UMthetho Wobumfihlo we-Luckey
By using or continuing to use our Services on or after this date you are acknowledging the updated Policy and that your use of the Services will be subject to this updated and revised Policy.
We collect and manage your personal data in compliance with both the "Informatique et Libertés" law of 1978, as amended (the “French Data Protection Act”) and the European General Data Protection Regulation 2016 2016/679 (“GDPR”), as well as all other applicable data protection law and regulation. Any terms referred to in this Policy (e.g. controller, data subject) are as defined in these laws.
- We, Luckey SAS (“Luckey”), are the controller making decisions about and processing your personal data. We are based in France.
- “Users” mean any User or recipient of our website, app or Services, including hosts, co-hosts, guests, management services providers and individuals browsing our site/app with or without registration for our Services;
- “Services” mean any use of our website, our mobile app by a User, the technical tools that we make available to management services providers and any element of our business we use in order to support you;
- What personal data we collect: We collect personal data directly from users, hosts, co-hosts and management services providers who use our Services. We may also collect personal data from third parties such as Airbnb to provide the Services and government authorities to comply with legal obligations. (see Section 3).
- How we process your personal data: We process your personal data to provide the Services, comply with legal obligations and further our commercial interests. We are not responsible for personal data processing performed by hosts or management services providers.
- How we share your personal data: We mainly share contact details between hosts and management services providers to enable the Services. We also share your personal data with other companies (including within the Airbnb corporate group) for our commercial interests and with government authorities in accordance with our legal obligations (see Section 5).
- How we keep your personal data: We keep your personal data for a maximum of five years (see Section 6).
- How we protect your personal data: We have strong security measures to protect your personal data (see Section 7).
- Where your personal data is processed: We transfer your personal data overseas to service providers and government authorities (see Section 8).
- Your personal data rights: We handle your personal data according to your rights (see Section 9)
Who controls the data?
Us! Luckey SAS is the controller and you are the data subject. Luckey is a simplified joint stock company, registered in the Trades & Companies Register of Paris under the no. 812 226 926, having its registered office at 10 rue de Penthièvre – 75008 Paris.
Any reference to “we”, “us” or “our” is a reference to Luckey. Similarly, any references to “hosts”, “guests”, “management services providers” or “co-hosts” are as described on our website and defined in the Luckey Terms of Service.
You can contact us by email: firstname.lastname@example.org.
What personal data we collect
Personal data is any data that can identify an individual or make an individual identifiable. People can be made identifiable either directly or indirectly by information (an “identifier” or combination of identifiers) which are unique to them at that immediate point in time.
We collect the personal data set out below when you (1) use our websites (including luckey.com, luckey.fr, luckey.es, luckey.ca, luckeyhomes.uk, luckeyhomes.ch and the host interface available at www.airbnb.com/hosting-services) (together referred to as the "Website"); (2) are a host or co-host that uses our Services; or (3) otherwise benefit from our Services, such as when you are a guest in a management services provider managed property.
- Website usage and device information: Your IP address and other device information, operating system, browser, browser settings, username, source of traffic and referrer, security login details including password, app/website settings, dates and times of access, pages selected and visited including third party links, searches, length of visit, data inputted, unique identifiers and other technological information relating to your use of our Website.
- Geo-location information: When certain features of our website are used, we may collect information about your precise or approximate location via your mobile device’s GPS, subject to any disablement of location services you have implemented in your device.
- Account information: In relation to hosts whose listing management services providers manage, host first and last name, phone number, email address, home address, and, where different, billing address, profile picture, nationality, preferred language, age and gender.
- Property information relating to the listing (eg listing number, address, internal surface area, photos, number of bedrooms, number of bathrooms and practical facilities such as access details, internet connection, media services, revenues earned and sums charged).
- Booking information: Details of previous, current and upcoming bookings, including details of relevant host, property and guest for each booking, and the practical activities relating to managing the property before and after the stay.
- Communications: the contents and associated details of all communications between us and you.
- Cookies and similar technology: any information placed on your device (including cookies, mobile identifiers, tracking URLs, log data and similar technologies)
How we process your personal data
We are required by law to have a specified GDPR legal basis for each purpose for processing your personal data. We use the following legal bases:
- Contractual Necessity: Processing which is necessary in order to perform the Services or fulfil contractual obligations.
- Legitimate Interest: Processing which is necessary for our identified legitimate business interests or the interests of others.
- Legal Obligation: Processing which we must carry out in order to comply with a legal obligation to which we are subject.
- Consent: Processing which we have explained to you and you have subsequently affirmatively consented to.
