BARMA HOSPITALITY undertakes to ensure that the collection and processing of your data are carried out lawfully, fairly and transparently, in accordance with the General Data Protection Regulation (GDPR) and French Act No. 78-17 of 6 January 1978 on information technology, data files and civil liberties.
The collection of its customers’ personal data is limited to what is strictly necessary, in accordance with the principle of data minimisation, and specifies the purposes for which this data is collected, whether providing this data is optional or mandatory in order to handle requests, and who may have access to it.
BARMA HOSPITALITY is a French simplified joint-stock company (SAS) with its registered office at 14 rue de Plélo, 35000 Rennes, registered in Rennes under SIRET number 941 982 787 00017.
The Company offers the following services:
“Site” means the Company’s website, namely www.barmahotelcourchevel.com
“Cookies”: A cookie is a piece of information placed on a user’s hard drive by the server of the website they visit. It contains several data items: the name of the server that placed it, an identifier in the form of a unique number or text, and possibly an expiry date. This information is sometimes stored on the computer in a simple text file that a server accesses to read and record information.
“Personal data” means any information relating to an identified natural person, or one who can be identified, directly or indirectly, by reference to an identification number or to one or more factors specific to them. An example would be the User’s email address.
“Customer” means any natural or legal person who makes a booking on the Site, through our partner providers, or directly with the Hotel whose address is given in section 1;
“Booking” means any booking made by the User, Customer, Professional or Consumer in order to use the Company’s Services;
“General Terms and Conditions of Sale and Use” or “GTCS/GTCU” mean the Company’s general terms and conditions of sale and use;
“Consumer” means the individual purchaser who is not acting for professional purposes and/or outside the scope of their professional activity;
“Professional” means the corporate or individual purchaser acting within the scope of their professional activity;
“Services” means all services and/or products offered to Users, Customers and Professionals by the Company through the Sites owned by the Company;
“Company” means BARMA HOSPITALITY, described more fully in section 1 hereof;
“User” means any person who uses the Site.
“Account” means the customer’s personal area with the Company’s partner providers.
“Quote” means a quote produced by the Company for a specific, bespoke service requested by the Customer.
“GDPR” means the General Data Protection Regulation applicable from 25 May 2018.
“Processing of personal data” means any operation or set of operations performed on such data, whatever the method used (collection, recording, organisation, storage, adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of making available, alignment or interconnection, blocking, erasure or destruction, etc.)
In accordance with the French Data Protection Act of 6 January 1978 and General Data Protection Regulation 2016/679 (GDPR), the information concerning you is intended for the Company, acting as data controller. You have the right to access, rectify and erase the data concerning you (details in section 5). You may exercise this right by sending an email to [email protected]
By connecting to the Company’s website www.barmahotelcourchevel.com, you access content protected by law, in particular by the provisions of the French Intellectual Property Code. The Company authorises only strictly personal use of the information or content you access, limited to saving it on your computer for display on a single screen, as well as reproduction, where permitted (link or download button), for copying or printing on paper. Any other use is subject to our express prior authorisation. By continuing your visit, you agree to comply with the restrictions above.
The Company requires its Customers, Users, Consumers and Professionals to comply with the laws in force and with the ethical rules of conduct necessary to establish a relationship of trust between the Company and its Customers, Users, Consumers and Professionals.
The Company requires its Users to comply with a set of obligations through its GTCS/GTCU.
Any failure to meet these obligations may result in the cancellation, without notice, of a booking made on the Company’s website or directly with the Hotel.
PLEASE NOTE THAT THE COMPANY DOES NOT EXCHANGE OR RENT OUT ANY OF ITS CUSTOMER OR PROSPECT FILES.
The Company’s website is not intended for minors. We do not knowingly collect or process personal data relating to minors. Should we become aware that personal data relating to minors has been collected without the prior authorisation of the holder of parental authority, we would take appropriate measures to delete this personal data from our servers.
