All personal data collected on the website www.rixos.com (the “Site”) are processed by Rixos Hospitality B.V. (hereinafter “Rixos” or “we”), acting as the data controller, in accordance with legal requirements and, in particular, the “Data Protection Act” of 6 January 1978 as amended and the European Regulation n°2016/679/EU of 27 April 2016.

The purpose of this privacy policy (hereinafter the “Policy”) is to inform anyone who browses the Site and/or fills in the forms offered on the Site and/or books an hotel on the Site (hereinafter the “User(s)” or “you”) of the commitments made by Rixos in order to ensure the protection of her/his personal data.

In particular, we provide you with information about the personal data we collect from you, how we use, disclose and protect it and, finally, how you can exercise your rights over this data.

1. Nature of the personal data collected on the Site

Rixos processes personal data concerning you and which you have provided to us in the following contexts:

• When you browse the Site.
• When you book a one of the following hotels directly on the Site: Rixos Almaty Hotel in Kazakhstan, Rixos Kadhisha Shymkent in Kazakhstan or Rixos Bab Al Bahr in the United Arab Emirates (the “Hotel(s)”);
• When you give your consent to receive our newsletters and other marketing/commercial information from us;
• When you wish to get in touch with us to ask us a question, make a complaint or apply for a job via the contact form.

In this context Rixos collects and processes the following personal data:

• Your identity and contact details: gender, surname, name, e-mail address, phone number, as well as the age of any children concerned by a reservation made on the Site and, as the case may be, the identity of the people concerned by a reservation made on the Site.
• Your billing details: billing address, mobile phone number. 
• Your payment information.
• Your job application information: CV, cover letter.
• The pages and sections of the Site you have visited and other information related to your browsing on our Site (see the Cookie policy);
• Any other information you directly and voluntarily provide to us while using the Site.

The mandatory or optional nature of any information to be completed by you is typically marked by an asterisk in the corresponding forms at the time such information is collected. Any failure to complete that information may result in Rixos refusing to process your request.

You agree that the personal data you provide about yourself to Rixos will be current, accurate, complete and unequivocal.

2. Purposes and legal basis for the processing of your personal data

The main objective of collecting personal data by Rixos is to offer you a secure, optimal, effective and personalized experience.
Rixos undertakes to collect and process your personal data lawfully and fairly.
The processing implemented by Rixos pursues specified, explicit and legitimate purposes.

Your data may be processed for the following purposes in particular:

• To provide you the service, i.e. recording / managing your booking and its payment.
  ⇒ In this context, the legal basis of the processing is the performance of the contract between Rixos and you. 
• To handle any questions or requests and deal with any complaints you may have: Rixos may use the data collected to respond to your requests relating to the functioning of the Site, Rixos’ services, your bookings, etc.
  ⇒ In this context, the legal basis of the processing is either the performance of the contract if the request concerns the contractual relationship between Rixos and you, or else the legitimate interest of Rixos, more specifically its financial interest in satisfying your questions and ensuring quality customer service. 
• To carry out statistical analyses, develop the Site, optimize your browsing and provide you with a personalized experience: cookies may be placed on the Site for these purposes – for more information you can refer to the Cookie Policy
  ⇒ In this context, the legal basis of the processing is Rixos’ legitimate interest, more specifically its financial interest in continually improving its Site and its services and in offering you appropriate content and optimal browsing. 
• To handle your job application if you contact us for this purpose.
  ⇒ In this context, the legal basis of the processing is the legitimate interest of Rixos, more specifically its interest in responding to your job application and finding suitable profiles for the position available within Rixos. 
• To send you marketing/commercial information: Rixos may send you e-mails with information on its activities and services if you have consented to it.
  ⇒ In this context, the processing is based on Rixos’ legitimate interest, more specifically its financial interest in making you personalized offers, better understanding your needs and offering you adapted services to build your loyalty.

Rixos may use the data collected for other purposes, subject to your prior consent.

