CONFIDENTIALITY POLICY

27 July 2022 Page 1 of 12

 CONTENTS
Article 1. PREAMBLE ........................................................................................................................... 3
Article 2. DEFINITIONS ........................................................................................................................ 3
Article 3. CONTACT DETAILS & POINT OF CONTACT ......................................................................... 4
Article 4. TERMS OF COLLECTION OF PERSONAL DATA .................................................................... 4
(a) Direct collection............................................................................................................................. 4
(a) Indirect collection .......................................................................................................................... 4
Article 5. CHARACTERISTICS OF THE PROCESSING OPERATIONS ...................................................... 5
Article 6. JOINT PROCESSING OPERATIONS ..................................................................................... 10
Article 7. DATA RECIPIENTS .............................................................................................................. 10
Article 8. ACCESS TO SOCIAL NETWORKS OF THE PX HOLDING GROUP ......................................... 10
Article 9. COMPUTERS AND FREEDOMS RIGHTS ............................................................................. 11
Article 10. COOKIES ........................................................................................................................ 12
(a) Strictly necessary Cookies (“Technical Cookies”) ................................................................ 12
(b) The Cookies and trackers that are not strictly necessary (“Non-technical Cookies and
trackers”)........................................................................................................................................... 12
Article 11. MODIFICATION OF THE CONFIDENTIALITY POLICY ..................................................... 12

27 July 2022 Page 2 of 12

 Article 1. PREAMBLE

• The Hotel Atmosphères is very attentive to the protection of privacy of its Representatives, and
particularly, the protection, confidentiality, and security of their Personal Data that it collects, within
compliance with the General Data Protection Regulation 2016/679 (“GDPR”) and the Computers and
Freedoms law no. 78-17 (“LIL”).

• Through this confidentiality policy, the Hotel Atmosphères wishes to make its Representatives aware
of the following:

(i) the characteristics of the processing operations of the Data collected and processed;

(ii) the commitments given by the PX Holding Group, to respect the Data of its Representatives
and to allow them, if necessary, to exercise their rights as per the Regulations.

• To this end, the Representatives are requested to read this document carefully.

Article 2. DEFINITIONS

The terms and expressions with a capital letter in this Confidentiality policy have the meaning stated
below, regardless of whether they are used in the singular or the plural:

- “Client”: physical person who has reserved one or more rooms in one or more Hotel of the
Hotel Atmosphères;

- “Cookie”: refers to the practice of recording and/or reading information from digital terminals
(computer, smartphone, tablet, etc.);

- “Data”: refers to the personal data of the Representatives, i.e. the information that allows
identifying them directly or indirectly, and which is collected and processed particularly when
using a Site within the context of a contract request, an online reservation request, etc.;

- “Supplier”: physical person or legal entity who provides goods or services to the Hotel
Atmosphères;

- “PX Holding Group”: refers to the entity formed by the legal entities operating the Hotel
Atmosphères and the company PX HOLDING, the owner of the said hotel.

- “Hotel”: may refer to Hotel Atmosphères;

- “Representative”: may refer to either Internet users, Clients, and Prospects of the Hotel
Atmosphères;

- “Partner(s): person(s) with whom the Hotel Atmosphères has concluded a contract intended
to promote and/or market the rooms and Hotel (for example, “Booking”, “Staycation”, etc.);

- “Third party Country”: any Nation that is not a member of the European Union;

- “Prospect”: any person identified as probably being interested in the services provided by the
Hotel Atmosphères;

27 July 2022 Page 3 of 12

 - “Social Networks”: refers to all the pages managed by the Hotel Atmosphères on social
networks (for example Facebook, Instagram, LinkedIn etc.);

- “Regulations”: refers to the provisions of the “Computers and Freedoms law” dated 6 January
1978, amended (“LIL”), the General Data Protection Regulation (EU Regulation 2016/679)
(“GDPR”) and all other specific provisions applicable to data protection;

- “Site(s)”: refers to the website(s) developed by the Hotel;

- “Internet user”: refers to any person who browses the Site(s).

Article 3. CONTACT DETAILS & POINT OF CONTACT

(a) Contact details of PX Holding and the Hotel Atmosphères:

• The head office of the company PX Holding (also called “PX Holding” in this document), is located at 6,
place des Etats-Unis, 75116-PARIS, France.