The controller of the personal data referred to herein is Renaud BIARD, Managing Director of the Hotel, whose company details are set out in section 1 of this page.
User information and rights
The Company hereby clearly informs you about the personal data processing it carries out as part of its activity, and how data is collected, used and protected.
Every User, Customer, Consumer and Professional has the right to ask the data controller, i.e. Renaud BIARD:
Subprocessing
The Company undertakes to ensure that any subprocessor provides sufficient contractual guarantees regarding the implementation of appropriate technical and organisational measures, so that the processing meets the requirements of the European data protection regulation (see the list of data recipients in section 4).
Data collected on the site (contact form)
When a Customer, User, Consumer or Professional makes a booking request on the site via our contact form, the following data is collected and processed by the Company: email, first name, last name, phone, country, arrival date, departure date, number of adults, number of children, and any additional information the Customer, Professional, User or Consumer deems necessary for their booking request.
Data collected on the site (via our provider D-EDGE)
When a Customer, User, Consumer or Professional makes a booking request on the site, the following data is collected and processed by our subprocessor D-EDGE: email, first name, last name, country, phone number, IP address, room type, booking rate, stay dates, bank card number (16 digits + expiry date) and any additional information the customer, consumer, professional or user may provide if they consider it relevant and useful for their booking.
The data is then sent to us by email, with the exception of the bank card number (16 digits + expiry date), which remains in secure storage on D-EDGE’s server. This data is only visible with a password and login via the intranet between the Company and D-EDGE.
Data Collected at the Company’s Premises
On a customer’s arrival, the following data is collected and processed: arrival and departure dates at the premises, room number, number of breakfasts (if any), order history, complaints, incidents, and information relating to correspondence on our site or directly with the Company (email message sent directly).
Some data is collected automatically as a result of the user’s actions on the site (see the section on cookies in section 5.1).
The data submitted must not include sensitive personal data such as government identifiers (e.g. social security numbers, driving licence numbers or taxpayer identification numbers), full credit card numbers (unless specifically requested, in particular when making a booking on the site by completing the relevant field of the booking form) or personal bank account numbers, medical records, or information relating to care requests associated with individuals, this list being non-exhaustive.
Regarding the collection of identity data
Prior identification for the provision of the desired service
Making a room available requires the customer to be identified beforehand using their identity card or any other document allowing them to be identified. The personal details (last name, first name, postal address) shown on the identity document are used to fulfil our legal obligations arising from the provision of the service as set out in the booking. The customer, consumer or professional must not provide false personal details and must not make a booking for another person without their authorisation. The contact details provided must always be accurate and up to date.
Collection of device data
Collection of profiling data and technical data for the purpose of providing the service.
Some of your device’s technical data is collected automatically by the Site and the server. This information includes, in particular, your IP address, internet service provider, hardware configuration, software configuration, browser type and language, etc. The collection of this data is necessary for proper browsing on the Company’s website.
The Company also offers a personalised experience by using automated decision-making through its newsletter email messages.
Collection of technical data for commercial and statistical purposes
Your device’s technical data is automatically collected and recorded by the server and our subprocessors for advertising, commercial and statistical purposes. This information helps us to personalise and continuously improve your experience on our Site. We do not collect or retain any personal details (last name, first name, address, etc.) that may be attached to technical data.
Google Analytics
This Site uses Google Analytics, an audience measurement service provided by Google Ireland Limited, which analyses site traffic (pages viewed, visit duration, traffic source) in order to improve its content and the browsing experience.
Google Ads
This Site also uses Google Ads for online advertising purposes. This service displays personalised ads to Users, in particular based on the pages visited on the Site, by placing advertising cookies on the User’s device.
Meta (Facebook) Pixel
This Site uses the Meta (Facebook) pixel, an advertising measurement and targeting tool provided by Meta Platforms Ireland Limited. It tracks certain actions carried out by Users on the Site (for example, viewing a page or making a booking) in order to serve personalised ads on Meta platforms (Facebook, Instagram) and to build advertising audiences.
