Last updated: July 9, 2026

1. Introduction

GRAPE HOSPITALITY FRANCE — (hereinafter “we,” “our,” or “the Company”) places great importance on the protection of your personal data.

The purpose of this privacy policy is to provide you with transparent information about how we collect, use, store, and protect your personal data when you:

• book a trip (online, by phone, through a travel agency, or through a third party);
• stay at one of our properties;
• use our additional services (restaurant, spa, seminar rooms, concierge services, etc.);
• sign up for our loyalty program or our newsletter;
• Visit our website or our mobile app;
• Contact us (customer service, complaints, requests for information).

This policy complies with the General Data Protection Regulation (GDPR – EU 2016/679) and the amended French Data Protection Act.

2. Data Controller

The data controller is:

Grape Hospitality France, whose registered office is located at 17 quai du président Paul Doumer, 92400 Courbevoie, and which is registered under number 815 278 288 in the Nanterre Trade and Companies Register.

The Data Protection Officer (DPO): dpo@grape-hospitality.com

3. Data We Collect

Depending on your interaction with us, we may collect the following categories of data:

3.1 Identification and Contact Information

Last name, first name, title, date of birth, mailing address, email address, phone number.

3.2 Information Related to the Reservation and Stay

Dates of stay, room type, preferences (floor, bedding, reported food allergies), booking history, loyalty card number, license plate number (if parking), check-in/check-out information.

3.3 Payment Information

Credit card number (processed securely, typically through a PCI-DSS-certified payment service provider), billing history. We do not store full credit card details on our own servers.

3.4 Identification Information

A copy of an ID card or passport, as required by the regulations governing passenger registration (police records, hotel registries) in certain countries.

3.5 Video Surveillance Data

Images captured by the video surveillance systems installed in the common areas of our facilities (lobbies, parking lots, hallways) for security purposes.

3.6 Browsing Data

IP address, browser type, pages viewed, cookies, and similar trackers (see Section 8).

3.7 Data Related to the Loyalty Program and Marketing

Communication preferences, newsletter open history, and stated interests.

4. Purposes and Legal Bases for Processing

• Reservation and Stay Management: Contract Performance
• Billing and Accounting: Legal Requirement
• Mandatory Registration of Travelers: Legal Requirement
• Safety of Property and Persons (Video Surveillance): Legitimate Interest
• Loyalty Program: Contract Performance / Consent
• Sending newsletters and promotional offers, marketing outreach, and optimizing our advertising campaigns: Consent (or legitimate interest for existing customers, with the right to object)
• Improving our services and statistics: Legitimate interest
• Claims and Customer Service Management: Contract Performance / Legitimate Interest
• Fraud Prevention: Legitimate Interest / Legal Obligation

5. Recipients of the Data

Your data may be disclosed, strictly to the extent necessary, to the following categories of recipients:

• authorized staff at our facilities (reception, sales department, management);
• our technical service providers (website hosting, hotel management software (PMS), payment solution);
• online travel agencies (OTAs) when you book through these channels;
• administrative or judicial authorities, upon legal request (passenger manifests, tax obligations);
• our business partners, service providers, and third-party platforms —only with your prior consent, where applicable

We never sell your personal data to third parties.

6. Transfers Outside the European Union

While some of our service providers (cloud hosting, marketing tools, booking platforms) are located outside the European Union, we ensure that these transfers are governed by appropriate safeguards: the European Commission’s standard contractual clauses, an adequacy decision, or another mechanism recognized by the GDPR.

7. Shelf Life

• Reservation and stay data: Duration of the business relationship + 3 years (marketing), legal retention period of up to 10 years (accounting)
• Identity records / guest registers: As required by local law (generally 1 to 5 years)
• Payment data: Not retained after the transaction, except as required for accounting purposes
• CCTV footage: 30 days maximum, unless there is an ongoing investigation
• Marketing data (newsletter): 3 years from the last contact, or until consent is withdrawn
• Loyalty Program: Membership Term + 3 Years

8. Cookies and Trackers

Our website and app use cookies to:

• to ensure the proper functioning of the website (technical, essential cookies);
• to measure our audience and improve our services (analytics cookies);
• to provide you with personalized content and offers (advertising cookies, subject to consent).

You can manage your preferences at any time through the cookie banner displayed during your first visit, or through your browser settings.

9. Your Rights

In accordance with the GDPR, you have the following rights regarding your personal data:

• Right of access: to obtain a copy of the data we hold about you;
• Right to rectification: to correct inaccurate or incomplete data;
• Right to erasure: Request the deletion of your data, subject to our legal obligations;
• Right to restriction of processing;
• Right to object, in particular to processing for direct marketing purposes;
• Right to data portability;
• The right to withdraw your consent at any time, when the processing is based on your consent;
• The right to establish guidelines regarding the handling of your data after your death (under French law);
• The right to file a complaint with the competent supervisory authority (in France, the CNIL—www.cnil.fr).

To exercise these rights, you may contact the Data Protection Officer (DPO) at the following address: dpo@grape-hospitality.com

10. Data Security

We implement appropriate technical and organizational measures to protect your data from unauthorized access, loss, alteration, or disclosure: encryption of sensitive data, restricted and secure access to systems, staff training, and regular security audits.

11. Minors

Our services are intended for adults. We do not knowingly collect data regarding unaccompanied minors, except as part of a normal family vacation and with the consent of the parent or legal guardian.

12. Changes to the Privacy Policy

We may need to modify this policy to reflect changes in laws, regulations, or our practices. You will be notified of any substantial changes through an appropriate means (email, notification on the website). The date of the last update appears at the top of this document.

‍