• The contact details of the Hotel Atmosphères is 31 rue des écoles, 75005-Paris.

(b) Point of contact:

• For all requests concerning this document or to exercise their rights, the Representatives of PX Holding
and/or the Hotel are invited to write to them, at the address of the choice of the User:
• through letter, at the postal address of the Hotel and/or PX Holding Group , whichever
is the recipient of the request, and is provided above;
• through letter to the following address: privacy@hotelatmospheres.com

Article 4. TERMS OF COLLECTION OF PERSONAL DATA

(a) Direct collection

• PX Holding Group as well as the Hotel collect Data from their Representatives through:
a. digital forms, on their respective Sites;
b. if necessary, forms during reservations.

(a) Indirect collection

• Certain Data processed by the Hotel was collected through their Partners, within the context of online
reservations made by the Clients on the respective sites of the latter.

• Within this context, the Data that the Hotel collect indirectly from Clients through their Partners, are
as follows:
o Identification data;
o Contact details;
o Details of the reserved stay;
o The payment method used;
o Possibly, Data concerning third parties.

27 July 2022 Page 4 of 12

 Article 5. CHARACTERISTICS OF THE PROCESSING OPERATIONS
• The Representatives’ Data is collected and processed according to the characteristics listed below.

• When the processing operation is based on consent, the Representatives have the right to withdraw it
at any moment.

27 July 2022 Page 5 of 12

No. END PURPOSES OF THE PROCESSING PERSON(S) LEGAL BASIS PERIOD OF STORAGE OF DATA* PROCESSING
OPERATION CONCERNED MANAGER(S)

CHARACTERISTICS OF THE PROCESSING OPERATIONS OF THE DATA COLLECTED FROM THE SITES OF THE HOTEL, THE PX HOLDING GROUP, PARTNERS AND CANDIDATES

1 Management of contact requests made Prospects Legitimate interest of the Hotel, i.e. For the duration necessary for the PX Holding
on the Sites providing information to all the management of requests
Clients persons who formulate the &
information requests
Hotel
Execution of pre-contractual
measures taken upon request of the
person concerned

2 Management of recruitments Candidates for a Execution of pre-contractual The storage period of the information PX Holding &
post within the measures taken upon request of the thus collected does not exceed two Hotel
Hotel person concerned years after the last contact with the
Atmosphères Candidate

3 Recording and administrative and Clients Execution of the contract 3 years from the latest interaction with Hotel
financial management of the reservation the site or from the end of the contract;
requests

4 “Atmosphères” Newsletter: Clients Execution of pre-contractual For the duration of the subscription to PX Holding
measures taken upon request of the the newsletter
Prospects person concerned

27 July 2022 Page 6 of 12

 ☞ Recording the newsletter subscription Execution of the contract
requests;

☞ Sending the newsletter.

5 Compiling statistics Clients The legitimate interest the Hotel in • 13 months in case of cookies PX Holding
knowing about the evolution and
Prospects effectiveness of the services provided • The statistics are compiled from the Hotel
data from active databases, which is
stored for the durations given in this Google (For the
table. After this, the data is anonymised. “Google
Analytics”
cookies)

CHARACTERISTICS OF THE PROCESSING OPERATIONS OF DATA CARRIED OUT WITHIN THE CONTEXT OF MANAGEMENT OF RESERVATIONS AND EXECUTION OF
CONTRACTS
6
Creation and update of client sheets Clients Legal obligation Three years from the latest interaction Hotel
or from the end of the contract; except
Execution of the contract contracts with a value of more than one
hundred and fifty Euros which shall be
archived for a duration of ten years from
the end of the commercial relation
7
Administrative and financial Prospects Execution of pre-contractual 3 years from the latest interaction with Hotel
management of the telephone or mail measures taken upon request of the the site or from the end of the contract
reservations Clients person concerned

Execution of the contract

27 July 2022 Page 7 of 12

8 Administrative and financial
management of other requests from Clients Execution of pre-contractual 3 years from the latest interaction with Hotel
Clients measures taken upon request of the the Site or from the end of your contract;
(SPA, restaurants, transports, etc.) Third parties person concerned
(accompanying
the Clients)