The main purpose of collecting your personal data is to offer you a safe, optimal, efficient and personalised experience at the establishment. To this end, you agree that we may use your personal data to:
The personal data concerning you collected on the site, at the premises and by partner providers is intended to be used by the Company and may be passed on to the subcontracting companies the Company may call upon in the course of providing its services. The Company ensures compliance with data protection requirements for all of its subcontracting companies. The Company does not sell or rent your personal data to third parties for marketing purposes. As a matter of ethics reflecting our values, we do not enter into strategic partnerships aimed at sharing your data to promote a third-party company’s service or product.
The Company does not disclose your personal data to third parties, except where:
The data recipients are currently:
In accordance with the French Data Protection Act and General Data Protection Regulation 2016/679 (GDPR), you have the right to access, rectify and erase the personal data concerning you, which you may exercise by sending an email to [email protected]
Your request will be processed within 30 days. We may ask you to accompany your request with a photocopy of proof of identity or authority.
You may also, at any time, change the personal data concerning you yourself in relation to our newsletter, by clicking on the link at the bottom of each of our newsletter emails, either to unsubscribe or to update your details.
Cookie retention period
In accordance with the CNIL’s recommendations, the maximum retention period for cookies is 13 months from the time they are first placed on the User’s device, as is the period of validity of the User’s consent to the use of these cookies. The lifespan of cookies is not extended with each visit. The User’s consent must therefore be renewed at the end of this period.
Purpose of cookies
Cookies may be used for statistical purposes, in particular to optimise the services provided to the User, based on the processing of information concerning access frequency, page personalisation, as well as the operations carried out and the information consulted.
You are informed that the Company may place cookies on your device. The cookie records information relating to browsing on the site (the pages you have viewed and can view) that we can read on your subsequent visits.
The cookie will allow the Company, for the period of validity or storage of the cookie, to identify your computer during your next visits. The Company’s partners or providers, or third-party companies, may also, subject to your choices, place cookies on your computer.
There are two main categories of cookies:
So-called “Technical” cookies. These cookies are essential for browsing our site, in particular for the proper execution of the ordering process;
So-called “Optional” cookies. These cookies are not essential for browsing our site but may, for example, make it easier for you to search, optimise your user experience, and, for us, better anticipate your expectations, improve our offering, or optimise the operation of our site.
The optional cookies placed on this Site include, in particular, audience measurement cookies (Google Analytics) as well as advertising cookies (Google Ads, Meta/Facebook pixel), used to analyse Site traffic and offer you relevant ads on other sites or social networks.
The retention period for this information on your computer is one year. Only the issuer of a cookie is able to read or modify the information contained in that cookie.
No cookie allows us to identify your personal identity.
The User’s right to refuse cookies
Disabling cookies may result in degraded service functionality.
You acknowledge that you have been informed that the Company may use cookies, and you authorise it to do so.
If you do not want cookies to be used on your device, most browsers allow you to disable cookies through the settings options.
You can object to the storage of cookies by configuring your browser as follows:
For Chrome
For Mozilla Firefox:
For Microsoft Internet Explorer:
For Edge:
For Opera:
Please note: If you choose to refuse the storage of cookies on your computer, or if you delete those already stored, we accept no liability for the consequences relating to the degraded functioning of our services resulting from our inability to store or read the cookies necessary for their operation that you have refused or deleted.
General points
The Company collects and retains your personal data for the purposes of performing its contractual obligations, along with information on how and how often our services are used. Personal data must be retained only for as long as necessary to accomplish the purpose pursued when it was collected. The Company only stores your data for as long as necessary to provide the service and, on this basis, deletes your bank details once the service has been completed. The retention of the data of our customers, professionals, consumers and users varies according to the type of data concerned. For example, your statistical data that is more than 13 months old will be deleted. Other data may be deleted at any time, in accordance with the provisions set out above.