- Vital Interest: Processing which is necessary to protect anyone’s health, physical integrity or life. We do not collect or process health-related data but we may need to process personal data we collect to protect someone’s health.
- Public Interest: Processing which is necessary to support government or public authorities as provided for in law, such as in order to cooperate with tax authorities or short term rental legislation in your jurisdiction.
Hosts who invite a management services provider to manage their listing authorize the management services provider to act on their behalf and we are not responsible for any related personal data processing.
We process your personal data for the following purposes:
Providing our Services to users, including use of our website and improving and developing our website using analytics.
We have a legitimate interest in processing personal data about users to ensure the effective operation of our website.
We set cookies on your device when you access our Website to allow us to recognize you when you return, help us provide a customized experience, analyse use of our website, improve marketing and advertising and enable us to detect certain kinds of fraud. We may also allow analytics providers and social media platforms, such as Facebook, to set cookies. Cookies are set with your consent, unless they are strictly necessary for the operation of our Website.
Providing our Services to hosts, managing host profiles, performing financial transactions and sharing your personal data with applicable service providers as necessary.
Hosts have agreed to the Host Agreement which forms the contract between you and us and the information we collect is the minimum necessary to allow us to comply with and perform our obligations under that contract. Without it, we will not be able to provide you with all the requested Services in the way envisaged by the agreement.
Supporting hosts and management services providers manage host listings, including sending account notifications, supporting check-ins/checkouts, supporting management services providers access listings, security alerts and accommodation reviews.
We have a legitimate interest in enabling management services providers to provide services agreed with hosts as our Services are linked.
Communicating with hosts, co-hosts and management services providers in relation to any booking/listing, including resolving complaints and responding to you when you contact us.
If you are a host, co-host or management services provider, we have a legitimate interest in being able to provide you with customer service through prompt and effective communications which are accurate and appropriate.
Providing advertising and marketing material to current, past and prospective hosts; maintaining the necessary contact information to do so; monitoring its results and improving as appropriate.
We have a legitimate interest in identifying prospective Luckey customers and contacting them.
We send hosts direct marketing. You may withdraw your consent or object to such communications at any time.
Informing hosts about potential management services providers
We have a legitimate interest in informing hosts who are Luckey customers about management services providers who could help them manage their listing.
Disclosing hosts’ contact details to management services providers to enable the Services
Hosts have agreed to the Host Agreement permitting Luckey to disclose hosts’ contact details to management services providers to enable the Services under that contract.
Preparing statistics regarding use of our Services where those statistics use personal data rather than anonymous or aggregate data.
We have a legitimate interest in understanding, researching, analysing and improving the level, frequency and type of use of our Services.
Complying with our legal and regulatory obligations or requests
We are subject to various legal obligations which require us to share specific elements of your personal data with regulatory or legal bodies such as local councils, national governmental departments, regulatory bodies.
Preventing harm or a breach of the law, combating crime and protecting the health and safety of Users and our staff
We are subject to various legal obligations which require us to share specific elements of your personal data with law enforcement bodies to combat crime or prevent harm.
Where there is no legal obligation to share data with law enforcement bodies, we may conclude that it is in our legitimate interests, others’ interests, people’s vital interests or the public interest to disclose personal data to law enforcement to protect people.
Protecting our own rights and interests or those of our Users, staff and customers, including enforcing or defending legal rights, claims, or obligations, or preventing loss or damage
We may conclude that it is in our legitimate interests, others’ interests, people’s vital interests or the public interest to process your personal data to protect our rights and interests.
How we share your personal data
5.1 Sharing between Luckey and other Users: We share contact details between hosts, co-hosts and management services providers to enable the Services.
5.2 Other companies have limited access to your personal data as necessary to provide their services or where it is in our legitimate interests to provide such access. They fall into the following categories:
1. Advisors responsible for overseeing our day to day operations (eg, our lawyers, accountants and auditors);
2. Service providers in the following categories:
- Payment providers;
- Data hosting providers;
- Providers of customer and user relationship management software;
- Internal and external communication and knowledge hosting providers;
- Data security support; and
- Vendors that assist us with marketing and advertising;
3. Management services providers with whom hosts work in order to execute day-to-day operations (including subcontractors working on behalf of management services providers); and
4. The Airbnb corporate group for the purpose of technological support and where it is in our commercial interests to do so.
5. Other third parties if we are involved in any merger, acquisition, reorganisation, sale of assets, bankruptcy or other insolvency, or in contemplation of any of the previous listed events, eg, due diligence. We will notify you in advance of this occurring.