9 Management and control of access to Clients Execution of the contract As regards the clients, the time of their Hotel
rooms stay
Hotel staff Legitimate interest of Hotel in
controlling and ensuring that only As regards the Hotel staff, for the entire
authorised persons can access the duration of their employment contract
rooms

10 Archiving the access history of the Hotel Clients Legitimate interest of the Hotel, to The data is deleted after every 600 Hotel
rooms ensure safety and check the connections, which is every 2 months
legitimacy of access to the rooms on average

11 Measurement of Client satisfaction Clients Legitimate interest of the Hotel & PX Satisfaction surveys are completed by PX Holding &
Holding in knowing the perception of the Clients in the Hotel, and the results Hotel
the Clients about the services are stored Beyond this, the data is
provided anonymised

12 Video-surveillance Clients Legitimate interest of the Hotel, to 1 month Hotel

ensure the safety of the people and
Hotel staff goods The data may be communicated to the
police department or legal authorities
following such a request

27 July 2022 Page 8 of 12

 PROMOTION OF SERVICES OFFERED BY THE HOTEL

13 Prospection Clients Legitimate interest when the Three years from the latest contact with PX Holding &
prospection is carried out with Clients the Client or the end of the contractual Hotel
Prospects relation
Consent when the prospection is
carried out with Prospects Three years from the latest contact or
the collection of data of the Prospect

14 Social networks management Clients Legitimate interest of Px Holding and Refer to the confidentiality policies of PX Holding &
of the Hotel to maintain relations the relevant networks (See below) Hotel
Prospects with its contacts (Clients and
Prospects), and to promote its
Third parties services on social networks

(*) At the end of these storage periods, the Data is archived in a secure manner for the necessary storage durations and/or statute of limitations resulting
from the applicable legislative or regulatory provisions. In pursuance of these periods, the Data shall be deleted, in accordance with the Regulations in force.

27 July 2022 Page 9 of 12

 Article 6. JOINT PROCESSING OPERATIONS

• The processing operations no. 1, 2, 6, 12, 13 & 14 above are carried out under the joint responsibility
of PX Holding and the Hotel.

• In compliance with Article 26 of the GDPR, the purpose of this clause is to make all the Representatives
aware of the broad outlines of the agreement that PX Holding has entered into with the Hotel.

• Thus, PX Holding is the primary point of contact through mail of the Representatives as regards
exercising their rights. PX Holding is in charge of communicating the requests to the Hotel if necessary.
Evidently, the requests sent directly to the Hotel through mail shall be processed by them, unless these
exclusively concern PX Holding.

• As for the Hotel, it is responsible for informing Clients when they make their reservations directly in
the establishments. Consequently, this confidentiality policy must be communicated to all their Clients,
along with their information notices if necessary.

Article 7. DATA RECIPIENTS

• All the transfers, as well as the relations with the Data recipients, are strictly supervised by the PX
Holding.

• The Data transfers are primarily carried out between the Hotel and PX Holding, and also between the
relevant internal services, particularly to the specially authorised technical personnel, and in
compliance with the purposes listed in the Article “Characteristics of processing operations”.

• PX Holding and the Hotel may also have to communicate certain Data to their Suppliers (sub-
contractors). These sub-contractors are obligated to ensure the confidentiality, integrity, and security
of the Data communicated to them, and to use the said data only within the context of the execution
of their task.

• In special circumstances, Data can be disclosed, when they are required to do so by legal and
administrative authorities that have a legitimate need to know.

Article 8. ACCESS TO SOCIAL NETWORKS OF THE PX HOLDING GROUP

• Certain Sites allow accessing the pages of the Social Networks created by PX Holding and/or the Hotel
by clicking on certain of the tabs present. When Internet users click on these links, Data concerning
them is automatically communicated to the Social Networks. Consequently, these Networks process
the Data within the context of processing operations for which the Hotel Atmosphères is a third party.
Consequently, the latter shall invite the Internet users to consult their respective confidentiality
policies to know the characteristics, and if required, to exercise their rights.

