INTRODUCTION

As part of the use of its services and in particular the services accessible on its website, its mobile site, its online store and its mobile applications, Bambou Resort, in its capacity as data controller, is likely to collect and process personal data concerning you.

For your information, personal data is any information relating to a natural person who is identified or can be identified, directly or indirectly, by reference to an identification number or to one or more elements specific to that person (surname, first name, address, e-mail address, telephone number, contract number, credit card number, etc.).

The processing of personal data refers to any operation performed on this type of data (collection, storage, transmission, deletion, etc.), whether on paper or by computer. The data controller is the person who determines the purposes of each processing operation and the means of achieving these purposes.

Bambou Resort is committed to protecting the privacy of our customers, prospective customers and visitors to our websites, mobile sites, online stores and mobile applications. All processing of personal data implemented as part of the services accessible complies with applicable local regulations on the protection of personal data and in particular the provisions of the amended French Data Protection Act of January 6, 1978 and the General Data Protection Regulation (EU Regulation 2016/679) or "RGPD".

Therefore, in the interests of transparency, this Privacy Policy aims to explain why your personal data is collected and processed by Bambou Resort, in its capacity as data controller, how it is processed, what rights you have to your data and how you can exercise them. 

1 - WHAT ARE OUR PERSONAL DATA PROTECTION COMMITMENTS?

Bambou Resort is committed to guaranteeing a high level of protection for the personal data of its customers, prospects and users of its physical and online sites: website, mobile site, online store and mobile applications, and of any other person whose personal data it processes.

Bambou Resort undertakes to comply with the regulations applicable to all processing of personal data that it implements:

• Your personal data will be processed lawfully, fairly and transparently;
• Your personal data is collected for specific, explicit and legitimate purposes, and is not further processed in a way that is incompatible with these purposes;
• Your personal data are stored in an appropriate and relevant manner and are limited to what is necessary for the purposes for which they are processed;
• Your personal data will be kept accurate and up to date and all reasonable steps will be taken to ensure that inaccurate data, having regard to the purposes for which it is processed, is erased or rectified without delay.

Bambou Resort implements appropriate technical and organizational measures to guarantee a level of security appropriate to the risk inherent in its processing operations, to meet regulatory requirements and to protect the rights and data of the persons concerned from the outset of processing operations.

Bambou Resort also contractually imposes the same level of personal data protection on its subcontractors (service providers, suppliers, etc.).

2 - WHAT PERSONAL DATA DO WE COLLECT?

A - Depending on the purpose of the collection

The personal data we collect varies depending on the purpose of the collection and the Service we provide.

This data is necessary to enable us to fulfil the following purposes: 

If you are a customer :

• Manage requests for accommodation bookings (length and dates of stay, services included, quote, amount) from customers themselves, tour operators or online travel agencies, 
• Manage reservations and invoicing for catering services,
• Manage reservations and invoicing for wellness services,
• Manage transfer requests,
• Manage room allocation and access, 
• Manage additional services ordered (romantic reception/dinner, gift box, photo shoot, etc.),
• Provide access to Wi-Fi,
• Manage payments, in particular direct debits by credit card,
• Manage invoicing and general accounting,
• Manage customer accounts and commercial relations,
• Conduct satisfaction surveys, 
• Communicate with you when you leave reviews of our services on review sites (TripAdvisor, Google, etc. or via our applications),
• Carry out marketing actions (sending out advertising messages, promotions, invitations to events, surveys) concerning the accommodation and restaurant activities (includes commercial communications via WhatsApp for the restaurant),
• Managing customer loyalty,
• Handle requests and complaints,
• Manage the WhatsApp mailing list for Bambou Resort guests (hotel guests and non-hotel guests), 
• Manage disputes, unpaid bills and litigation relating to services provided,
• Manage concierge services offered to customers (external reservations, organization of activities, specific requests),
• To draw up analyses or statistics to improve the quality of products and services,
• Organize contests and award prizes;
• Draw up financial and sales statistics.

If you are a user of our websites (as a visitor or customer), for :

• Manage newsletter subscriptions,
• Communicate on new products and special operations,
• Respond to requests received via the forms we provide (contact, notice, transfer request, claim...),
• Register online reservations (accommodation and restaurant),
• Register transfer requests online,
• Manage pre-authorizations or deposits for reservations,
• Manage online user accounts on some of Bambou Resort's websites,
• Manage feedback on our services or content,
• Manage online payments,
• Managing cookies on our websites,

If you are one of our suppliers : 

• Carry out administrative operations related to contracts, orders, deliveries, invoices and accounting for accounts payable,
• Provide supplier selections for Resort needs,
• Maintain supplier documentation.

