Privacy Policy

Last updated: December 22, 2025

Aware of the importance of ensuring data confidentiality, Institut VATEL (hereinafter "VATEL"), acting as data controller, is committed to the protection of personal data, in accordance with Regulation (EU) 2016/679 of April 27, 2016 (GDPR) and amended Law No. 78-17.

1. PURPOSE

The purpose of this data protection policy is to inform you about the commitments and practical measures taken by VATEL to ensure respect for your personal data.

This privacy policy may evolve depending on the legal and regulatory context and the recommendations and/or guidelines of the CNIL (French Data Protection Authority).

2. SCOPE

This privacy policy applies in particular when you visit our websites, when you access our products and services (school enrollment, hotel, restaurant, or spa reservations) or when you participate in VATEL events (hereinafter collectively referred to as the "Service(s)").

VATEL acts in its capacity as data controller.

This privacy policy may be supplemented by additional elements specified in all or part of a provided Service.

3. TYPES OF DATA COLLECTED

VATEL ensures that it only collects and processes data that is strictly necessary for the purpose for which it is processed, in accordance with the data minimization principle.

When you access one of our Services, you may be required to provide personal data by filling out registration forms: we indicate there which types of personal data are required. You may choose not to submit the requested data, but this may limit your access to the Service.

Personal data is collected in three ways:

• what you provide;

• what we obtain from third-party sources;

• and finally, through your use of our Services.

3.1. Data you provide to us

The personal data collected directly from you depends on your relationship with the Service and may include:

• Contact data: last name, first name, email address, postal address, phone number, mobile number;

• Comments and other information you provide to us, including search queries, questions, and information you send to the requested service.

3.2. Data collected from other sources

We may also obtain your contact details and other personal information from our subsidiaries and other third parties, including:

• Vatel group companies with which we offer joint services; and/or

• Publicly accessible sources and partners from whom we obtain data to validate and supplement the information we hold.

3.3. Service usage data, including cookies

A Service may automatically collect information about how you interact with it, including:

• Information about the computer and connection environment, namely the IP address, browser type and version, operating system and other software installed in your environment, mobile platform, technical identifier(s), error reports, and execution data;

• Usage data such as the functions you used, configurations you selected, data you clicked on, including the date and time and pages viewed, terms searched, and pages visited and searched within the Service;

• Geographic information from Services based on user location to provide you with more relevant content based on your geographic location wherever you are in the world.

We collect this data through our servers, the use of cookies, and various technologies.

Cookies are small text files that can be read by a web server in the VATEL domain that placed the cookie on your hard drive. We may use cookies and other technologies to store your preferences and configurations, assist you with registration, and analyze site operations.

You can control cookies through your browser settings and several tools. However, if you block certain cookies, you will no longer be able to register, log in, access certain parts, or fully use the Services.

4. PURPOSES OF PROCESSING

Depending on the relationship established with VATEL, we use your personal data to:

• Provide, activate, and manage your access to and use of the Service;

• Process and respond to a school enrollment application or a brochure request;

• Improve the Service and our other products and events, and develop new ones;

• Offer personalized content to make the Service more relevant based on your interests and geographic location;

• Respond to your requests, searches, comments, and concerns;

• Notify you of changes, updates, and other announcements relating to the Service and our other products and services;

• Provide promotional messages and other information about our products, events, services, and all new developments related to VATEL;

• Invite you to participate in surveys regarding the use of the Service;

• Identify usage trends and develop data analysis, including for research, auditing, reporting, and other business operations, which include determining the effectiveness of our promotional campaigns and evaluating business performance;

• Comply with our legal obligations, resolve potential disputes, and enforce our contracts.

If you are the manager of an entity registered for one of our Services, we will use your data to communicate with you about your organization's subscription.

If you provide us with information about users within your entity, you warrant that you have obtained their consent for us to use their personal data to provide them with the Services.

Processing is based on the execution of a contract, consent, VATEL's legitimate interest, or a legal obligation, as the case may be.

5. DATA RECIPIENTS

VATEL only communicates your personal data to authorized and specified recipients:

• Competent internal departments of VATEL;

• Technical service providers acting as processors, bound by contractual obligations compliant with the GDPR.

No personal information of the user is published without the user's knowledge, exchanged, transferred, assigned, or sold on any medium to third parties. Only the hypothesis of the buyout of www.vatel.fr and its rights would allow the transmission of said information to the potential purchaser, who would in turn be bound by the same obligation of data conservation and modification regarding the website user.

6. RETENTION AND CONSERVATION PERIOD OF YOUR PERSONAL DATA

Institut VATEL only retains your data for the duration necessary for the operations for which they were collected, as well as in compliance with applicable legislation. This is for the purpose of providing the Service and executing the obligations you have requested, or for other essential purposes such as complying with our legal obligations, maintaining commercial and financial archives, settling disputes, maintaining security, detecting and preventing fraud and abuse, and executing the contract binding us.

7. PROCESSING LOCATIONS

Your personal data is stored and processed in France and within the European Union.

VATEL takes measures, including through contracts, intended to ensure that the information continues to be protected wherever it is located, fully consistent with the protection standards imposed by applicable law.

8. TRANSFER OF PERSONAL DATA

VATEL refrains from processing, hosting, or transferring the collected information to a country located outside the European Union or recognized as "inadequate" by the European Commission without prior notification to the data subject.

When transfers outside the EU are necessary, Institut VATEL will implement appropriate safeguards, including:

• European Commission Standard Contractual Clauses;

• Additional security measures.

9. DATA SECURITY

VATEL ensures the security of your personal data by implementing enhanced data protection through the use of physical and logistical security measures.

To ensure the security and confidentiality of Personal Data and Personal Health Data, VATEL uses networks protected by standard devices such as firewalls, pseudonymization, encryption, and passwords.

When processing Personal Data, VATEL takes all reasonable measures to protect it against loss, misuse, unauthorized access, disclosure, alteration, or destruction.

10. CHILDREN'S PRIVACY PROTECTION

VATEL does not knowingly collect information from children under 16, and as a rule, VATEL's websites are not directed at children under 16.

11. YOUR RIGHTS

You have rights guaranteed by privacy and data protection laws in Europe and certain other countries, which you can exercise free of charge:

• Access to your personal information;

• Rectification or erasure of your personal data;

• Restriction of our processing of your personal data;

• Objection to our processing;

• The right to obtain a copy of the personal data concerning you provided to VATEL, in a structured, commonly used, and machine-readable format, where this right is applicable in accordance with Article 20 of the GDPR (right to data portability);

• The right to define directives regarding the disposition of your personal data after your death, in accordance with Article 85 of the French Data Protection Act (Loi Informatique et Libertés).

Only you can exercise these rights on your own data by writing to: Vatel Group – 8, rue Duhamel - BP 2013 - 69227 Lyon – France or rgpd@vatel.com, specifying "GDPR" in the subject line and attaching a copy of your proof of identity.

You can also file a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL), the personal data regulator in France.

12. LANGUAGES

The original version of this policy was drafted in the French language.

Thus, the French version will be considered the official version. In the event of a dispute concerning this policy, the French version will prevail over the English version and any other version.

13. CHANGES

We will update this privacy policy regularly. Any changes will be posted on this page with an updated revision date.

14. CONTACT

If you have any comments, questions, or requests regarding this policy or the processing of your data, please contact us by writing to: Vatel Group – 8, rue Duhamel - BP 2013 - 69227 Lyon – France or rgpd@vatel.com, specifying "GDPR" in the subject line and attaching a copy of your proof of identity.