Legal Notices & Crédits
I. SCOPE OF APPLICATION AND DEFINITIONS
BRACH PARIS (hereinafter “Brach”) is a French société par actions simplifiée registered at the Commercial and Companies Registry of Paris under the number 803 406 685, whose registered office is located at 7, rue Jean Richepin – 75116, Paris, whose business activity is the operation and management of high-end hotels, spas and restaurants including related events associated with or hosted by these establishments.
BRACH PARIS FITNESS CLUB (hereinafter “Brach FC”) is a French société par actions simplifiée registered at the Commercial and Companies Registry of Paris under the number 823 711 239, whose registered office is located at 17, avenue de l’Opéra – 75001 Paris, and whose business activity is the operation of sports clubs and fitness centres, paramedical services and the retail of sports equipment and accessories.
Brach and Brach FC are members of the Evok Hôtels Collection group (hereinafter the “Evok Group”), which is coordinated by the partnership known as Evok Hôtels Collection SNC, located at 17, avenue de l’Opéra in the 1st arrondissement of Paris (hereinafter “Evok”)
Brach currently conducts its business within the framework of the following establishment (hereinafter the “Establishment”) and bespoke website (hereinafter the “Website”):
- Brach Paris (comprising a hotel, restaurant, bar, patisserie, kitchen garden and sports club), located at 1-7, rue Jean Richepin in the 16th arrondissement of Paris;
Brach FC currently conducts its business activity within the framework of the Brach Sports Club.
Within the framework of their business activities, Brach and Brach FC process personal data within the meaning of the French Act of 6 January 1978 on computer technology, computer files and civil liberties and of the European Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data which entered into force on 25 May 2018, hereinafter “Processing”.
Personal data: personal data is any and all information relating to an identified or identifiable natural person, directly or indirectly, by reference to an identification number or to one or more factors specific to that natural person. To determine whether a person is identifiable, account should be taken of all the means enabling his or her identification which are available or accessible to the controller or to any other person.
Processing: Processing of personal Data means any operation or set of operations performed on such Data, whatever the means used, and in particular the collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, as well as locking, erasure or destruction.
Data Subject: a person concerned by the Processing of personal Data is the person to whom the Data which is the subject of a Processing relates.
The purpose of this Personal Data Processing Charter is to set out for the benefit of those persons coming into contact, or wishing to come into contact, in one way or another, with Brach, and in particular users of the Website, the conditions according to which their Personal Data will be subject to Processing, and the rights of the Data Subjects in this regard.
II. DATA PROCESSED
1°) Categories of Data:
The Data liable to be processed by Brach and Brach FC, from whatever source they are collected, are the following:
- Data relating to vital statistics: first name*, second name*, marital status*; date of birth*;
- Contact data: e-mail address*, land line and mobile phone numbers*, postal address, social media identifiers;
- Login data: details of the connection terminal such as IP address, IMEI number or mobile phone number: nature and model of the terminal; location of terminal; access software and operating systems; connection dates and times;
- Browsing data: pages visited on the Website or before logging on to the Website; browsing time and duration; browsing history; saving of personal preferences;
- Personal-related data: nationality*, country of residence*, copy of identity card* supplied when checking in to the hotel or taking out a membership to the Sports Club (for members); other information contained on that card: date and place of birth, height, eye colour; family status and composition, age of children; lifestyle habits: beverages, food preferences, pets, other specific personal information disclosed by the Data Subjects ;
- Professional-related data, if a contact, request, booking or purchase is made or a service received on professional grounds or in a professional context and the data disclosed by the Data Subjects ;
- Specific data relating to or liable to reveal, even allegedly:
- personal health, if the Data is volunteered by the Data Subjects in view of specific services or support from the Establishment (for instance in the case of a disability, special eating requirements, specific measures of hygiene, nature and reasons for consultations monitored at the Sports club and fitness centre);
- political opinions, trade-union membership, philosophical or religious beliefs of persons, if the Data is volunteered by the Data Subjects due to specific demands or to the denomination for which the booking was made or the invoice established (for instance: booking by a political, trade union or religious organisation or association; preparing special meals) ;
Brach and Brach FC will only process specific Data where such are combined with a request presented by a Data Subject and that the Processing is necessary to the performance of the services thus requested. Specific Data which is revealed incidentally or allegedly by other non specific Data processed by Brach and Brach FC shall not be, per se, subject to Processing.