Retention period for personal and sensitive data
Retention of data during the contractual relationship and beyond.
In accordance with Article 6-5° of Act No. 78-17 of 6 January 1978 on information technology, data files and civil liberties, sensitive data (bank card) that is processed is not retained beyond the time necessary to perform the obligations defined at the conclusion of the contract or the predefined duration of the contractual relationship.
Personal data (last name, first name, email, postal address) that is processed is retained for a period of 3 years in our booking software.
Erasure of data after account deletion
Data purging measures are in place to ensure effective erasure once the retention or archiving period necessary to accomplish the specified or required purposes has been reached. In accordance with Act No. 78-17 of 6 January 1978 on information technology, data files and civil liberties, you also have a right to erasure of your data, which you may exercise at any time by contacting the Company.
Erasure of data after 3 years of inactivity
For security reasons, if you have not visited our establishment for more than 3 years, your personal data will be deleted.
Erasure of Data after 12 months in the Newsletter
If you have not been active within the newsletter, i.e. opened and/or clicked a link contained in an email, over a period of 1 month, you will receive an email inviting you to take an action (clicking a link) before permanent deletion from the relevant list.
The hosting servers on which the Company processes and stores your data on the site are located exclusively within the European Union.
The Company undertakes to inform you immediately, insofar as we are legally authorised to do so, in the event of a request from an administrative or judicial authority concerning your data.
As part of its services, the Company attaches the utmost importance to the security and integrity of the personal data of its customers, consumers, professionals and users. Accordingly, and in compliance with the GDPR, the Company undertakes to take all appropriate precautions to preserve the security of the data, in particular to protect it against any accidental or unlawful destruction, accidental loss, alteration, unauthorised disclosure or access, as well as against any other form of unlawful processing or communication to unauthorised persons.
To this end, the Company implements the digital industry’s standard security measures to protect personal data against unauthorised disclosure. By using the encoding methods recommended by the digital industry, the Company takes the necessary measures to protect payment-related information, it being understood that the Company does not offer on-site payment directly but goes through an external service secured by our subprocessor D-EDGE.
Furthermore, in order in particular to prevent any unauthorised access and to guarantee the accuracy and proper use of the data, the Company has put in place electronic and manual procedures to back up and preserve the data collected through its services.
Nevertheless, no one can consider themselves completely safe from a hacker attack. This is why, in the event that a security breach were to affect you, the Company undertakes to inform you as soon as possible and to make its best efforts to take all possible measures to neutralise the intrusion and minimise its impact.
In the event that you suffer harm as a result of a third party exploiting a security breach, the Company undertakes to provide you with all necessary assistance so that you can assert your rights.
It should be borne in mind that any user, customer or hacker who discovers and exploits a security breach is liable to criminal penalties, and that the Company will take all measures, including by filing a complaint and/or bringing legal action, to protect the data and rights of its users and its own, and to limit the impact as far as possible.
Informing the User in the event of a security breach
We undertake to implement all appropriate technical and organisational measures, through physical and logistical security means, in order to guarantee a level of security appropriate to the risks of accidental, unauthorised or unlawful access, disclosure, alteration, loss or destruction of the personal data concerning you. In the event that we become aware of unlawful access to the personal data concerning you stored on our servers or those of our providers, or of unauthorised access resulting in the materialisation of the risks identified above, we undertake to:
In no event may the commitments defined in the point above regarding notification in the event of a security breach be construed as any acknowledgement of fault or liability as to the occurrence of the incident in question.
Except in cases of force majeure, the Company guarantees the User, Consumer, Customer and Professional the proper performance of its service in compliance with these General Terms and Conditions.
Any compensation potentially owed by the Company to the User or a third party, on the grounds that the liability of the Company, its subsidiaries or its partners is engaged in respect of the performance hereof, may not exceed the price paid by the User, Customer, Professional or Consumer in return for the service(s) giving rise to the said liability (e.g. the price of a booked room or apartment).