If you are one of our partners or future partners (travel agency, CSE...):

• Carry out sales prospecting and marketing activities

For job applicant data :

• Review applications and organize interviews;
• Check candidates' professional skills in relation to the position to be filled or the positions likely to be filled.

In general, we may process your personal data for the purposes of managing requests to exercise rights granted to you under the regulations applicable to the processing of personal data.

We also process personal data in connection with the management of our social networking pages. To find out more, see our Social Networking Policy.

B - Data collected

Bambou Resort may collect the following categories of personal data directly:

a) your personal details, such as your surname, first name, e-mail address, postal address and telephone number(s);

b) the identifiers used to access your online account, i.e. username and password. This is necessary for us to create a personal user account;

c) exchanges with us, which may include details of conversations with customer service;

d) demographic information such as your age, gender and lifestyle preferences (including your favourite products and your interest in them);

e) browsing history, such as pages visited, date of visit, location at the time of visit, or IP address. To this end, cookies and other tracking technologies are used to collect information about you when you interact with the Bambou Resort Site. 

To find out more about cookies and how to disable them, please consult our Cookies Policy.

f) information relating to payment when a purchase or reservation is made on one of our sites, online stores or applications. Generally, the invoice is issued in your name and billing address. Bank details are managed by Stripe, which collects bank details in a secure, Data Security Standard-certified manner.

g) contact details for partners and service providers: surname, first name, professional e-mail address, telephone number, company address, position held; 

f) In general, any information that you communicate to us when you deal with Bambou Resort in any other way.

The provision of your personal data is voluntary. However, certain information, identified by an asterisk in our forms or indicated as compulsory, is essential for us to process your request. Without this information, Bambou Resort will not be able to process your request. 

‍

Bambou Resort may also collect personal data about you indirectly when you share content on social networks, websites, stores or applications relating to our products and services, or by responding to our posts and promotional announcements on social networks.

C - Personal data concerning minors

Bambou Resort does not collect or process personal data relating to children under the age of 18 without the prior consent of the child's parents or guardians.

If personal data concerning children is collected via our websites, mobile sites or online stores, parents or guardians may object by contacting us at the address given at the bottom of this page.

3 - HOW IS PERSONAL DATA COLLECTED?

A - Data collected directly from you

In the context of our relationship, you may communicate your personal data to Bambou Resort by various means, in particular on our websites: internet site, mobile site, online store and mobile applications, during your internet browsing, purchases, reservations, by filling in the various collection forms, when subscribing to the newsletter, when creating an account, when submitting an application, when posting comments on our social networking pages, when establishing any contact with our establishment or when you transmit your personal data to us in any other way.

B - Data collected automatically

When you access our sites, some of your data is automatically collected via cookies and other tracers. To find out more about cookies, please consult our Cookies Policy.

C - Social networks

To find out more about the data collection and processing carried out by Bambou Resort on these social networking pages, please consult its Social Networking Policy.

4 - WHAT IS THE LEGAL BASIS FOR PROCESSING YOUR DATA?  

Your data is mainly used for the purposes described in point 2 -A of this Policy. In all cases, Bambou Resort collects your data only when there is a legal basis for its collection and processing.

The processing of your data is justified :

• To ensure the performance of the service and/or sales contract you have signed with the resort, in particular :  
  
  • Customer management operations: reservations, cancellations, orders, invoices, payments, service provision, room allocation and access, concierge services, transfers;
  • Customer relations and claims management;
  • Online user account management ;
  • The organization of contests and the awarding of prizes;
  • Supplier management operations: administrative operations relating to contracts, orders, deliveries and invoices.

On this contractual legal basis, any refusal to communicate your personal data will prevent the conclusion and performance of the contract.

• To comply with a legal obligation to which the Bambou Resort Company is subject, in particular :
  
  • Applicable accounting rules for managing both accounts receivable and accounts payable, 
  • Management of requests to exercise your rights under the regulations applicable to the processing of personal data,
  • Verification of the customer's age on arrival.

• For the purposes of the legitimate interests pursued by Bambou Resort (in particular developing new services and offers, improving customer service, etc.):
  
  • Manage requests, questions, comments and opinions on products, services and content; 
  • To draw up analyses or statistics to improve the quality of products and services;
  • Managing loyalty ;
  • Gather applications and verify the candidate's professional skills in relation to the position to be filled or the positions likely to be filled;
  • Conduct satisfaction surveys; 
  • Give access to Wi-Fi ;
  • Draw up financial and commercial statistics;
  • Handle unpaid bills and disputes (not involving offences and/or not resulting in the exclusion of a person from a right, benefit or contract);
  • Carry out sales and marketing activities with partners;
  • Maintain supplier documentation and provide selections. 