- Location data: place* and dates* of stays; places visited when ordering taxis or other similar services; booking dates* of spaces or services (classes, barber consultations) at the Sports Club;
- Payment data*: as appropriate and depending on the customer’s chosen method of payment: RIB (bank identity statement), IBAN, name or corporate name of account holder, credit card details or details of other payment cards accepted by Brach and Brach FC (American express, Diners etc.) ; amounts paid for services and billing details.
The Data above marked with an asterisk (*) are indispensable to the conclusion and efficacy of bookings, stays or services ordered, which cannot be validated or provided without disclosing such Data.
The other Data are necessary only to the extent where the Data Subject intends to procure performance of services whose contents or nature are dependent on the relevant Data; their supply is therefore strictly a matter of appraisal by the Data Subjects.
2°) Data Subjects:
Data relating to vital statistics and Contact data processed by Brach are collected from all persons coming or wishing to come into contact with the Establishment, including the Sports Club: customers, prospective clients, suppliers, trade partners, press, job seekers etc., whether by visiting or browsing the Website, by sending contact forms, subscribing to the newsletter, via booking forms, e-mails or other correspondence, or verbally by phone or actual physical contact.
Personal-related data, Professional-related data, Specific data, Location data and Payment data are collected, as appropriate, according to what is stated in 2°), from all persons making a booking or a stay or other experience (meals, receptions, events, Sports Club) within the Establishment, or more generally receiving a service or goods from the Establishment.
The Data processed by Brach FC (Data relating to vital statistics, Personal-related data, Professional-related data, Specific data, Location data and Payment data) are collected from any data subjects coming into contact, or wishing to come into contact with the Sports Club, for the purpose of joining, take out a membership, booking a service.
Minors. The Website is designed for majors. Legal guardians of minors must take responsibility to monitor and supervise their use of communication tools, and in particular their web browsing behaviour.
3°) Data collected directly by Brach:
(a) Brach will collect directly itself certain data in certain configurations, as follows:
- On or via the Website,
- where the person represents he or she is a major, before continuing browsing: Data relating to vital statistics;
- where the person signs up for the newsletter: Contact data (e-mail address) ;
- where the person fills in the Venue request form: Data relating vital statistics (Name and date of birth) Contact data, Personal-related data and Professional-related data according to what is disclosed by the person;
- via the installation or reading of Cookies and trackers directly installed by Brach – find out more about Cookies (see below) : Data relating to vital statistics, Contact data, Login data, Browsing data;
- upon receipt of all other correspondence or miscellaneous contacts (by letter, e-mail, text message, fax, telephone, social media invitation, internet sharing etc.) on the part of any persons having contacted Brach by any means whatsoever, and in particular on any address using “@brachparis.com” : etc. : Data relating to vital statistics, Contact data, Personal-related data, Professional-related data, Specific data, Location data and Payment data, according to the contents disclosed by the person and to the chosen means of communication; and if the contact is made via the internet: Login data and Browsing data;
- on the occasion of any meeting between people within a professional or commercial context giving rise to voluntary disclosure by the Data Subject (whether public or professional) of such Data, whether verbally, or through the exchange of business cards, brochures or any other materials containing the data: Data relating to vital statistics, Contact data, Professional-related data;
- where the Data Subject makes a booking via e-mail, over the phone or on the spot, or provides such Data when checking in to the hotel: Data relating to vital statistics, Personal-related data, Professional-related data, Specific data, Location data, Payment data, according to the contents disclosed by the person;
- where the Data Subject places an order with the patisserie: Data relating to vital statistics, Personal-related data, Location data (delivery time, billing address, delivery address, access code, floor, apartment number) and Payment data;
- and in the two previous case scenarios, if the contact is made via the internet : Login data and Browsing data;
(b) Brach FC collects itself directly certain data in certain configurations, as follows:
- on registration of the person as a member of the Sports Club, which takes place via an exchange of e-mails: Data relating to vital statistics, Contact data, where applicable: Personal-related data, Professional-related data;
- on conclusion of a subsidized membership (for members) : Payment data
- when ordering other services, outside the scope of membership: Data relating to vital statistics, Contact data, where applicable: Personal-related data, Professional-related data, Payment data, Location data.