27 July 2022 Page 10 of 12

• Here are some links:

• Facebook confidentiality policy:

https://fr-fr.facebook.com/privacy/explanation;

• Instagram confidentiality policy:

https://fr-fr.facebook.com/help/instagram/155833707900388

• LinkedIn confidentiality policy:

https://www.linkedin.com/legal/privacy-policy?_l=fr_FR

• Moreover, we would like to inform you that browsing on the Facebook pages of PX Holding and/or the
Hotel shall result in Data being processed for preparing statistics under the joint responsibility of PX
Holding, and if required, of the Hotel, and of Facebook Ireland Limited, where the latter assumes
primary responsibility for the said processing operation in accordance with the addendum published
by it and available at the following address:
https://fr-fr.facebook.com/legal/terms/page_controller_addendum.

Article 9. COMPUTERS AND FREEDOMS RIGHTS

In their capacity of “person concerned” for the processing operations described in this document, and
in compliance with the applicable Regulations, all the Representatives have the following rights:

• a right of access, i.e. obtaining confirmation whether the Data has or has not been processed, and
if yes, access to the said Data, as well as the different information including the purposes of the
processing operation, the Data category, the recipient(s) of the Data, etc.
• a right of rectification, at the earliest, for Data which is inaccurate, incomplete, expired, or
ambiguous, or which it is prohibited to collect or process;
• a right of opposition to the processing of Data by the processing manager or to a Data transfer,
unless there are legitimate and important reasons which prevail over your interest;
• a right to delete Data for the following reasons:
o The Data is no longer necessary in view of the purposes for which it was collected
or processed;
o the consent on which the processing operation was founded was withdrawn, and
there is no other legal reason for processing the Data;
o the processing of the Data is opposed and there is no superior interest justifying
the execution of the processing operation;
o The Data was processed illegally;
o The Data must be deleted to comply with the legal obligation to which PX Holding
and/or the Hotel may be subject;
o The Data was collected when the Representative was a minor.
• a right to organise in advance and during their lifetime, the conditions in which the Data shall
be stored and communicated, after death;
• a right to portability and recovery of Data that allows receiving Data sent in a structured format,
currently used and legible for a machine, and to communicate it to another processing manager.
• In the event one of these rights is exercised digitally, the responses provided shall be, if necessary,
through digital means whenever possible, unless the Representative has specifically requested
otherwise.

27 July 2022 Page 11 of 12

• In the event the responses provided are deemed unsatisfactory or incomplete, all the
Representatives have the possibility of filing a claim with the CNIL (National Commission for
Information Technology and Civil Liberties), the national control authority tasked with ensuring
compliance with the obligations in terms of protection of personal data.
• The consumer has the right to be registered on the opposition to cold calling list “Bloctel”.

Article 10. COOKIES

(a) Strictly necessary Cookies (“Technical Cookies”)

The exclusive purpose of certain Cookies is to allow or facilitate the communication digitally, or they
are strictly necessary for the provision of online communication services upon the express request of
each User. In compliance with Article 82 of the LIL, the User’s consent is not required for using these
cookies which result in the processing of Data necessary for the continuation of the legitimate interest
of the Hotel and/or PX Holding Group, i.e. for the correct technical management of their Site.

These are primarily session cookies which allow authentication and log-ins to the Site(s) as well as the
memorisation of the browsing information during a session (for example to ensure the authentication
of the User by remembering the means of authentication during a session, or even the choice of legal
language, etc.)

(b) The Cookies and trackers that are not strictly necessary (“Non-technical Cookies and
trackers”)

The Hotel Atmosphèresuses the advertisement Cookies and trackers which record information
concerning the preferences of Internet users by analysing their browsing on the Sites which it develops
and also on third party sites, which allow optimising the Sites, and also to adapt the content proposed
to their interests.

Among these Cookies, there are third party Cookies and trackers which may be installed on the Users’
terminal when they browse the Sites. The purposes of these Cookies are the preparation of statistics
and facilitating the redirection of Internet users towards the social networks pages published by PX
Holding, and by each Hotel concerned.

An information strip is displayed at every first visit. The purpose of this strip is to give prior information
to Internet users about the specific purposes of the use of Cookies and trackers, to obtain their
consent, and if required, to allow them to oppose all or part of the Cookies and tracers which are stored
on the digital terminals.

Article 11. MODIFICATION OF THE CONFIDENTIALITY POLICY

To ensure that this confidentiality is exhaustive at all times, it may be modified. In such a case, the
updated document shall be communicated to all Representatives through all means.

Last updated on 27 July 2022

27 July 2022 Page 12 of 12