We consider you an important customer. Our first priority is to offer you exceptional stays and experiences throughout the world. Your complete satisfaction and confidence in Accor is absolutely essential to us.
That's why, as part of our commitment to meeting your expectations, we have set up (and we had a privacy policy before the much anticipated GDPR - General Data Protection Regulation ) a customer personal data protection charter. This charter formalizes our commitments to you and describes how the AccorGroup uses your personal data.
In this charter, “AccorGroup” means:
AccorHotels Deutschland GmbH, with registered offices at Hanns-Schwindt-Straße 2, 81829 München, Germany
Good to know!
You probably don't know this, but the hotel you are booked to stay in is probably not owned by Accor or one of its family of companies. Most Accorbranded hotels are operated under a franchise or management agreement between the hotel’s owner and Accor (or one of its subsidiaries across the world). This is why, when staying in one of these hotels, your personal data will be dealt with by Accor and the hotel, both acting as Data Controllers for their own, separate, purposes. Each hotel will process your data to manage its contractual relationship with you (invoicing, payment, booking management etc.), to perform marketing activities and to comply with its legal obligations. Accor has communicated the principles set out in this charter to all of the Accorbranded hotels and their respective owners. We will do our upmost to ensure that all hotels comply with the applicable data protection laws and this charter in relation to the processing of your personal data.
In accordance with applicable regulations, in particular the European General Data Protection Regulation, we have instituted the following ten principles throughout the AccorGroup:
1. Lawfulness: We use personal data only if:
- we obtain the consent of the person, OR
- it is necessary to do so for the performance of a contract to which the person is a party, OR
- it is necessary for compliance with a legal obligation, OR
- it is necessary in order to protect the vital interests of the person, OR
- we have a legitimate interest in using personal data and our usage does not adversely affect the persons’ rights
2. Fairness: We can explain why we need the personal data we collect.
3. Purpose limitation and data minimisation: We only use personal data that we really need. If the result can be achieved with less personal data, then we make sure we use the minimum data required.
4. Transparency: We inform people about the way we use their personal data
5. We facilitate the exercise of the people’s rights: access to their personal data, rectification and erasure of their personal data and the right to object to the use of their personal data
6. Storage limitation: We retain personal data for a limited period
7. We ensure the security of personal data, i.e. its integrity and confidentiality.
8. If a third party uses personal data, we make sure it has the capacity to protect that personal data.
9. If personal data is transferred outside Europe, we ensure this transfer is covered by specific legal tools.
10. If personal data is compromised (lost, stolen, damaged, unavailable…), we notify such breaches to the respective country’s responsible authority and to the person concerned, if the breach is likely to cause a high-risk in respect of the rights and freedoms of this person.
For any questions concerning the ten principles of Accordata protection policies, please contact the Data Privacy department whose details appear in the clause "Your rights".
- Technical and location data you generate as a result of using our websites and applications.
Personal data may be collected on a variety of occasions, including:
1. Participation in marketing programs or events:
- Signing up for loyalty programs
- Participation in customer surveys (for example, the Guest Satisfaction Survey)
- Online games or competitions
- Subscription to newsletters, in order to receive offers and promotions via email.
2. Internet activities:
- Connection to Accorwebsites (IP address, cookies in accordance with our Policy about the use of tracers)
- Online forms (online reservation, questionnaires, Accorpages on social networks, social networks login devices such as Facebook / Instagram login, conversations with chatbot, etc.).