4°) Data collected by Brach’s trade partners:
Brach processes Data relating to vital statistics, Contact data, Personal-related data, Professional-related data, Specific data, Location data, Payment data collected by the following persons which are Brach partners:
5°) Data collected via third-party Cookies enabled on the Websites
Brach processes Login data and Browsing data collected by the Cookies enabled by Brach and implemented on the Website by Google, via Google Analytics and Adwords which are used by Brach.
Find out more about Cookies.
6°) Publicly accessible Data:
Brach also processes publicly accessible Data relating to vital statistics and Contact data, such as for instance, data supplied on a website, a telephone messaging service, the masthead in print publications, publicly available professional registers etc.
III. CHARACTERISTICS OF PROCESSING
1°) Activities giving rise to Processing:
The personal Data described in II 1° are processed by Brach and Brach FC within the framework of the following activities:
– Hotel, bar and restaurant services delivered by the Establishment;
– Sports Club, fitness, wellness comprising apparatus, lessons and personal coaching including paramedical services (dietary, osteopathy, naturopathy); barber;
– Sale of pastry goods to take-away (shop);
– Kitchen garden;
– Establishment Venues: organisation of public or private, professional, cultural, artistic and public relations venues, product launches, signing sessions, interviews etc. ;
– Correspondences with people coming into contact with Brach (enquiries, candidacies, offers for goods or services etc.)
All categories of Data according to what is necessary to perform the service or to process the request and what is disclosed by the Data Subject.
Activity (ii) : Involvement of Brach and Brach FC and of their afore mentioned activities, in the business activity of the Evok Group (comprising: development of hotel establishments, restaurants and wellness centres, conception of promotional strategies and tools, diffusion and communication of the Group, development of commercial packages, creation of events) in its development, in its communications, media exposure and commercial attraction strategy: Data relating to vital statistics, Contact data, Login data and Browsing data.
2°) Processing purposes:
Activities (i): the purposes of the Processing are:
– As a general rule: to satisfy, handle, process requests or offers of any kind addressed to Brach and Brach FC; to perform, improve, diversify and anticipate services requested by the clients of Brach and Brach FC in relation to their stay or experience at the Establishment:
– As concerns the hotel, bar and restaurant services, the Sports Club and as concerns Establishment Venues: to manage the capacity, organisation, reception desk and customer access services at the Establishment and in its various spaces; to satisfy specific customer requests during their stay or experience at the Establishment, to personalise or provide customer courtesy or loyalty services, to plan Brach’s resources and supplies, to pay for services;
– As concerns the Sale of pastry goods: to ensure payment, supply, follow-up, deliver orders and to manage after sales services;
– As concerns other solicitations received by Brach and Brach FC: to respond to the contact, to possibly satisfy their request or accept their offer, even at a later date.
Activities (ii): The purpose of the Processing by Brach is the transmission of Data to the partnership known as Evok Hôtels Collection SNC, with the following purposes:
Data relating to vital statistics and Contact data: to provide trade communications, promotional and prospecting services relating to the development of the activities of the Evok Group, to implement loyalty programs (to provide a news feed relating to the Evok Group, in particular via the newsletter, invitations to public relations events, communications relating to commercial packages) by means of e-mailing and text messaging campaigns.
Login data and Browsing data: See the Cookies section.
For further details: see Evok’s Personal Data Processing Charter.
Activities (i) : Brach FC is the Controller in relation to the Data mentioned in II.3° (b), Brach is the Controller in respect of all other Processing.
Activities (ii) : Evok is the Controller.
See Evok’s Personal Data Processing Charter.
4°) Basis for Processing:
Activities (i) : The Processing is based:
For the hotel, bar and restaurant services, the Sports Club, Establishment Venues, the Sale of Pastry Goods: on performance of the contractual or pre-contractual service requested by the Data Subject ; on the implementation of the legal requirements of the Controller in particular as concerns account keeping and the archiving of business records and invoices, in addition, on the achievement of the legitimate interests* pursued by Brach and Brach FC in any case.
For all other solicitations received by Brach: on the achievement of the legitimate interests pursued by Brach and Brach FC or on the processing of the solicitation.