3. Storage of your personal data

Rixos will keep your personal data for as long as necessary to achieve the purposes for which they are collected and processed.
Rixos may, however, keep your personal data for a longer period (in archives) whenever there is a legal obligation for us or to take into account the applicable statute of limitation period to assert, exercise or defend legal claims, namely:

• 5 years after the end of the commercial/contractual relationship for any data collected in the context of a booking.
• 3 years after the last contact with you for any data collected for direct marketing purposes.
• 10 years for any data required for accounting purposes.
• until the end of the processing of your request for any request / claim (and in accordance with the applicable statute of limitation in the event of litigation).
• 2 years for applicant data from the last contact with the applicant unless the applicant agrees to a longer period; beyond that the data are archived for 4 years.
• when cookies or other tracers not necessary for the functioning of the Site are placed on your device, they are stored in accordance with the legal obligations and recommendations issued by the authorities (i.e. for a maximum period of 6 months in France).

4. Communication of your personal data

Rixos may provide access to your personal data to service providers and/or affiliates to perform services related to the Site (including hosting, maintenance, risk and fraud protection, Site optimization) and to perform data analysis and marketing campaign services. These service providers will only have access to your data to perform these services and are bound to the same security and confidentiality obligations as Rixos which remains responsible for the processing of your data. Any personal data required to make a reservation in one of the Hotels on the Site will be transferred to the concerned Hotel. The Hotels are operated under a franchise or management agreement between the Hotel’s owner and Rixos (or one of its subsidiaries across the world). When staying in one of the Hotels, your personal data will be dealt with by Rixos and the Hotel, both acting as data controllers for their own, separate, purposes. In summary:

• Rixos will process your personal data because it manages the Site’s booking engine, which allows Rixos to collect the data necessary to organize your stay in one of the Hotels and to communicate this data to the concerned Hotel. Rixos also manages a global database of clients who stay in hotels under the Rixos brand,
• the Hotel will process your data to manage its contractual relationship with you (invoicing, payment, booking management etc.), to perform marketing activities and to comply with its legal obligations.

The data related to your stays, preferences and satisfaction are shared between the hotels operating under the Rixos brand. This data is used to improve the quality of service and your experience in each of these hotels. In this context, your data is processed jointly by Rixos and these hotels. In order to pursue this legitimate interest, whilst safeguarding your rights and liberties, a specific joint controllership agreement describes the obligations and responsibilities of Rixos and these hotels. You may, at any time, object to the sharing of this data between the hotels and Rixos. by contacting us as provided in Article 7 below. You can also request a summary of the key points of the joint controllership agreement.
Your personal data may also be shared with Accor S.A., the parent company of Rixos, to meet our obligations to customers, to manage reservations and hotel stays, for the management of Accor S.A.’s loyalty program and/or analytics purposes. In this context, Rixos and Accor S.A. will both act as data controllers for their own, separate purposes.

Personal data shared with Accor S.A. includes the following:

• Contact details (for example, last name, first name, telephone number, email)
• Personal information (for example, date of birth, nationality)
• Information relating to your children (for example, first name, date of birth, age)
• Your membership number for the Accor loyalty program or another partner program (for example, an airline loyalty programme) and information related to your activities within the context of the loyalty program
• Your arrival and departure dates
• Your preferences and interests (for example, smoking or non-smoking room, preferred floor, type of bedding, type of newspapers/magazines, sports, cultural interests, food and beverages preferences, etc.)
• Your questions/comments, during or following a stay in one of our Accorbranded establishments
• Technical and location data you generate as a result of using our websites and applications.

Your personal data may also be shared with Fine Otel Turizm İşletmecilik A.Ş., a franchise company of Rixos, to carry out the necessary processes in order for you to benefit from the products and services offered by the Company, to perform a contract, to process customer complaints and claims, to conduct analysis for providing special services according to your requests regarding our products and services, to ensure effective communication by managing customer relations and ensuring customer satisfaction, to carry out accomodation services, to carry out post-accomodation support services, to carry out transfer processes for the accommodation services, to conduct marketing activities related to the services provided, to conduct campaign and promotion activities prepared by our affiliates, to execute, control and report financial transactions, to conduct loyalty programs connected with products and services, to conduct activities in compliance with the legislation. In this context, Rixos and Fine Otel Turizm İşletmecilik A.Ş. will both act as data controllers for their own, separate purposes.

