1. Purpose and scope
This policy explains how MIH collects and uses the personal data of visitors to the website www.mihotel.fr, prospective customers, customers, guests, accompanying persons and anyone who contacts MiHotel. It applies to direct bookings, to communications before and after a stay, to on-site services and, where MIH receives the data, to bookings made through a partner platform.
This policy constitutes information within the meaning of Articles 12 to 14 of Regulation (EU) 2016/679 (“GDPR”). Consulting it or accepting the terms of sale does not constitute consent to optional processing.
2. Data controller and contact
The data controller is MIH, a simplified joint-stock company (SAS) with share capital of €310,470, registered with the Chambéry Trade and Companies Register (RCS) under number 804 812 519, whose registered office is at 47 chemin de Join, 73100 Brison-Saint-Innocent, France, operating the MiHotel brand.
- Privacy email: contact@mihotel.fr — suggested subject: “Personal data”
- Post: MiHotel — Données personnelles, 29 place Bellecour, 69002 Lyon, France
- Telephone: +33 (0)4 28 29 65 94
3. Data processed and sources
Category | Data | Source |
|---|---|---|
Identity and contact details | Surname, first name, title, date of birth where necessary, nationality, address, email, telephone. | You, the organiser of the stay or a booking platform. |
Booking and stay | Dates, Suite, number and identity of guests, requests, preferences, messages, services, incidents, complaints. | You, MiHotel teams, Guesty, booking channel. |
Verification / obligations | Identity document where necessary, individual police registration form for foreign guests, supporting documents. | You or the adult accompanying you. |
Payment and invoicing | Amount, payment method, status, transaction reference, billing address. MIH does not intend to store the card security code. | GuestyPay or another payment service provider, you. |
Digital use | IP address, device, browser, pages viewed, timestamps, cookie choices, technical logs. | Your device, Guesty Websites, authorised tools. |
Communication / marketing | Contact history, consents, unsubscriptions, survey responses, offer preferences. | You and MIH’s communication tools. |
Premises security | CCTV images in signposted areas, date and time. | Cameras at the establishments concerned. |
MIH only requests the data that is necessary. Mandatory fields are indicated; failure to provide them may prevent the booking, the payment, access to the accommodation or the handling of the request. Anyone who provides the data of an accompanying person must ensure that they are entitled to do so and must pass this policy on to them.
4. Purposes, legal bases and consequences
Purpose | Legal basis | Main data |
|---|---|---|
Responding to requests, making and managing the booking, providing the stay and services, sending access information and service messages. | Pre-contractual measures and performance of the contract. | Identity, contact details, booking, communications, stay. |
Collecting, securing and reconciling payments; managing deposits, refunds, unpaid amounts and disputes. | Contract; legitimate interests in preventing fraud and defending rights; accounting obligations. | Transaction, invoicing, booking, evidence. |
Invoicing, accounting, taxes, police registration forms, responses to authorised authorities. | Legal obligation. | Identity, stay, invoice, legally required data. |
Security of people, property, access and systems; prevention of misuse and incidents. | Legitimate interest of MIH, subject to the rights of individuals; legal obligation where applicable. | Access, logs, incidents, signposted images. |
Customer service, complaints, litigation and evidence of rights. | Contract and legitimate interest in resolving disputes and defending rights. | Communications, stay file, relevant documents. |
Improving services, producing internal statistics and measuring satisfaction. | Legitimate interest for non-intrusive analyses; consent where the system uses non-exempt trackers. | Usage, stay, responses and aggregated data. |
Sending MiHotel offers by email or SMS. | Consent for prospective customers; legitimate interest for similar services offered to customers, with a simple means of objecting in every message. | Contact details, customer history, preferences, evidence of choice. |
Telephone marketing. | Prior consent, except for calls relating to an ongoing contract within legal limits. | Telephone, evidence of consent, contractual relationship. |
Placing or reading personalisation, advertising or non-exempt audience measurement cookies. | Consent. | Online identifiers, browsing, consent choices. |
MIH does not reuse data for an incompatible purpose without providing the required information and, where necessary, obtaining fresh consent.
