ALL Accor Experiences Personal Data

PERSONAL DATA PROTECTION CHARTER FOR CUSTOMERS OF THE ALL ACCOR EXPERIENCES SITE

1. ACCOR GROUP’S COMMITMENT TO PRIVACY PROTECTION

We consider you a valued client therefore our top priority is to offer you exceptional experiences around the world. Your satisfaction and trust in Accor are essential to us so we have implemented a policy to protect your personal data. This charter sets out our commitments to you and describes how the Accor Group uses your personal data when you use the ALL Accor Experiences Site, accessible at https://experiences-all.accor.com hereinafter referred to as the “Site”.

This Site is accessible to members of the ALL Accor loyalty programme. The processing of personal data relating to the ALL Accor loyalty programme (including the creation and management of your ALL Accor member account and the management of your loyalty benefits) is described in the Accor Client Personal Data Protection Charter, accessible at the following address: https://all.accor.com/a/en/information/data-protection.html and at the bottom of the Site page. This charter covers the processing of personal data implemented in connection with your use of the ALL Accor Experiences Site.

2. SCOPE

In this charter, “Accor” refers to:

  • Accor SA, parent company of the Accor Group, with its registered office at 82 rue Henri Farman, 92130 Issy-les-Moulineaux, France;

  • Subsidiaries and other companies affiliated with Accor SA participating in the activities of the Accor Group.

When you book an experience with one of our featured experience providers, your personal data is processed by both Accor SA and the experience provider in question, each acting as a separate data controller pursuing its own purposes.

In summary:

  • Accor SA processes your data because it manages the ALL Accor Experiences Site, which enables Accor SA to collect the data necessary to organise your experience and to share that data with the relevant experience providers.

  • Each experience provider processes your data to manage their contractual relationship with you (experience management, billing, payment, etc.) and to prepare for your arrival at the experience.

3. 10 ACCOR PRINCIPLES TO PROTECT YOUR PERSONAL DATA

In accordance with the applicable regulations, in particular the General Data Protection Regulation adopted in Europe, we have established the following 10 principles for the processing of your data within the Accor Group:

  1. Lawfulness: we only use personal data if:

    • we have obtained the individual’s consent, OR

    • this is necessary for the performance of a contract to which the individual is a party, OR

    • this is necessary for compliance with a legal obligation, OR

    • this is necessary to protect the individual’s vital interests, OR

    • we pursue a legitimate interest in using personal data and this use does not infringe upon the individual’s freedoms and interests.

  2. Fairness: we explain how the personal data we collect is useful to us

  3. Specified purposes and data minimisation: we only collect personal data that is strictly necessary for our purposes. If we can achieve the same result using less personal data, then we ensure that we use only that data.

  4. Transparency: we inform the individuals concerned about how we use their data.

  5. We facilitate data subjects’ exercise of their rights: access to data, rectification and erasure of data, and objection to data processing.

  6. Storage periods: we only store personal data for limited periods.

  7. We ensure the security of personal data, namely its integrity and confidentiality.

  8. If a third party needs to use personal data, we ensure that they are capable of protecting that personal data.

  9. If personal data needs to be transferred outside the European Union, we ensure that the transfer is governed by appropriate legal mechanisms.

  10. If personal data is compromised (lost, stolen, damaged, unavailable, etc.), we notify the competent data protection authorities and the affected individuals if the breach is likely to result in a high risk to the rights and freedoms of individuals.

For any questions about Accor’s 10 data protection principles, please contact the Personal Data Protection department, the contact details for which are provided in the “Your rights” section.

4. WHAT PERSONAL DATA IS COLLECTED?

To enable us to provide you with this service for booking experiences with experience providers, we need to collect the following data about you and your companion(s):

  • Identification data and contact details (surname, first name, telephone number, email and postal address);

With the exception of the postal address, providing this information is mandatory so that we can process your booking. Your booking cannot be completed if any of this information is missing.

  • Loyalty programme membership information (membership number, status, benefits);

  • Information related to your booking (booking dates and times, location);

  • Experience preferences;

  • Special requests you may make during the booking process;

  • Information necessary to organise certain events;

  • Your questions and comments before, during, or after your experience;

  • Technical and location information when you use the ALL Accor Experiences Site, to allow us to display experiences nearby.

5. FOR WHAT PURPOSES ARE YOUR DATA COLLECTED AND FOR HOW LONG ARE THEY STORED?

The table below presents the purposes for which we process your data, the legal basis for this processing, as well as the associated storage periods:

Purposes Legal basis Storage period

Management of experience bookings with experience providers:

  • Allow you to book, modify and/or cancel your experience, including through an auction system, if applicable

  • Send experience providers your booking details

  • Send you booking confirmation emails and/or SMS and inform you of any changes in the status of your booking

 Processing necessary for the performance of the contract to which you are a party Three (3) years from the date you were last active with us

Improvement of the services provided:

  • Conduct satisfaction surveys following your experience

  • Display your ALL Accor membership details when logging into the Site via your ALL Accor account, including your status, points balance, contact information, and current experience bookings

  • Collect your experience preferences in order to personalise the display of experiences on the Site

  • Perform analyses and segmentation based on information about you (booking history, interactions with the Site, preferences)

  • Manage your requests and claims

 Processing necessary for the pursuit of our legitimate interest in improving our services and the quality of the experiences offered on the Site.