*The legitimate interests of Brach are in particular to successfully develop, maintain and constantly improve customer relations, to achieve their satisfaction, as well as to diversify and give incentive to its customer base, to maintain the quality of and renew its offering, including the spaces available to the public, to maintain an image and brand of luxury hotels, restaurants and venues which are viewed both as high-end, and cultural, refined and diverse;
Data relating to vital statistics and Contact data. The Processing is based on the consent of the Data Subject and, for communication requirements directed at the customers of Brach and Brach FC or at professionals affiliated with or interested in the business sectors of Brach, Brach FC and Evok, on the achievement of the legitimate interests pursued by Brach, Brach FC and Evok*.
Login data and Browsing data. The Processing is based on the consent of the Data Subject, which is solicited from the very first visit to the Website from which the Data are collected.
*The legitimate interests of Brach, Brach FC and Evok are in particular to develop the Evok Group and its establishments, to promote media exposure, commercial attraction, the quality and diversification of its offering and of its key achievements, to maintain and develop an image, a brand and a label of luxury or very high-end amenities.
It is recalled that the Controller in charge of the Processing carried out within the framework of the activities (ii) is Evok. See Evok’s Personal Data Processing Charter.
5°) Contractual requirement of Data:
Only Data relating to vital statistics, certain Contact data (e-mail address and mobile phone number, postal address as appropriate), certain Personal-related data, certain Location data and the Payment data are necessarily required to conclude a booking and to perform a service; they are marked with an asterisk above and are specified to the Data Subject prior to each booking or purchase.
Other Data may be freely and voluntarily disclosed by Data Subjects within the framework of their specific requests.
6°) Recipients of the Data:
Data relating to vital statistics, Contact data, Login data and Browsing data collected or received by Brach and Brach FC are transmitted to Evok within the framework of the aforementioned Processing for which Evok is the Controller. See Evok’s Personal Data Processing Charter.
For Processing operations whose purpose is the management and performance of Sports Club services, Brach FC uses a platform provided by the company known as HI DEVELOPPEMENT SAS, RCS registered at the Commercial and Companies Registry of Avignon under the number 440 858 660, whose registered office is at 9B Allée de la Verne 84370 Bédarrides which also ensures the storage of the Data collected within the framework of this activity, acting as processor.
The performance of certain operations necessary to the Processing implemented within the framework of the Activities (ii) (database formatting and maintenance, storage of Personal data and Contact data) are carried out on behalf of Evok by the company known as Sarbacane Software SAS, registered at the Commercial and Companies Registry of Lille no. 509 569 598, whose registered office is located at 3 avenue Antoine Pinay – Industrial Estate (ZA) “des Quatre Vents” – 59510 HEM, acting in a processor capacity. See Sarbacane’s Personal Data Processing Charter.
The Data collected or received by Brach and Brach FC are not transmitted by Brach nor by Brach FC, nor by Evok, to any other recipient apart from, as applicable, the legally empowered authorities, within the framework of a specific assignment or of the exercise of a right of communication.
7°) Data retention period:
The Data will be kept in a form which permits identification of Data Subjects for no longer than is necessary for the purposes for which they are processed.
Where Processing is based on the Data Subject’s consent, the Data processed will only be kept by Brach or Brach FC for as long as the consent prevails.
Any new disclosure of Data, even where such have already been disclosed beforehand by the Data Subject, according to one or the other of the means of collection mentioned under section II “Data processed” will trigger a new retention period, irrespectively of the previous retention periods.
Personal-related data, Professional-related data, Specific data, Location data and Payment data are kept for the period necessary to the performance of the contractual and pre-contractual services requested by Data Subjects and for which such Data are disclosed.
Personal-related data and Professional-related data, can be kept for an additional period of one year from the end of the Data Subject’s stay or experience within the Establishment.
Specific data are only kept for the period strictly necessary to the performance of the contractual or pre-contractual services requested by Data Subjects and for which such Data are disclosed, or to Brach and Brach FC’s adherence to legal requirements (in particular storage and archiving of nominal invoices, book keeping and other accounting or tax requirements).
Payment data are kept for the period strictly necessary to each payment in view of which they are disclosed and to Brach and Brach FC’s adherence to legal requirements (in particular storage and archiving of invoices, book keeping and other accounting or tax requirements).
1°) Definition :
A Cookie is a tracking tool which consists of a small computer file or a short alphanumeric combination, which is automatically installed or read by a network provider or a website on the terminal device (computer, mobile phone, tablet, video games console) of the Data Subject, that can access the data already stored in said terminal, or write or store information on that device.
