Privacy Policy
Last updated: April 2025 - Version 1.1.
In compliance with Regulation (EU) 2016/679 and Law No. 78-17 of January 6, 1978 as amended
1. Identity of the data controller
Data controller | SHB - Société Hôtelière Beauvaisienne SAS |
Operated brand | ELEMA Hotels |
Address | ZA DE LA VATINE, RUE DE CLERMONT, 60000 BEAUVAIS |
RCS | 393 808 191 R.C.S. Beauvais |
GDPR contact email | data.privacy@somnoo.com |
Data Protection Officer (DPO) | Not subject to mandatory designation under Art. 37 GDPR - contact via: data.privacy@somnoo.com |
2. Personal data collected
2.1 Data provided directly
Identity data: name, first name, nationality (police form for foreign travelers).
Contact data: email address, phone number, mailing address.
Reservation data: stay dates, room type, number of occupants, stay preferences.
Payment data: processed exclusively via Adyen (PCI DSS Level 1). SHB - Société Hôtelière Beauvaisienne never stores raw bank card data.
Pre check-in data: estimated arrival time, identity documents if required, electronic signature.
Post-stay reviews and feedback: comments, satisfaction ratings.
Application data: CV, cover letter (recruitment).
Surveillance images: recordings of common areas in ELEMA establishments (reception, hallways, parking, common areas).
2.2 Data collected automatically
IP address, browser type and version, operating system, timestamp.
Pages visited, session duration, navigation path (Google Analytics, anonymized data).
Approximate location inferred from IP address (country/region - not precise).
2.3 Data received from third parties
Distribution intermediaries (OTAs): name, email, stay dates, reservation reference.
Technical and operational providers: direct online reservation data and hotel management operational data.
Client relationship management providers (CRM): stay data, preferences, interaction history.
3. Purposes and legal bases
Purpose of processing | Legal basis (Art. 6 GDPR) | Retention period |
|---|---|---|
Booking and stay management | Art. 6(1)(b) - Contract performance | Duration of stay + 5 years |
Pre check-in & guest communications | Art. 6(1)(b)+(f) - Contract + Legitimate interest | 12 months post-stay |
Secure payment | Art. 6(1)(b) - Contract performance | 13 months (chargeback) / 5 years |
Police form - foreign travelers | Art. 6(1)(c) - Legal obligation | 1 year (regulatory) |
Marketing prospecting / Newsletter | Art. 6(1)(a) - Consent | Until unsubscribe or 3 years |
Upsell & additional services | Art. 6(1)(a) - Consent | Duration of consent |
Anonymous site statistics | Art. 6(1)(a) - Consent (cookies) | 26 months maximum |
Complaint and dispute management | Art. 6(1)(f) - Legitimate interest | 5 years (civil limitation) |
Recruitment | Art. 6(1)(a) - Candidate consent | 2 years after last contact |
Accounting and tax obligations | Art. 6(1)(c) - Legal obligation | 10 years |
Surveillance of common areas | Art. 6(1)(f) - Legitimate interest (security of goods and people) | 30 days (unless judicial requisition) |
4. Data recipients
4.1 ELEMA Group establishments
The personal data collected is intended for SHB - Société Hôtelière Beauvaisienne SAS, data controller, as well as hotels operated under the ELEMA Hotels brand.
Only individuals directly involved in data processing for one of the purposes described in article 3 may access them, strictly within that purpose and according to the principle of least privilege.
4.2 Contractors and partners
Your personal data may be communicated to the following categories of recipients, strictly within the limits of the purposes described in article 3:
Technical and operational providers - companies managing the reservation system, property management system (PMS), website hosting and maintenance.
Client relationship management providers (CRM) - companies handling communications before, during, and after the stay, pre check-in management, guest portal, and additional services.
Payment providers - companies ensuring secure processing of bank transactions, PCI DSS certified. SHB - Société Hôtelière Beauvaisienne never stores raw bank card data at any time.
Marketing and analytics providers - companies measuring site traffic, online advertising campaigns, and retargeting, subject to your cookie consent.
Distribution intermediaries (OTAs) - third-party booking platforms, only when the booking is made via them.