5.3 Government authorities in accordance with law
We may disclose your personal data to government authorities (including courts, law enforcement, tax authorities, local councils or authorized third parties) where we are required or permitted to do so by law.
We may also disclose personal data where is necessary for any of the reasons below on condition that it fulfils a specified GDPR legal basis (including legitimate interest, public interest, legal obligation, vital interest).
- Comply with a valid legal request in civil or criminal matters
- Combat suspected crime or any activity that may expose us or our Users to legal liability
- Enforce and administer our Host Agreement
- Protect the rights, property, personal safety or interests of Luckey, its staff, its Users or members of the public.
How we keep your personal data
- We retain personal information for as long as needed or permitted in light of the purpose(s) for which it was obtained and consistent with applicable law. This is determined by our legal and regulatory obligations relating to our Services or whether retention is advisable in light of our legal position (such as in regard to applicable statutes of limitations, litigation or regulatory investigations). For example, if you are a host, your personal data is stored for the duration of your registration for our Services and for a period of five years after you cease using our Services.
- We may also retain your personal data for other exceptional purposes that are in our legitimate interest, such as prevention of fraud detection and prevention, enhancing safety, and protection of our business and legal interests (e.g. claims).
How we protect your personal data (Data Security)
We ensure all necessary administrative, organisational, physical and technical measures to help protect your personal data against unauthorized access, loss, destruction or alteration are in place and up to date. We may use other companies to support us in these efforts. Some of the safeguards we use to protect your information include firewalls, encryption and access controls. Luckey staff are only able to access personal data relevant to their role and are under a duty of confidentiality.
Where your personal data is processed
- Your personal data (as set out in Section 3) is mainly processed in France where we are based and the United States of America (US) by our corporate group and other companies (including data hosting providers). Occasionally, it may be necessary to transfer your personal data overseas in support of legal claims.
- The US has not been recognised by the European Commission as providing adequacy protections for personal data and transfers of personal data to the US for operational purposes are allowed using European Commission approved model contracts for the transfer of personal information to third countries (i.e. standard contractual clauses). For a copy of the standard contractual clauses, please contact us via the details provided in the Section 2 above.
- Our colleagues in Canada also have access to personal data. Canada’s local law (the Personal Information Protection and Electronic Documents Act) has been deemed to provide an essentially equivalent or adequate level of data protection by the European Commission. Therefore when we transfer data to Canada, we rely on European Commission adequacy decision for Canada.
- Occasionally, either us or other companies we share data with may be required or permitted to disclose your personal data to overseas government authorities. Such disclosures will always be decided on detailed assessments of the necessity of the disclosure. Where the transfer is not necessary for a legal claim or to protect people’s vital interests or public interests, we may disclose your personal data in accordance with the standard contractual clauses.
Your personal data rights
You have a number of rights under data protection law, including:
Right of access: you may request that we confirm whether or not we process personal data about you and, where we do request access to, or copies of, the personal data we process about you, and information on the nature and purposes of processing and details of data sharing.
Right of or rectification: you have the right to rectify your personal data if it is inaccurate or incomplete.
Right of erasure or restriction: you have the right to request that we delete your information or restrict the processing of your personal data, provided there are valid grounds for doing so.
Right to data portability: in circumstances where we rely on contractual necessity or consent as our legal basis, you have the right to receive your personal data in a machine- readable format from us and to have it transferred to the recipient of your choice
Right to object: Where we process your information based on legitimate interests, public interests, or for direct marketing you can object to this processing. Unless we have compelling legitimate grounds or where it is needed for legal reasons, we will cease processing your information when you object.
Right to withdraw consent: where you have previously provided your consent, you have the right to withdraw consent at any time. However, this will not affect the lawfulness of the processing based on consent before its withdrawal.
Right to leave instructions after your death: if you have exercised this right, we will respect your instructions or those of your nominated individual in accordance with French law.
You can exercise your rights by contacting us at: email@example.com; or 1 bis Cité du Paradis, 75010 Paris. Please provide specific details about the right you wish to exercise and what end result you are seeking. For example, if you would like access to your personal data, please let us know if there is a specific time window you are interested in.
Right to complain: If you are not happy with our response to your exercise of your rights, or any other aspect of the processing of your personal data by us or on our behalf, you have the right to complain to Luckey’s Lead Supervisory Authority, the French data protection authority, CNIL, or to your local data protection authority.
Changes to this Policy
We may fully or partially change this Policy at any time. Any updated Policy will be dated and posted on our Site 30 days before the changes take place.