2°) Purposes to the use or enabling of Cookies and information transmitted by Cookies:
Website operation requires the implementation of the following Cookies, which are presented according to the functionalities provided by each type of Cookie :
– Implementation and facilitation of electronic communication and supply of online communication services, exclusively: Functional cookies;
– Improvement of Website browsing experience; organisation of visualized content (including Google Maps interactive maps and YouTube videos), saving of personal data already entered by the Data Subject, tracking of user preferences and options, for instance for the efficiency of a booking, saving services already requested: Efficiency cookies;
– Measuring web traffic: Web traffic cookies;
– Monitoring browsing habits (Websites and pages visited, search history and search terms used) and preferences of Data Subjects in view of customized ads: Advertising cookies; Advertising cookies are also installed by Google via YouTube videos and Google Maps interactive maps accessible on the Website: the data collected (login, location and browsing data) are not processed by Brach but by Google ;
– Promotion of the Website and improvement of its user-friendliness, via social media sharing functionalities (Facebook, Twitter, Instagram, Google+, Pinterest, Linkedin), by means of the share button enabling web browsing to be tracked by the websites of these social media, whether or not these buttons or links are hit by the Website user: Social media cookies. The Data collected by these Cookies are not processed by Brach, but by the aforementioned social media operators.
3°) Consent of Data Subjects:
The use of Efficiency cookies, Advertising cookies, Web traffic cookies and Social media cookies, that is to say all Cookies apart from functional Cookies, implies the consent of the Data Subject.
In accordance with article 32 II of the act of 6 January 1978, the consent of the Data Subject can result from his or her connection settings. Website users are prompted to check or alter their settings before pursuing their browsing experience on the Website. By continuing to browse the Website, that is to say by visiting another page of the Website from the Website or by clicking on any item of the Website (image, link, thumbnail etc.), the Data Subject expresses his or her consent to the use of the above mentioned Cookies.
4°) Cookies’ validity period:
5°) Blocking or Managing Cookies:
Click on the browser menu (Safari, Mozilla etc.), then choose “Preferences” or “Settings” or “Tools”; then proceed as follows depending on your web browser:
Safari: “Privacy” > “Cookies and website data”: choose the desired options; to block cookies entirely, select: “Always block” and check the box “Website tracking: Ask websites not to track me” if not already checked;
> also, to manage Data and Cookies already stored on the terminal: “Manage website data”: make the desired data deletions by selecting the Data and Cookies sources and categories in the panel then by clicking the “delete” button;
Mozilla Firefox: “Privacy and Security” > “Cookies and site data”: make the desired settings, after consulting the “Learn more” section;
– to block all Cookies : click the button “Block Cookies and site data (may cause websites to break)” ;
– to manage Cookies: click on the button “Enable Cookies (recommended)” and select among the proposed options (i) keep Cookies: to limit to the maximum extent possible, select “until I close Firefox”, (ii) accept third-party Cookies: to limit to the maximum extent possible, select “Never” ;
– also, with the use of the three buttons “Clear Data”, “Manage Data” or “Manage Permissions”, the user can delete all (“Clear”) or part (“Manage”) of the Data and Cookies already stored on the terminal or authorise certain Websites only to use these Cookies (“Manage Permissions”) ;
Internet Explorer: “Internet Options” > Thumbnail “Privacy” > “Advanced” button to prompt the window “Advanced Privacy Settings” > check the box “Override automatic cookie handling”, then select the desired option: accept, block or be prompted to determine the desired configuration for first-party and third-party Cookies.
Chrome: “Show advanced settings” (at the bottom), then in the Privacy Section click on “Content settings” then “Cookies” section, then:
– to delete all or specific Cookies : “All cookies and site data” > “Remove all”; or mouse over the name of the website and Delete
– to change the default settings relating to Cookies: turn “Allow sites to safe and read cookie data” on or off; turn on “Block third-party cookies” to block third-party Cookies;
to block Cookies for a specific site only: next to “Block”, “Clear on exit” or “Allow” click “Add”, then enter the Website address and click “Add”.
Other specific solutions:
Besides the general settings of your browser, there are solutions to control, manage or personalise, depending on their purpose or the entity using the Cookies.
Advertising cookies. These Cookies are implemented by Brach via Adwords provided by Google (Google services). To disable these: https://policies.google.com/technologies/product-privacy?hl=fr, then “Control your ads settings” and select the desired options.