Legal and judicial authorities - administrations, courts or authorized bodies, upon requisition or under a legal obligation.
SHB - Société Hôtelière Beauvaisienne ensures that all its contractors provide sufficient guarantees regarding the protection of personal data, in accordance with Article 28 of the GDPR.
4.3 Data sale
SHB - Société Hôtelière Beauvaisienne does not sell or rent your personal data to third parties for commercial purposes.
5. Cookies and trackers
Category | Cookie(s) | Purpose | Max. duration |
|---|---|---|---|
Technical (exempt) | PHPSESSID, w360_rgpd, cloudfront | Session, security, CDN - mandatory for operation | Session / 13 months |
Analytics | Google Analytics (_ga, _gid) | Anonymized audience measurement (IP anonymized) | 26 months |
Marketing | Google Ads (gcl_au), Meta Pixel (_fbp) | Targeted advertising, retargeting, campaign measurement | 90 d. – 13 months |
Consent (CMP) | Axeptio | Memory of your cookie choices | 6 months |
In accordance with CNIL recommendations (deliberation no. 2020-091), non-essential cookies are only set after your consent via our cookie banner. You can modify your preferences at any time via the "Manage my cookies" link at the bottom of the page.
Learn more: www.allaboutcookies.org - www.youronlinechoices.eu - www.cnil.fr/en/cookies-and-other-trackers
6. Transfers outside the European Union
Certain providers (Google, Meta, Adyen) may transfer data outside the EU. These transfers are governed by:
The EU-U.S. Data Privacy Framework (adequacy decision of July 10, 2023) for certified American entities.
Standard Contractual Clauses (SCC) adopted by the European Commission (decision of June 4, 2021).
Binding Corporate Rules (BCR) for multinational groups.
The list of countries concerned and applicable safeguards can be obtained on request at contact@somnoo.com.
7. Data security
SHB - Société Hôtelière Beauvaisienne implements appropriate technical and organizational measures to ensure the security of your personal data and protect it against any unauthorized access, loss, destruction or accidental disclosure, in accordance with Article 32 of the GDPR.
In case of a data breach likely to pose a risk to your rights and freedoms, SHB - Société Hôtelière Beauvaisienne is committed to notifying the CNIL within 72 hours (Art. 33 GDPR) and to informing you directly if the risk is high (Art. 34 GDPR).
8. Your rights
Right | Description |
|---|---|
Access (Art. 15) | Obtain confirmation and a copy of your processed data. |
Rectification (Art. 16) | Have inaccurate or incomplete data corrected. |
Erasure (Art. 17) | Request the deletion of your data ("right to be forgotten"). |
Objection (Art. 21) | Object to processing based on legitimate interest or commercial prospecting. |
Restriction (Art. 18) | Request the temporary suspension of a processing. |
Portability (Art. 20) | Receive your data in a structured, machine-readable format. |
Withdrawal of consent | Withdraw consent at any time, without retroactive effect. |
Post-mortem directives (Art. 85 LIL) | Define instructions on the fate of your data after your death. |
How to exercise your rights?
By email: data.privacy@somnoo.com (subject: "Exercise of GDPR rights – [Your name]")
By postal mail: SHB - Société Hôtelière Beauvaisienne – ZA DE LA VATINE, RUE DE CLERMONT, 60000 BEAUVAIS
Response time: 1 month from the receipt of the request (Art. 12 GDPR), extendable by 2 months in case of complex or numerous requests. An identity document may be required.
CNIL Appeal Right: If you believe your rights are not respected, you can file a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL) - 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 - Tel.: 01 53 73 22 22 - www.cnil.fr
9. Minors
The elema-hotels.com site and ELEMA Hotels services are not intended for persons under the age of 18. SHB - Société Hôtelière Beauvaisienne does not knowingly collect personal data from minors. If you are a parent or legal guardian and believe that your child has provided us with data, please contact us at data.privacy@somnoo.com to request deletion.
10. Update
This policy may be updated to reflect legal, regulatory, technical, or commercial developments. Any substantial changes will be communicated via email (registered clients) or through an information banner on the Site.
We invite you to regularly consult this page.
Last update date: April 2026 - Version: 1.1.