• Subject to obtaining your prior consent, Bambou Resort may process your data for : 

• send you our newsletter and commercial offers on our products and services, 
• provide you with offers from our partners, 
• deposit cookies under the conditions described in the Cookies Policy.

At any time, you may reconsider your choice and withdraw your consent, as described in article 7 of this Policy, without however calling into question the lawfulness of the processing based on consent and implemented prior to the withdrawal.

5 - HOW LONG IS YOUR DATA STORED?

Bambou Resort undertakes to keep your personal data for no longer than is necessary for the purposes for which they are processed.

Retention periods are defined according to the purposes of the processing carried out by Bambou Resort and take into account, in particular, applicable legal provisions imposing a specific retention period for certain categories of data, any applicable limitation periods and the recommendations of the CNIL concerning certain categories of data processing.

For further information on how long we keep your data, please contact the Bambou Resort DPO (see articles 7 and 12 of this Policy). 

6 - WHO MAY ACCESS YOUR PERSONAL DATA?

A - Recipients of your data

Bambou Resort is likely to transmit your data only to authorized recipients, within the limits of their respective attributions and according to the purpose(s) concerned: Bambou Resort staff, and external organizations, subcontractors with whom our relationship is contractually framed to include the requirements arising from the protection of personal data.

‍

‍

B - Data transfers outside the European Union

Some of your personal data may be transferred outside the European Union, in particular to service providers located in the United States, via our subcontractors.

When such transfers take place, Bambou Resort ensures that they are accompanied by appropriate guarantees in accordance with current legislation, and in particular :

• by an adequacy decision of the European Commission when the recipient country offers an equivalent level of protection;
• or, failing that, by signing standard contractual clauses (SCCs) adopted by the European Commission, in accordance with Article 46 of the RGPD, accompanied where necessary by additional measures required to ensure a level of protection equivalent to that guaranteed within the EU.

You can obtain further information on these guarantees or obtain a copy of the standard contractual clauses by contacting us at dpo@hotelbambou.fr.

7 - HOW TO EXERCISE YOUR RIGHTS

In accordance with the applicable regulations on the protection of personal data, you may, at any time, exercise your rights of access, rectification and deletion of data concerning you, as well as your rights to limit and object to processing and your right to the portability of your personal data.

The right of access

You may obtain from Bambou Resort confirmation as to whether or not your data is being processed and, where it is, access to all data and information held.

The right to rectify your data 

You may obtain from Bambou Resort, as soon as possible, the rectification of any data concerning you that may be inaccurate or erroneous. You may also, if necessary, request that your data be completed. 

‍

The right to erase your data 

Barring legal exceptions, you may ask Bambou Resort to delete your data as soon as possible if, in particular, you consider that the processing carried out by Bambou Resort on your data is no longer necessary with regard to the purposes for which it was collected. 

‍

The right to portability of your data 

You have the right to recover part of your data in an open, machine-readable format, or to ask Bambou Resort to transfer it to another organization. This right only applies to data that you have actively and knowingly provided to Bambou Resort (for example, data that you have entered in an online form) or data generated when using a service or device in the context of concluding or managing your contract, and which is processed automatically, on the basis of consent or the performance of a contract.

‍

The right to object 

You may object to your data being used by an organization for a specific purpose. In this case, you must put forward reasons relating to your particular situation, except in the case of commercial canvassing, to which you may object without giving any reason. If your data is processed for commercial prospecting purposes, you may object at any time, just as you may object at any time to the placement of cookies.

‍

The right to limit the processing of your data 

You can ask Bambou Resort to keep your data without being able to use them, in one of the following cases:

• you dispute the accuracy of the data used by Bambou Resort, 
• you object to your data being processed,
• in the event of unlawful use, but you object to their deletion, 
• you need it to establish, exercise or defend legal rights.

‍

The right to withdraw your consent to the processing of your data 

Where the processing of your personal data is based on your consent (e.g. the sending of our electronic commercial offers), you may withdraw your consent at any time.

Once you have agreed to receive commercial offers from Bambou Resort, you may, at any time, change your mind by clicking on the unsubscribe link at the bottom of the e-mail or by sending STOP, as indicated in the SMS messages sent to you. If you have agreed to receive newsletters from Bambou Resort, you may, at any time, express your wish to no longer receive them, using the unsubscribe link present in each newsletter.

Likewise, if you wish to withdraw your consent to cookies, you may do so in accordance with the procedures set out in the Cookies Policy in article 3-B of this Privacy Policy.

In addition, you also have the right to define directives concerning the fate of your personal data post mortem.