Advertising Cookies used by Google can be disabled on: https://policies.google.com/technologies/cookies?hl=fr&gl=fr, and by clicking on “ad settings”, or further still on: https://policies.google.com/privacy?hl=fr&gl=fr then “Your privacy controls”.
As a general rule, most advertising Cookies can also be controlled via an online choice platform: www.youronlinechoices.eu, http://optout.aboutads.info/?c=2&lang=EN (USA) or https://youradchoices.ca/.
Google Maps and You Tube Cookies: go to: https://policies.google.com/technologies/product-privacy, then select the desired options in each menu. The Google Maps terms of service are also available by clicking on the link on the interactive map.
Web traffic cookies. These Cookies are implemented using the Google Analytics tool provided by Google. Users can disable these by installing the opt-out browser add-on at: https:// support.google.com/analytics/answer/181881 ?hl=fr.
Social media cookies, implemented via the share buttons accessible on the Website. Social media networks generally provide for the possibility to block, manage or personalise Social media cookies via an add-on available to all, network members and non-members alike, as well as via the settings of the member’s account. To manage the Cookies, go to: Facebook and Instagram (and other Facebook products) : https://www.facebook.com/policies/cookies/ ;
Pinterest : https://policy.pinterest.com/fr/cookies ;
Cookies personalisation page. Users can also visit the page of the Website devoted to the Personalisation of Cookies.
6°) Consequences of a refusal or objection:
Objections to Functional cookies, in particular if the user objects to all Cookies, will make operation of the communication service impossible. The user will not be able to browse the Website.
Objection to Efficiency cookies will not bar access to the Website and its functionalities, but may lead to a less efficient and less seamless browsing experience and to the reduced performance of the Website’s functionalities and services, including booking services.
V. RIGHTS OF THE DATA SUBJECT
1°) Right of access:
The Data Subject, providing proof of identity, shall have the right to question the Controller in view of obtaining:
- confirmation of whether or not the personal Data concerning him or her have been subject to Processing;
- information relating to the purposes of the Processing, to the categories of personal Data processed and to recipients or categories of recipients to which the Data are disclosed;
- where applicable, information relating to contemplated transfers of personal Data to countries outside the European community;
- disclosure, in accessible form, of the personal Data which concern him or her as well as any and all information available as regards the origin thereof;
- information enabling him or her to know and challenge the logic involved in any automatic personal data processing in the event of a decision made on the grounds of the latter and producing legal effects with regard to the interested party.
At the request of the Data Subject, a copy of the personal Data which concerns him or her will be sent to him or her by the Controller. For any further copies, the costs associated with the reproduction and delivery thereof will be for the account of the Data Subject.
The Controller will not respond to manifestly unreasonable requests, in particular due to their number, or because of their repetitive or systematic character.
2°) Right to rectification:
The Data Subject, providing proof of identity, shall have the right to obtain, without undue delay, the rectification of inaccurate personal Data concerning him or her. Taking into account the purposes of the Processing, the Data Subject shall have the right to have incomplete personal Data completed, including by means of providing a supplementary statement.
3°) Right to erasure:
The Data Subject, providing proof of identity, shall have the right to obtain from the Controller the erasure, without undue delay, of personal Data concerning him or her, where one of the following grounds applies:
- the Data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
- the data subject has withdrawn consent and where is no other legal ground for the processing of the Data;
- the data subject exercises his or her right to object to processing;
- the Data have been collected from the Data Subject when he or she was a child.
4°) Right to restriction of Processing:
The Data Subject, providing proof of identity, shall have the right to obtain restriction of Processing where one of the following cases applies:
- the accuracy of the Data retained is contested by the Data Subject, for a period enabling the Controller to verify the accuracy of the Data;
- the Processing is unlawful and the Data Subject opposes the erasure thereof and requests the restriction of their Processing instead;
- the Controller no longer needs the Data but they are required by the Data Subject for the exercise of his or her legal claims;
- the Data Subject has exercised his or her right to object pursuant to 6°) pending the verification whether the legitimate grounds of the Controller override those of the Data Subject.
Where Processing has been restricted under this paragraph, such Data shall, with the exception of storage, only be processed with the Data Subject’s consent, or for the exercise of legal claims, for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
A data subject who has obtained a restriction of Processing pursuant to this paragraph will be informed before the restriction is lifted.
