Last updated: September 7, 2026

1. Introduction

GRAPE HOSPITALITY FRANCE (hereinafter "we," "our," or "the Company") places great importance on the protection of your personal data.

This privacy policy is intended to provide you with full transparency regarding how we collect, use, store, and protect your personal data when you:

• book a stay (online, by phone, through an agency, or through a third party);
• stay at one of our properties;
• use our additional services (restaurant, spa, meeting rooms, concierge, etc.);
• Sign up for our loyalty program or newsletter;
• visit our website or mobile app;
• Contact us (customer service, complaints, requests for information).

This policy complies with the General Data Protection Regulation (GDPR – EU 2016/679) and the amended French Data Protection Act.

2. Data controller

The data controller is:

Grape Hospitality France, with its registered office at 17 quai du président Paul Doumer, 92400 Courbevoie, registered under number 815 278 288 with the Nanterre Trade and Companies Register (RCS).

The Data Protection Officer (DPO): dpo@grape-hospitality.com

3. Data We Collect

Depending on how you interact with us, we may collect the following categories of data:

3.1 Identification and Contact Information

Last name, first name, title, date of birth, mailing address, email address, phone number.

3.2 Booking and Stay-Related Data

Stay dates, room type, preferences (floor, bedding, reported food allergies), booking history, loyalty card number, license plate number (if parking), check-in/check-out information.

3.3 Payment Information

Credit card number (processed securely, typically through a PCI-DSS-certified payment provider), billing history. We do not store full credit card details on our own servers.

3.4 Identity Data

A copy of an ID card or passport, as required by regulations governing traveler registration (police forms, hotel registers) in certain countries.

3.5 Video Surveillance Data

Images captured by video surveillance systems installed in the common areas of our facilities (lobbies, parking lots, hallways) for security purposes.

3.6 Browsing data

IP address, browser type, pages visited, cookies, and similar trackers (see Section 8).

3.7 Loyalty Program and Marketing Data

Communication preferences, newsletter open history, declared interests.

4. Purposes and Legal Bases for Processing

• Reservation and Stay Management: Contract Performance
• Invoicing and Accounting: Legal Obligation
• Mandatory guest registration: Legal obligation
• Security of property and individuals (video surveillance): Legitimate interest
• Loyalty Program: Contract Performance / Consent
• Sending newsletters and promotional offers, conducting sales outreach, and optimizing our advertising campaigns: Consent (or legitimate interest for existing customers, with the right to object)
• Service Improvement and Statistics: Legitimate Interest
• Complaint Management and Customer Service: Contract Performance / Legitimate Interest
• Fraud prevention: Legitimate interest / Legal obligation

5. Data Recipients

Your data may be shared, strictly on a need-to-know basis, with the following categories of recipients:

• authorized personnel at our facilities (front desk, sales department, management);
• our technical service providers (website hosting, property management software (PMS), payment solutions);
• online travel agencies (OTAs) when you book through these channels;
• administrative or judicial authorities, upon legal request (guest register, tax obligations);
• , to our business partners, service providers, and third-party platforms only with your prior consent, where applicable

We never sell your personal data to third parties.

6. Transfers outside the European Union

If any of our service providers (cloud hosting, marketing tools, booking platforms) are located outside the European Union, we ensure that these transfers are governed by appropriate safeguards: European Commission standard contractual clauses, adequacy decisions, or other mechanisms recognized by the GDPR.

7. Retention Period

• Booking and stay data: Duration of the business relationship + 3 years (for marketing purposes), legal retention period of up to 10 years (for accounting purposes)
• Identity forms / guest register: In accordance with local legal requirements (typically 1 to 5 years)
• Payment data: Not retained after the transaction, except as required for accounting purposes
• Video surveillance footage: 30 days maximum, unless legal proceedings are ongoing
• Marketing data (newsletter): 3 years from the last contact, or until consent is withdrawn
• Loyalty program: Membership duration + 3 years

8. Cookies and Trackers

Our website and app use cookies to:

• ensure that the site functions properly (technical, essential cookies);
• measure traffic and improve our services (analytical cookies);
• to provide you with personalized content and offers (advertising cookies, subject to consent).

You can manage your preferences at any time via the cookie banner that appears during your first visit, or through your browser settings.

9. Your rights

In accordance with the GDPR, you have the following rights regarding your personal data:

• Right of access: obtain a copy of the data we hold about you;
• Right to rectification: correct inaccurate or incomplete data;
• Right to erasure: Request the deletion of your data, subject to our legal obligations;
• Right to restriction of processing;
• Right to object, particularly with regard to processing for direct marketing purposes;
• Right to data portability;
• The right to withdraw your consent at any time, when processing is based on that consent;
• The right to provide instructions regarding the handling of your data after your death (French law);
• The right to file a complaint with the relevant supervisory authority (in France, the CNIL—www.cnil.fr).

To exercise these rights, you may contact our Data Protection Officer (DPO) at the following address: dpo@grape-hospitality.com

10. Data Security

We implement appropriate technical and organizational measures to protect your data against unauthorized access, loss, alteration, or disclosure, including: encryption of sensitive data, restricted and secure access to systems, staff training, and regular security audits.

11. Minors

Our services are intended for adults. We do not knowingly collect data from minors without parental supervision, except in the normal course of a family stay and with the authorization of the person exercising parental authority.

12. Privacy Policy Updates

We may update this policy to reflect changes in legal or regulatory requirements or in our own practices. Any significant changes will be communicated to you through an appropriate channel (email or website notification). The date of the last update is indicated at the top of this document.

‍