5. Service communications and marketing
Confirmations, access codes, information relating to the stay, invoices and customer service replies are communications necessary for the contract: unsubscribing from marketing does not stop them.
Every electronic commercial message includes a simple means of unsubscribing. Since 11 August 2026, telephone marketing to a consumer requires, in principle, their prior consent; the exception relating to an ongoing contract is interpreted strictly. MIH keeps evidence of choices and respects any withdrawal or objection.
6. Recipients and processors
Within the limits of their duties and on a need-to-know basis, data may be accessible to:
- authorised MIH teams and operational service providers involved in the stay (reception, concierge, housekeeping, maintenance, security, services ordered);
- Guesty, Inc. and its processors for Guesty Websites, booking management, messaging and platform functions;
- GuestyPay and the banking or payment service providers involved in the transaction;
- providers of communication, technical hosting, support, cybersecurity, analytics, accounting, consultancy and archiving services;
- the platform through which the booking was made, in accordance with its own responsibilities and rules;
- government bodies, authorities, courts, public and ministerial officers or advisers where required by law or to defend a right.
MIH does not sell personal data. Service providers acting on behalf of MIH are contractually bound to confidentiality, to security and to using the data solely on documented instructions, unless otherwise required by law.
7. Guesty Websites, GuestyPay and responsibilities
For processing whose purposes and essential means are determined by MIH, MIH acts as data controller and Guesty acts primarily as processor. Guesty may, however, act as a separate controller for its own obligations, the security of its services, fraud prevention or other purposes described in its policy, depending on the context. GuestyPay and its payment partners also apply their own regulatory obligations.
Guesty’s information is available at www.guesty.com/privacy-policy/ and its data processing addendum at www.guesty.com/data-processing-addendum/. To exercise a right concerning a MiHotel booking, we recommend contacting MIH first so that the request can be followed up with the service providers.
8. Transfers outside the European Economic Area
The use of Guesty and certain service providers may involve access from, or transfer to, countries outside the European Economic Area. Where the country does not benefit from an adequacy decision of the European Commission, MIH requires a mechanism compliant with Articles 44 et seq. of the GDPR, in particular the Commission’s standard contractual clauses, supplemented where necessary by a transfer impact assessment and additional technical or organisational measures.
A copy of the relevant safeguards, or information on their availability, may be requested from MIH, subject to the protection of trade secrets and security information.
9. Retention periods
The periods below are standard maximums. A shorter period applies once the purpose has been achieved; longer retention may be necessary for a legal obligation, a limitation period or a dispute, with archiving and restricted access.
Data / purpose | Period or criterion |
|---|---|
Enquiries without a booking | Time needed to handle the enquiry, then up to 3 years after the last contact for commercial follow-up where lawful. |
Booking and stay file | Duration of the active relationship, then archiving of evidential items for up to 5 years, unless a different period applies. |
Invoices and accounting records | 10 years from the end of the financial year concerned. |
Card data used to process payment | The time of the transaction; the card security code is never kept after authorisation. |
Evidence in the event of a card dispute | 13 months after the debit, or 15 months for a deferred debit card, in secure intermediate archiving. |
Copy of identity document for verification | Deleted as soon as verification is complete and, in the absence of any incident, within 30 days at the latest. A document needed for a dispute is set aside for the duration of that dispute. |
Individual police registration form for foreign guests | 6 months from the date it is completed, then destroyed, in accordance with the applicable rules. |
Marketing to customers | Up to 3 years after the end of the commercial relationship or the last contact, with any objection taken into account immediately. |
Marketing to prospective customers | 3 years from collection or from the last contact initiated by the prospective customer; withdrawal of consent handled without delay. |
GDPR rights requests | The time needed to respond, then appropriate retention for evidential purposes, in principle up to 5 years; proof of identity deleted as soon as verification is complete unless a need is demonstrated. |
Security and access logs | A period proportionate to the purpose, generally 6 to 12 months, unless there is an incident or a specific obligation. |
CCTV | A few days and no more than one month, unless an extract is needed for an incident, an investigation or litigation. |
Cookie consent choices | In principle 6 months before asking again, unless there is a significant change to the service or to the choice requested. |
Cookies and trackers | Period defined by purpose and limited to what is necessary; exempt audience measurement trackers and their data comply with the applicable CNIL limits, including a maximum of 25 months for the information collected. |
10. Cookies and other trackers
A cookie is a small file or identifier stored on or read from a device. On first access, the banner must allow non-essential trackers to be accepted or refused with equal ease, and then allow a choice by purpose. Refusing must never impair the functions strictly necessary for booking. Continuing to browse, closing the banner or inactivity do not constitute consent.