5°) Data portability:
Where the Processing is based on the consent of the Data Subject or on performance of the contract or on the pre-contractual measures requested by the Data Subject and that the Processing is carried out by automated means, the Data Subject shall have the right, without prejudice to the right contemplated in 3°) and to the rights and freedoms of third parties, to receive the Data concerning him or her, which he or she provided to the Controller in a structured, commonly used and machine-readable format and to transmit those Data to another Controller, or to have the Data transmitted directly to another Controller, where this is technically feasible.
6°) Right to object:
The Data Subject may object at any time, on legitimate grounds, to the Processing of his or her Data that should be based exclusively on the legitimate interests pursued by the Controller or by a third party authorised by the Controller.
The Data Subject shall have the right to object, at no expense, and at any time, to the Data concerning him or her, being used for direct marketing purposes, in particular commercial marketing, including for the purpose of profiling where such is related to such direct marketing, by the current Controller for such processing or the controller for any subsequent processing.
The exercise of this right shall not adversely affect the lawfulness of the Processing carried out prior to the exercise of the right to object.
7°) Withdrawal of consent:
Where Processing is based on consent of the data subject, the latter shall have the right to withdraw his or her consent at any time.
The exercise of this right shall not adversely affect the lawfulness of Processing based on consent before its withdrawal.
8°) Automated individual decisions, including profiling:
Unless he or she has granted express consent or that the conclusion or performance of the contract so requires, the Data Subject shall have the right not to be subject to a decision based solely on automated Processing, including profiling, which produces legal effects or similarly significantly affects him or her.
9°) Instructions relating to the Processing of Data after death:
Any data subject may issue instructions relating to the storage, erasure and disclosure of his or her personal Data after his or her death. These instructions may be either general or specific. Instructions of a general nature concern all personal Data relating to the Data Subject and can be recorded with a digital trusted third party certified by the Commission nationale de l’informatique et des libertés. Instructions of a specific nature concern the Processing of personal data mentioned by these instructions. They are recorded with the relevant Controllers. General and specific instructions define the manner according to which the data subject intends for the rights mentioned in this section to be exercised after his or her death.
The Data Subject can alter or revoke his or her instructions at any time.
These instructions may appoint any person as an executor. That person will then be entitled, when the Data Subject dies, to examine the instructions and to request the relevant Controller to implement these. Failing such appointment, or, save instruction to the contrary, in the event of death of the appointee, his or her heirs are entitled to examine the instructions upon the death of their predecessor in title and to request the relevant Controller to implement these.
10°) Exercise of rights with respect to the Controller
The Data Subjects shall exercise the rights contemplated in this section by sending their requests or instructions by post or e-mail to:
Evok Hôtels Collection SNC
Personal Data Protection
17, avenue de l’Opéra – 75001 Paris
Requests must include due documentary evidence of the identity of the person responsible for the request. In the event of reasonable doubt, the Controller may ask for additional information necessary to confirm such identity.
That person must indicate in his or her request, the rights that he or she intends to exercise, as well as the Data and the Processing (purposes, basis) to which such exercise pertains and where applicable, the instructions, that he or she intends to send the Controller.
Incomplete requests will not be processed. In any event, the Controller reserves the right to claim any additional information necessary to the implementation of the rights invoked.
11°) Complaints with the supervisory authority:
Without prejudice to any other effective judicial or administrative remedy, any Data Subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State in which he or she has his or her habitual residence, his or her place of work or in the location where the violation was allegedly committed, if he or she considers that the personal Data Processing concerning him or her is an infringement of the regulatory framework relating to the protection of personal data.
In France, the supervisory authority is the Commission Nationale de l’Informatique et des Libertés (CNIL) located at 3, place de Fontenoy- TSA 80715 – 75334 Paris Cedex 07.
VII. PERSONAL DATA PROTECTION OFFICER
Mr Anthony Hamet is appointed as the Personal Data Protection Officer (PDPO) for the entire Evok Group, including Brach and Brach FC.
Data subjects can contact the PDPO regarding any issues relating to the processing of their personal data and to the exercise of the rights they are conferred by the General Data Protection Regulation.
To contact the PDPO:
– by post
Evok Hôtels Collection SNC
Personal Data Protection
For the attention of the Personal Data Protection Officer
17, avenue de l’Opéra – 75001 Paris
– by e-mail: firstname.lastname@example.org