These rights may be exercised by writing to the following address:

Bamboo Hotel

Anse Mitan

Martinique FWI

97 229 Trois-Ilets

MARTINIQUE - France

Or by email to: dpo@hotelbambou.fr
‍

In this context, we may, depending on the situation, ask you to accompany your request with the elements necessary for your identification (surname, first name, e-mail) as well as any other information necessary to confirm your identity. 

Right to lodge a complaint with the CNIL

You also have a right of complaint to the Commission Nationale de l'Informatique et des Libertés (CNIL) if you consider that your rights are not respected or that the protection of your data is not ensured in accordance with the RGPD, you may, at any time, lodge a complaint with a competent supervisory authority (in France, the CNIL), directly on the CNIL Website or by post to: CNIL - 3 Place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07.

8 - COMPUTER SECURITY / TRANSACTION SECURITY

Ensuring the security and confidentiality of the personal data you entrust to us is a priority for Bambou Resort. We therefore implement all technical and organizational measures appropriate to the nature, scope and context of the personal data you provide us with and the risks presented by their processing, to preserve the security of your personal data and, in particular, to prevent any accidental or unlawful destruction, loss, alteration, disclosure, intrusion or unauthorized access to such data.

Bambou Resort infrastructures are protected against malicious software (viruses, spyware, etc.). Physical and remote access to servers hosting data is controlled.

We offer a secure online payment system using the latest technology.

Bambou Resort strives to combat identity theft on the Internet. This is why, for example, we use a device to detect fraudulent payments made by credit card. This device is designed to protect you in the event of loss or theft of your credit card.

The security and confidentiality of personal data depend on good practice on everyone's part. That's why we ask you not to share your passwords with third parties, to always log out of your profile and your social account (especially if you have linked accounts) and to close your browser window at the end of your work session, especially if you access the Internet from a computer shared with other people. This will prevent other users from accessing your personal information.

In the event that Bambou Resort calls on service providers to process part of your data, it undertakes to verify that they present sufficient guarantees to ensure the protection of the personal data entrusted to them and to have them sign confidentiality clauses in accordance with Article 28 of the RGPD.

In the event of a personal data breach, i.e. a security incident, whether malicious or not and whether intentional or unintentional, which results in the integrity, confidentiality or availability of your personal data being compromised, we undertake to comply with the following obligations:

The "Violation Register" contains the following information:

• the nature of the violation ;
• the categories and approximate number of persons concerned;
• categories and approximate number of files involved ;
• probable consequences of the violation ;
• the measures taken to remedy the violation and, where appropriate, to limit the negative consequences of the violation;
• where applicable, justification for not notifying the CNIL or informing the persons concerned. 

However, in accordance with the regulations in force, Bambou Resort is not obliged to inform you of a violation in the following cases:

• Your personal data is protected by measures that make it incomprehensible to anyone not authorized to access it;
• measures have been taken so that the risk is no longer likely to materialize;
• this communication requires disproportionate efforts on the part of Bambou Resort, which has no means of contacting you to inform you.

‍

9 - Mandatory fields 

Fields marked with an asterisk are mandatory. If you fail to reply, your request will not be processed. The obligation to provide the requested data is contractual, as it is necessary for the performance of the contract to which you are a party or for pre-contractual measures carried out at your request, in particular in the event of a request for information or a quotation concerning our products and services.

10 - PRIVACY BY DESIGN/BY DEFAULT

Bambou Resort is committed to integrating the protection of personal data right from the design stage of a project, a service or any other tool linked to the handling of personal data, in particular the minimization of personal data, the limitation of the purposes of data collection, respect for the integrity and confidentiality of data, and the limitation of retention periods.

11 - ACCOUNTABILITY

In order to comply with the principle of Accountability, i.e. the implementation of demonstrate compliance with the RGPD, Bambou Resort :

• adopts internal procedures to ensure compliance with the regulation (IT charter, personal data protection charter);
• keeps documentary records of all processing carried out under its responsibility or that of the subcontractor (keeping of the processing register, confidentiality agreements with employees and service providers, company security policy, procedures for managing requests for access, rectification, opposition, etc.);
• carries out impact analyses (PIA) for processing operations presenting particular risks to rights and freedoms.

The aim is to provide a wealth of documentation enabling compliance with data protection rules to be demonstrated at all times.

12 - CONTACT US

If you have any further questions about this policy or the way Bambou Resort treats your personal data, please contact us at the following address: dpo@hotelbambou.fr 

13 - CHANGES TO THE PRIVACY POLICY 

Bambou Resort reserves the right to adapt the present privacy policy. Consequently, we invite you to regularly consult our Policy, accessible from all pages of the Site, in order to keep informed of the latest applicable online version. Whenever we make substantial changes to this Statement, we publish a link to the Statement on the home page of our site. We also invite you to check the date indicated on this Policy to see when it was last updated. 

‍