaining:
confirmation of whether or not the personal Data concerning him or her have been subject to Processing;
information relating to the purposes of the Processing, to the categories of personal Data processed and to recipients or categories of recipients to which the Data are disclosed;
where applicable, information relating to contemplated transfers of personal Data to countries outside the European community;
disclosure, in accessible form, of the personal Data which concern him or her as well as any and all information available as regards the origin thereof;
information enabling him or her to know and challenge the logic involved in any automatic personal data processing, as applicable, in the event of a decision made on the grounds of the latter and producing legal effects with regard to the interested party.
At the request of the Data Subject, a copy of the personal Data which concerns him or her will be sent to him or her by the Evok. For any further copies, the costs associated with the reproduction and delivery thereof will be for the account of the Data Subject.
Evok will not respond to manifestly unreasonable requests, in particular due to their number, or because of their repetitive or systematic character.
2°) Right to rectification:
The Data Subject, providing proof of identity, shall have the right to obtain, without undue delay, the rectification of inaccurate personal Data concerning him or her. Taking into account the purposes of the Processing, the Data Subject shall have the right to have incomplete personal Data completed, including by means of providing a supplementary statement.
3°) Right to erasure:
The Data Subject, providing proof of identity, shall have the right to obtain from the Controller the erasure, without undue delay, of personal Data concerning him or her, where one of the following grounds applies:
the Data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
the data subject has withdrawn consent and where is no other legal ground for the Processing of the Data;
the data subject exercises his or her right to object to processing;
the Data have been collected from the Data Subject when he or she was a child.
4°) Right to restriction of Processing:
The Data Subject, providing proof of identity, shall have the right to obtain restriction of Processing where one of the following cases applies:
the accuracy of the Data retained is contested by the Data Subject, for a period enabling the Controller to verify the accuracy of the Data;
the Processing is unlawful and the Data Subject opposes the erasure thereof and requests the restriction of their Processing instead;
the Controller no longer needs the Data but they are required by the Data Subject for the exercise of his or her legal claims;
the Data Subject has exercised his or her right to object pursuant to 6°) pending the verification whether the legitimate grounds of the Controller override those of the Data Subject.
Where Processing has been restricted under this paragraph, such Data shall, with the exception of storage, only be processed with the Data Subject’s consent, or for the exercise of legal claims, for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
A data subject who has obtained a restriction of Processing pursuant to this paragraph will be informed before the restriction is lifted.
5°) Data portability:
Where the Processing is based on the consent of the Data Subject or on performance of the contract or on the pre-contractual measures requested by the Data Subject and that the Processing is carried out by automated means, the Data Subject shall have the right, without prejudice to the right contemplated in 3°) and to the rights and freedoms of third parties, to receive the Data concerning him or her, which he or she provided to the Evok in a structured, commonly used and machine-readable format and to transmit those Data to another controller, or to have the data transmitted directly to another controller, where this is technically feasible.
6°) Right to object:
The Data Subject may object at any time, on legitimate grounds, to the Processing of his or her Data that should be based exclusively on the legitimate interests pursued by Evok or by a third party authorised by Evok.
The Data Subject shall have the right to object, at no expense, and at any time, to the Data concerning him or her, being used for direct marketing purposes, in particular commercial marketing, including for the purpose of profiling where such is related to such direct marketing, by the current Controller (Evok) for such processing or the controller for any subsequent Processing.
The exercise of this right shall not adversely affect the lawfulness of the Processing carried out prior to the exercise of the right to object.
7°) Withdrawal of consent:
Where Processing is based on consent of the data subject, the latter shall have the right to withdraw his or her consent at any time.
The exercise of this right shall not adversely affect the lawfulness of Processing based on consent before its withdrawal.
8°) Automated individual decisions, including profiling:
Unless he or she has granted express consent or that the conclusion or performance of the contract so requires, the Data Subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects him or her.
9°) Instructions relating to the Processing of Data after death:
Any data subject may issue instructions relating to the storage, erasure and disclosure of his or her personal Data after his or her death. These instructions may be either general or specific. Instructions of a general nature concern all personal Data relating to the Data Subject and can be recorded with a digital trusted third party certified by the Commission nationale de l’informatique et des libertés. Instructions of a specific nature concern the Processing of personal Data mentioned by these instructions. They are recorded with the relevant controllers. General and specific instructions define the manner according to which the data subject intends for the rights mentioned in this section to be exercised after his or her death.
The Data Subject can alter or revoke his or her instructions at any time.
These instructions may appoint any person as an executor. That person will then be entitled, when the Data Subject dies, to examine the instructions and to request the relevant controllers to implement these. Failing such appointment, or, save instruction to the contrary, in the event of death of the appointee, his or her heirs are entitled to examine the instructions upon the death of their predecessor in title and to request the relevant controllers to implement these.
10°) Exercise of rights with respect to Evok:
The Data Subjects shall exercise the rights contemplated in this section by sending their requests or instructions by post to:
Evok collection L
Personal Data Protection
17, avenue de l’Opéra – 75001 Paris
or
or by e-mail to:
inforgpd@evokhotels.com
Requests must include due documentary evidence of the identity of the person responsible for the request. In the event of reasonable doubt, Evok may ask for additional information necessary to confirm such identity.
That person must indicate in his or her request, the rights that he or she intends to exercise, as well as the Data and the Processing (purposes, basis) to which such exercise pertains and where applicable, the instructions, that he or she intends to send the Controller.
Incomplete requests will not be processed. In any event, Evok reserves the right to claim any additional information necessary to the implementation of the rights invoked.
11°) Complaints with the supervisory authority:
Without prejudice to any other effective judicial or administrative remedy, any Data Subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State in which he or she has his or her habitual residence, his or her place of work or in the location where the violation was allegedly committed, if he or she considers that the personal Data Processing concerning him or her is an infringement of the regulatory framework relating to the protection of personal data.
In France, the supervisory authority is the Commission Nationale de l’Informatique et des Libertés (CNIL) located at 3, place de Fontenoy- TSA 80715 – 75334 Paris Cedex 07.
VII. PERSONAL DATA PROTECTION OFFICER
Mr Anthony Hamet is appointed as the Personal Data Protection Officer (PDPO).
Data subjects can contact the PDPO regarding any issues relating to the processing of their personal data and to the exercise of the rights they are conferred by the General Data Protection Regulation.
To contact the PDPO:
– by post
Evok Collection L
Personal Data Protection
For the attention of the Personal Data Protection Officer
17, avenue de l’Opéra – 75001 Paris
– by e-mail: inforgpd@evokcollection.com