Three (3) years from the date you were last active with us

Four (4) years from the date your file is closed in connection with a complaint or claim.

Management of communication preferences, alerts and notifications:

  • Allow you to register for waitlists and alerts when an experience goes on sale

  • Notify you when an experience goes on sale if you have proactively requested to be informed

 Processing based on your consent. Three (3) years from the date you were last active with us
Manage any potential litigation and preserve evidence that could be used in court proceedings

Processing necessary for the pursuit of our legitimate interest in establishing evidence in the event of a dispute

For the applicable statutory limitation periods
Comply with all applicable legislation (e.g. storage of accounting documents)

Processing necessary for compliance with a legal obligation

For the duration specified in the applicable legislation

6. CONDITIONS FOR THIRD-PARTY ACCESS TO YOUR PERSONAL DATA

Accor operates in many countries and we strive to offer you the same services worldwide. As such, we must share your personal data with internal and external recipients, under the following conditions:

To provide you with the best possible experience for your booking, we share your data with a limited number of authorised individuals and services:

  • Experience providers: data regarding your bookings and special requests are shared with the experience providers involved in your booking, to enable them to manage your booking and prepare for your experience.

  • Service providers: Accor SA may share your personal data with service providers acting on its behalf, particularly our hosting provider responsible for managing and operating the Site (communications regarding your bookings, auction management, satisfaction surveys, and customer request management). These service providers may only use your data within the scope of the services they perform on behalf of Accor SA.

  • Local authorities: we may also be required to disclose your information to local authorities, if required by law or as part of an investigation and in accordance with applicable local regulations.

7. THE PROTECTION OF YOUR PERSONAL DATA DURING INTERNATIONAL TRANSFERS

For the purposes set out in Article 5 of this charter, we may transfer your personal data to internal or external recipients located in countries where the level of personal data protection may differ from that guaranteed under European Union law.

Therefore, in addition to implementing this charter, Accor takes appropriate measures to secure the transfer of your personal data to an Accor entity or an external recipient located in a country offering a different level of protection from that provided in the country where the personal data is collected. These transfers are governed by appropriate legal mechanisms, notably the standard contractual clauses adopted by the European Commission, binding corporate rules, or any other safeguard compliant with applicable regulations.

Depending on your booking, your data may be transmitted to experience providers located outside the European Union, as this transfer is necessary for the execution of your booking contract. Your data may also be transmitted, as part of the booking process, to our service provider managing the booking platform.

8. DATA SECURITY

Accor SA takes appropriate technical and organisational measures, in accordance with applicable legal provisions (in particular Article 32 of the GDPR), to protect your personal data against destruction, loss, alteration, misuse, and unauthorised access, modification, or disclosure, whether these actions are unlawful or accidental. To this end, we have implemented technical measures (such as firewalls and data encryption) and organisational measures (such as identification and authentication systems, physical protection measures, and access controls). When you provide payment information while making a booking on the Site, secure encryption technology protects your transactions.

9. COOKIES AND OTHER TRACKERS

Accor SA uses cookies and other trackers on its websites. To learn more about Accor’s use of these trackers and to configure your settings, please consult our tracker policy via the “Cookies” link in the footer of our sites.

10. YOUR RIGHTS

You have the right to obtain information about and access your personal data collected by Accor SA, subject to applicable legal provisions. You also have the right to object to the use of your personal data, particularly to avoid receiving commercial communications.

You also have the right to have your data rectified or erased, or to restrict its processing. In addition, you have the right to the portability of your data and the right to define instructions for the processing of your data after your death. If your personal data is not accurate, complete or up-to-date, please communicate the necessary changes to the Personal Data Protection Department indicated below. If you wish to exercise these rights, you may submit your request via our dedicated online Contact form or contact Accor’s Personal Data Protection Department by email at data.privacy@accor.com or by post to the following address:

ACCOR – Département Protection des Données Personnelles (Data Privacy), 82 rue Henri Farman, 92130 Issy-les-Moulineaux, France.

To ensure the confidentiality and protection of your personal data, we will need to verify your identity in order to respond to your request. If we have reasonable doubts about your identity, we may ask you to provide a copy of an official identity document, such as an identity card or passport, to support your request. In this case, a black and white copy of one of these documents is sufficient.

All requests will be processed as soon as possible and in accordance with applicable law.

You may also exercise your rights regarding your personal data held and processed by an experience provider acting as the data controller. To do so, you must contact this experience provider directly. For assistance with your requests, you can use our dedicated online form or write to the Personal Data Protection Department at data.privacy@accor.com.

Finally, you may lodge a complaint with a supervisory authority and contact Accor’s data protection officer by writing to accorhotels.dpo(at)accor.com.

11. UPDATES

We may amend this charter periodically. We therefore invite you to consult this charter regularly, particularly when booking an experience on the Site.

12. QUESTIONS AND CONTACTS

For any questions regarding the personal data policy within the Accor Group, please contact the Personal Data Protection Department (see the “Your rights” section).