Personal data shared with Fine Otel Turizm İşletmecilik A.Ş, Mena Hotels FZE, Rixos Hospitality B.V. and all its related subsidiaries,contracted agencies, shareholders or profits sharing entities, subsidirary technologies/websites (hereafter will be referred as “Rixos”) which are entitled to process/and share the data with includes the following:

• Contact details (for example, last name, first name, telephone number, email)
• Personal information (for example, date of birth, nationality)
• Information relating to your children (for example, first name, date of birth, age)
• Your membership number for the Accor loyalty program or another partner program (for example, an airline loyalty programme) and information related to your activities within the context of the loyalty program
• Your arrival and departure dates
• Your preferences and interests (for example, smoking or non-smoking room, preferred floor, type of bedding, type of newspapers/magazines, sports, cultural interests, food and beverages preferences, their online behavior, search history etc.)

Rixos may also share your data to comply with its legal obligations, to prevent, detect, investigate and take action against any prohibited or illegal activities, any situation threatening the security or any other right and interest of Users, Rixos or any individual and any violation of the Site’s
Terms of Use. Rixos may also transmit your personal data to respond to legal or administrative proceedings of any kind, court orders or enforcement measures requested by the competent authorities. Finally, Rixos may share your data in the context of a merger or acquisition of all or part of Rixos by a third party, as is hereby accepted by you. For the email marketing & communications, Rixos is obliged to inform their accessible database that unless opted-out, Rixos has rights to contact with its prior accessible – opted in guests in various marketing and advertising communications in different existing & upcoming advertising platforms and technologies, unless guests opt out.

5. Transfers of your personal data

The recipients listed above to whom Rixos may communicate your personal data may be domiciled abroad, including outside the European Economic Area.
In such case, Rixos will require them to take, in accordance with the applicable legislation on the protection of personal data, all organizational and technical measures to ensure an adequate level of protection of your data (in particular by a decision of adequacy of the European Commission, by the signature of the standard contractual clauses drafted by the European Commission or by the US Privacy Shield – a copy of these documents is available on request at Rixos Hospitality B.V., Nieuwezijds Voorburgwal 104 – 108, 1012 SG Amsterdam, Netherlands.

6. Your rights

You have the following rights over your personal data:

• The right of access: You have the right to obtain (i) confirmation as to whether personal data concerning you are processed or not and, if processed, to obtain (ii) access to such data and a copy thereof. 
• The right to rectification: You have the right to obtain the rectification of inaccurate personal data concerning you. You also have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
• The right to erasure: In some cases, you have the right to obtain the erasure of personal data concerning you. However, this is not an absolute right and Rixos may have legal or legitimate grounds for keeping such data.
• The right to restrict processing: in some cases, you have the right to obtain restriction of the processing of your personal data.
• The right to portability: you have the right to receive the personal data concerning you which you have provided to Rixos, in a structured, commonly used and machine-readable format, and you have the right to transmit those data to another controller without hindrance from Rixos. This right only applies when the processing of your personal data is based on your consent or on a contract and such processing is carried out by automated means. 
• The right to object to processing: you have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you when such processing is based on the legitimate interest of Rixos. Rixos may, however, invoke compelling legitimate grounds for continued processing. When your personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of such data. 
• The right to lodge a complaint with the competent supervisory authority: you have the right to contact the CNIL to complain about Rixos’ personal data protection practices. 
• A right to give instructions concerning the use of your data after your death: you have the right to give Rixos instructions concerning the use of your personal data after your death.

To exercise one or more of these rights, please contact Rixos at the following postal address: Rixos Hospitality B.V.,  Nieuwezijds Voorburgwal 104 – 108, 1012 SG Amsterdam, Netherlands or by email at dataprivacy@rixos.com. 

7. Contact us

Feel free to send us any questions or concerns regarding this Privacy Policy by sending us an email at dataprivacy@rixos.com

8. Changes to this Privacy Policy

If we decide to change this Privacy Policy, we will post the changes on this page and update the date of the change indicated above. In the event of a substantial change, we will inform you by any means deemed appropriate.