The Company does not systematically monitor how its services are used, in particular the use of the equipment available in the room and communal areas, which remains the responsibility of the Customer, Consumer or Professional.
Under no circumstances may the Company be held liable to third parties for any harm resulting from the use of the services on behalf of the User, Customer, Consumer or Professional, in any capacity whatsoever.
User liability
The Customer, Consumer, Professional or User is solely responsible for the way in which they use the room, the communal areas and the equipment made available to them in connection with the performance hereof.
The liability of the User, Customer, Consumer or Professional may be engaged as a result of the failure to comply with these General Terms and Conditions of Sale and Use as well as the privacy policy, or any legal or regulatory provision or provision resulting from an applicable international convention.
The User, Customer, Consumer or Professional shall indemnify the Company against any harm, claim or recourse by third parties resulting from a breach, by the User, Customer, Consumer or Professional, of these General Terms and Conditions of Sale and Use as well as the Privacy Policy, of the Company, or of any legal or regulatory provision or provision resulting from an applicable international convention.
The Company undertakes to offer you the possibility of having all the data concerning you returned to you on simple request. The User is thus guaranteed better control over their data and retains the option to reuse it. This data must be provided in an open and easily reusable format, directly to another data controller where desired and technically possible.
Erasure of data on request
The User, Customer, Consumer or Professional has the option to delete their Data at any time, by simple request to the Company or directly via a link at the bottom of each of our newsletter emails.
Cancellation of a booking in the event of a breach of the Privacy Policy
In the event of a breach of one or more provisions hereof, or of any other document incorporated herein by reference, the Company reserves the right to cancel your booking with no possibility of a refund if a payment has already been made.
The Company undertakes to comply with the applicable regulations relating to data transfers, even though the Company currently does not transfer data to foreign countries for the vast majority of its processing. Where it is necessary in order to provide our services, this is done in the following ways:
Currently, the only processing operations concerned by this provision relate to:
The booking of services offered by the Company to a user who has decided to make a booking via the subprocessor D-EDGE from the Company’s website. Only the following data is transferred: CUSTOMER ID, email address, purchase amount, product name, email address, phone, postal address (if provided), the 16 digits of the bank card and its expiry date.
Audience measurement and online advertising carried out via Google Analytics and Google Ads, services provided by Google Ireland Limited, in the context of which certain technical data (cookie identifiers, IP address) may be processed by Google in accordance with the European Commission’s standard contractual clauses.
The management of an ethical, personalised business relationship through information delivered on Facebook via the “Custom Audience” feature offered by Facebook.
The email address is the only data transferred, in order to allow Facebook to identify its users and build an audience.
To find the list of countries with a sufficient legal level: CNIL – Data protection around the world.
The Company reserves the right to change this Privacy Policy at any time, in particular in application of changes made to the laws and regulations in force. Any changes made will be notified to you via our website and/or by email, where possible at least thirty (30) days before they come into effect. We recommend that you check these rules from time to time to stay informed of our procedures and rules regarding your personal information.
In the event of amendments hereto, the Company undertakes not to substantially lower the level of privacy protection without first informing the persons concerned.
This Privacy Policy is governed by French law. This reference document is written in French. Should it be translated into one or more languages, only the French text shall prevail in the event of a dispute. The invalidity of any clause does not entail the invalidity of the Privacy Policy. The temporary or permanent non-application by the Company of one or more clauses hereof shall not constitute a waiver on its part of the other clauses hereof, which continue to take effect.
Any dispute to which the privacy policy may give rise, in particular concerning its validity, interpretation and performance, their consequences and their follow-up, shall be submitted to the courts having jurisdiction within the district of the city of Rennes.
Any question concerning the Company’s Privacy Policy may be sent by email to [email protected] or by post to the following address:
BARMA HOSPITALITY, La Tania, 143 route de Praz-Juget, 73120 Courchevel, France.
Phone: +33 4 20 23 10 10
Email: [email protected]