Category | Examples of purposes | Rule |
|---|---|---|
Strictly necessary | Security, load balancing, session, basket/booking, authentication, remembering the consent choice. | Activated without consent only if genuinely essential; information is mandatory. |
Audience measurement | Visitor statistics and performance. | Consent, unless the configuration strictly meets the CNIL exemption criteria. |
Functional | Non-essential personalisation, external media, enhanced preferences. | Prior consent. |
Advertising / social networks | Campaign measurement, targeting, retargeting, social sharing. | Prior consent, separate for each purpose and partner. |
11. CCTV
Where cameras are installed in the common areas or entrances of an establishment, their purpose is the security of people and property. They do not film private areas. Local signage indicates where they are located. Only authorised persons have access to the images. The right of access may be limited to protect the rights of third parties or the needs of an investigation.
12. Security and data breaches
MIH implements technical and organisational measures appropriate to the risk: management of access rights, authentication, access restrictions, encryption where relevant, backups, logging, updates, clauses with service providers and incident procedures. No transmission over the internet is entirely free of risk.
Where a breach presents a risk to rights and freedoms, MIH notifies the CNIL under the conditions laid down by the GDPR and informs the individuals concerned where a high risk is likely to result.
13. Automated decisions
To its knowledge, MIH does not make any decision producing legal effects concerning, or similarly significantly affecting, a person based solely on automated processing. Tools may flag a risk of fraud or an anomaly; where a significant decision results from this, MIH provides for human intervention and allows the person to express their point of view, in accordance with the applicable requirements.
14. Minors and accompanying persons
The booking service is not intended to be used by a minor alone. The data of an accompanying minor is provided by the responsible adult and limited to what is necessary for the stay or for a legal obligation. MIH does not carry out targeted marketing aimed at minors.
15. Your rights
- access the data concerning you and obtain a copy of it;
- have inaccurate or incomplete data rectified;
- request erasure, where the legal conditions are met;
- request the restriction of processing;
- object to processing based on legitimate interest, on grounds relating to your particular situation; objection to marketing is absolute and requires no justification;
- receive the data you have provided in a structured format and transmit it to another controller where the right to data portability applies;
- withdraw your consent at any time, without retroactive effect;
- set out instructions regarding what happens to your data after your death, under the conditions laid down by French law;
- obtain information and safeguards relating to international transfers.
Requests may be sent to the contact details given in section 2. MIH will, in principle, respond within one month of receipt; this period may be extended by two months for complex or numerous requests, with reasons given within the first month. MIH may request additional information or proof of identity only where there is reasonable doubt, and in a proportionate manner.
If a difficulty remains unresolved, you may refer the matter to the French Data Protection Authority (Commission nationale de l’informatique et des libertés, CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or lodge a complaint at www.cnil.fr.
16. Updates
MIH may amend this policy to reflect changes in processing, service providers or the law. The date of the update is shown at the top of the document. In the event of a substantial change, appropriate information is provided and fresh consent is obtained where required by law.