| Purpose/Activity | Lawful basis for processing including basis of legitimate interest | Retention period |
|---|---|---|
| Meeting our obligations to our customers. | Performance of a contract with you. Necessary to comply with a legal obligation. Necessary for our legitimate interest in running our business and providing you with requested products and services. |
10 years from the booking in accordance with legal obligations. |
| Managing the reservation of rooms and accommodation requests, in particular the creation and storage of legal documents in compliance with accounting standards. | ||
Managing your stay at the hotel:
|
Performance of a contract with you. Necessary for our legitimate interest in running our business and providing you with requested products and services. |
For the duration of your stay. |
Managing our relationship with customers before, during and after your stay:
|
Performance of our contract with you and for the management of your membership in the loyalty program. Necessary for our legitimate interests in promoting our services, performing direct marketing activities (taking into account your commercial relationship with one of the AccorGroup’s entities) and improving our services. |
3 years from the last date on which you have interacted with us in any way, if you are not a member of the loyalty programme. 6 years from the last date on which you have interacted with us in any way, if you are a member of the loyalty programme. |
Improving our hotel service by:
|
Performance of contract with you in relation to the management of your membership in the loyalty program. Necessary for our legitimate interests in promoting our services, performing direct marketing activities (taking into account your commercial relationship with AccorGroup) and improving our services. |
3 years from the last date on which you have interacted with us in any way, if you are not a member of the loyalty program. 6 years from the last date on which you have interacted with us in any way, if you are a member of the loyalty program. |
| Use a trusted third party to cross-check, analyse and combine your collected data at the time of booking or at the time of your stay, in order to determine your interests and develop your customer profile and to allow us to send you personalized offers. | Necessary for our legitimate interests in promoting our services, performing direct marketing activities (taking into account your commercial relationship with one of the AccorGroup’s entities)) and improving our services. | 3 years from the last date on which you have interacted with us in any way, if you are not a member of the loyalty program. 6 years from the last date on which you have interacted with us in any way, if you are a member of the loyalty program. |
Improving Accor SA services, in particular:
|
Performance of contract with you (for the management of your membership in the loyalty program) Necessary for our legitimate interests in promoting our services, performing direct marketing activities (taking into account your commercial relationship with one of the AccorGroup’s entities)) and improving our services. |
3 years from the last date on which you have interacted with us in any way, if you are not a member of the loyalty program. 6 years from the last date on which you have interacted with us in any way, if you are a member of the loyalty program. 6 years from the date of closure of your file in case of a claim or a complaint. |
Securing and enhancing your use of Accor SA websites, applications and services by:
|
Necessary for our legitimate interests in running our business, provision of administration and IT services and network security to prevent fraud | 13 months from the collection of the information. |
| Internal management of lists of customers having behaved inappropriately during their stay at the hotel (aggressive and anti-social behaviour, non-compliance with safety regulations, theft, damage and vandalism or payment incidents). | Necessary for our legitimate interests in running our business and to prevent fraud and the abuse of our property and staff. | Up to 122 days from the recording of an event. |
| Securing payments by determining the associated level of fraud risk. As part of this analysis, Accor SA and hotels may use the AccorGroup risk prevention service provider to refine their analysis. Depending on the results of the investigations carried out, AccorGroup may take security measures, in particular AccorGroup may request the use of a different booking channel or for the use of an alternative payment method. These measures will have the effect of suspending the execution of the booking or, if the result of the analysis does not guarantee the safety of the order, of cancelling it. Fraudulent use of a means of payment leading to payment default may result in the entry of data in the AccorGroup incident file, which may lead AccorGroup to block future payments or carry out additional checks. |
Necessary for our legitimate interests in running our business and to prevent fraud. | 90 days to our database to allow for analysis and controls and then 2 years in a separated database used for improving the system. In case of recording in the incident file, 2 years from recording or until regularization of the situation if earlier. |
| Securing properties and persons and preventing non-payments. For these reasons, some hotels have a feature that allow them to include in the category of "ineffective" customers, any customer whose behaviour has been inappropriate in the following ways: aggression and rudeness, non-compliance with the hotel contract, failure to observe safety rules, theft, damage and vandalism, or payment issues. The status of “ineffective” may cause the hotel where this listing originated to refuse a customer's reservation when he/she returns to the same hotel. |
Necessary for our legitimate interests in running our business, securing properties and persons and preventing non-payments. | 122 days from registration. |
| Using services to search for persons staying in AccorGroup hotels in the event of serious events affecting the hotel in question (natural disasters, terrorist attacks, etc.). | Protection of the vital interests of the guests. | For the duration of the event. |
Conforming to any applicable legislation (for example, storing of accounting documents), including:
|
Necessary to comply with a legal obligation. | As stipulated in the respective country’s legislation. |
The AccorGroup operates in many countries and we endeavour to provide you with the same services throughout the world. Thus, we have to share your personal data with internal and share your data with a number of authorised people and departments in the AccorGroup in order to offer you the best experience in our hotels. The following teams may have access to your data:
- IT departments
- Commercial partners and marketing services
- Legal services if applicable
Generally, any appropriate person within AccorGroup entities for certain specific categories of personal data.
With service providers and partners: your personal data may be sent to a third party for the purposes of supplying you with services and improving your experience, for example:
External service providers: IT sub-contractors, international call centres, banks, credit card issuers, external lawyers, dispatchers, printers.
Commercial partners: Accor may, unless you specify otherwise to the Data Privacy department, enhance your profile by sharing certain personal information with its preferred commercial partners. In this case, a trusted third party may cross-check, analyse and combine your data. This data processing will allow Accor and its privileged contractual partners to determine your interests and customer profile to allow us to send you personalized offers.
Social networking sites: In order to allow you to be identified on the Accorwebsite without the need to fill out a registration form, Accor has put in place a social network login system. If you log in using the social network login system, you explicitly authorize Accor to access and store the public data on your social network account (e.g. Facebook, LinkedIn, Google, Instagram…), as well as other data stated during use of such social network login systems. Accor may also communicate your email address to social networks in order to identify whether you are already a user of the concerned social network and in order to post personalized, relevant adverts on your social network account if appropriate.
With local authorities: We may be obliged to send your information to local authorities if this is required by law or as part of an inquiry. We will ensure that any such transfer is carried out in accordance with local regulations.
For the purposes set out in clause 6 of this charter, we may transfer your personal data to internal or external recipients who may be in countries offering different levels of personal data protection.
Consequently, in addition to implementation of this charter, Accor employs appropriate measures to ensure secure transfer of your personal data to an Accor entity or to an external recipient located in a country offering a different level of privacy from that in the country where the personal data was collected.
Your data may be sent to Accorhotels and entities located within the European Union, in particularly, but not exclusively in the following countries: France, UK, Germany, Poland, Netherlands, Switzerland.
Accor SA takes appropriate technical and organizational measures, in accordance with applicable legal provisions (in particular: Art. 32 GDPR), to protect your personal data against illicit or accidental destruction, alteration or loss misuse and unauthorized access, modification or disclosure. To this end, we have taken technical measures (such as firewalls) and organizational measures (such as a user ID/password system, means of physical protection etc.) to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services. In relation to the submission of personal data, SSL (Secure Socket Layer) encryption technology is used to guarantee a secure transaction of data. Organizational measures ensure the security of the processing.
Accor uses cookies and other tracking technologies on its websites. To find out more about how Accor uses these trackers and how to configure them, please consult our policy on Cookies by clicking the link in our Cookie Banner.
You have the right to obtain information about and access your personal data collected by Accor, subject to applicable legal provisions. Also you have the right to have your personal data rectified, erased or have the processing of it restricted. Furthermore you have the right to data portability and to issue instructions on how your data is to be treated after your death (hopefully as late as possible!). You can also object to the processing of your personal data, preferences and satisfaction between the hotels operating under the AccorGroup brands.
In the event that you wish to exercise any of your above rights, please contact the Data Privacy department for the AccorGroup directly by sending an email to data.privacy@accor.com or by writing to the address below:
Accor
Département Protection des Données Personnelles (Data Privacy Department)
82, rue Henri Farman -ACC 1208
CS 20077
92445 Issy-les-Moulineaux - FRANCE
For the purposes of confidentiality and personal data protection, we will need to check your identity in order to respond to your request. In case of reasonable doubts concerning your identity you may be asked to include a copy of an official piece of identification, such as an ID card or passport, along with your request. A black and white copy of the relevant page of your identity document is sufficient.
All requests will receive a response as swiftly as possible.
You may also exercise your rights in respect of your personal data that is stored and processed by a hotel as a data controller. To do this, you must contact the hotel directly. You will find all necessary information to contact a hotel on all.accor.com. If you need any assistance, please contact AccorData Privacy Department by writing to data.privacy@accor.com or to the above postal address.
You also have the right to lodge a complaint with a data protection authority. For your information,
You can contact Accordata protection officer by writing to accorhotels.dpo@accor.com or to the above postal address.
If you are in Australia or New Zealand and have a complaint about how we collect, hold, use or disclose your personal data, you can also contact privacy.au@accor.com.
We may modify this charter from time to time. Consequently, we recommend that you consult it regularly.
For any questions concerning The Accor Group's personal data protection policy, please contact the Data Privacy department (See clause "Your rights").