- Who controls the data?
- What personal data is collected by Luckey?
- The use of your personal data
- Recipients and sharing of the collected data
- Personal data retention
- International Transfer
- Your rights
By using or continuing to use our Services on or after this date you are acknowledging the updated Policy and that your use of the Services will be subject to this updated and revised Policy.
Protecting your personal data is extremely important to us.
You can rest assured that when collecting and managing your data, we conduct ourselves in compliance with both the "Informatique et Libertés" law of 1978 (the French Data Protection Act) and the European General Data Protection Regulation 2016 (GDPR), as well as all other applicable data protection law and regulation.
- We, Luckey SAS (“Luckey”), are the data controller making decisions about and processing your personal data. We are based in France (see Question 2 for more details);
- When we refer to “Users” in this Policy, we mean any User or recipient of our website, app or Services, including current, prospective and former hosts, guests and individuals browsing our site/app with or without registration for our Services;
- When we refer to “Services” in this Policy, we mean any and all aspects of our website and our mobile app available to you for your use as a User and any element of our business we use in order to support your connection to us. This could be online (eg, the website) or offline (eg, if you are a host, when we co-ordinate staff to offer you a welcoming service, or if you are a guest, you participate in communications such as SMS with the host through Luckey);
- Luckey collects personal data directly from you and via automatic transfer from third parties for the purposes of managing you as a User and providing you with appropriate Services relating to property rental. We also carry out marketing to current, past and prospective hosts (see Question 3 and Question 4 for more information on the data we collect and the processing we conduct);
- Luckey shares your personal data with its staff who provide our Services, together with other contractors who support us. Where we are legally obliged to do so, we share the data accordingly. To the extent necessary, Luckey also shares some personal data within its corporate group, Airbnb. See Question 5 for more information;
- Luckey retains your data for a maximum of five years (see Question 6 for more information);
- Luckey has various structures in place to protect and manage your data (see Question 7 for more information);
- Luckey does transfer your personal data overseas, but only to sub-contractors who are certified under the Privacy Shield or to group affiliates based in countries with equivalent levels of data protection law (see Question 8 for more information);
- You have a number of rights regarding your personal data which Luckey respects and with which it complies (see Question 10 for more information).
2. Who controls the data?
LUCKEY is the data controller and you are the data subject, as those terms are defined in the GDPR. Luckey is a simplified joint stock company, registered in the Trades & Companies Register of Paris under the no. 812 226 926, having its registered office at 10 rue de Penthièvre – 75008 Paris. Any reference to “we”, “us” or “our” is a reference to Luckey. We are responsible for all processing of your personal data relating to our business as described in this Policy.
You can contact us by email: firstname.lastname@example.org; and telephone: (+33) 6 44 60 20 21.
We are regulated by the French data protection authority, the Commission Nationale de l'Informatique et des Libertés (“CNIL”). The CNIL can be contacted by telephone on (+33) 1 53 73 22 22.
3. What personal data is collected by Luckey?
Personal data is any data that can identify an individual or make an individual identifiable. People can be made identifiable either directly or indirectly by information (an “identifier” or combination of identifiers) which are unique to them at that immediate point in time.
While you are using our websites (including luckey.com, luckey.app, luckey.fr, luckey.es, luckey.ca, luckeyhomes.uk, luckeyhomes.ch, luckey.family) or our mobile application (together referred to as the "Website") and otherwise benefitting from our Services, we may (1) ask you to provide; (2) automatically collect from connected third parties such as the booking platform; or (3) otherwise gather (eg from our Website) categories of personal data for the purposes of processing listed in Section 4 below. These personal data are:
- Website usage and device information: Your IP address and other device information, operating system, browser, browser settings, username, source of traffic and referrer, security login details including password, app/website settings, dates and times of access, pages selected and visited including third party links, searches, length of visit, data inputted, unique identifiers and other technological information relating to your use of our Website;
- Geo-location Information. When certain features of our Website are used, we may collect information about your precise or approximate location via your mobile device’s GPS, subject to any disablement of location services you have implemented in your device;
- Account information: Your first and last name, phone number, email address, home address and, where different, billing address, profile picture, nationality, preferred language, age, gender, and, in relation to hosts, an identification video and/or proof of identity such as your passport. You may also volunteer other information about yourself which we record and then make publicly available, such as a personal description. Any of the information relating to you as an individual could be used to build a profile from these characteristics and similar identifiers;
- Financial information including bank account details (including IBAN), social security number where required and information relating to transactions connected to individual bookings including the payment instrument used, date and time, payment/billing amount, payment instrument expiration date and billing postcode, PayPal or equivalent email address and other related transaction details;
- Property information relating to the rental accommodation (eg identification number, address, internal surface area, photos, number of bedrooms, number of bathrooms and practical facilities such as access details, internet connection, media services, revenues earned and sums charged);
- Booking information: details of previous, current and upcoming bookings, including details of relevant host, property and guest for each booking, any questions relating to the property from the guest and subsequent answers from the hosts as applicable either ahead of the stay, during or afterwards, and the practical activities relating to managing the property before and after the stay;
- Communications: the contents and associated details of all communications between us and you;
- Cookies and similar technology: please see Question 9.
Luckey’s Services are not directed at children under 18 and we do not knowingly collect any personal information directly from children under 18. If you believe that we are processing such personal information, we will be extremely concerned and urge you to contact us using the information provided in section 2 above.
4. The use of your personal data
We use the different categories of personal data listed above for various different purposes. We are required by law to have a specified legal ground for each of those purposes. We use the four most common legal grounds (there are 6 set out in the law):
- Contract: Processing which is the minimum necessary in order to perform the services we promised to you when you entered into a contract with us.
- Legitimate Interest: Processing which is the minimum necessary for our identified legitimate business interests.
- Legal Obligation: Processing which we must carry out in order to comply with a legal obligation to which we are subject.
- Consent: Processing which we have explained to you and you have subsequently agreed or consented to.
Purpose / Service
Managing your access to and use of our Services, most of which are available via our Website, including improving and developing our Services and that Website. This includes processing any data relating to financial transactions and sharing your data with applicable third party service providers as necessary.
If you are a host, you have agreed to the Host Agreement which forms the contract between you and us and the information we collect is the minimum necessary to allow us to comply with our obligations under that contract. Without it, we may not be able to provide you with all the requested Services.
We also have a legitimate business interest to maintain, manage and improve the Website and our Services through the processing of the necessary personal data for our Users (hosts, guests and prospective hosts and guests). In relation to our Services in particular, this includes the necessary processing of financial personal data, such as that necessary to process payments and to comply with our anti-money laundering obligations to verify your identity.
If you volunteer personal data about yourself, then this is processed on the grounds of consent.
Communicating with you in relation to any booking / rental, including managing opinions of the Services
If you are a host, you have agreed to the Host Agreement which forms the contract between you and us.
If you are a host or a guest, we have a legitimate business interest of being able to provide you with customer service through prompt and effective communications which are accurate and appropriate.
Creating a database of Users, including prospective, current and previous hosts and guests
We have a legitimate business interest in building and maintaining an accurate and up to date record of Users and recipients of our Services, including to ensure those individuals are receiving an effective and useful service.
Preparing statistics regarding use of our Services where those statistics use personal data rather than anonymous or aggregate data.
We have a legitimate business interest in understanding, researching, analysing and improving the level, frequency and type of use of our Services.
Providing advertising and marketing material to current, past and prospective hosts; maintaining the necessary contact information to do so; monitoring its results and improving as appropriate.
We have a legitimate business interest in undertaking marketing activities to offer you products or services that may be in the interests of any of our Users.
You have choices regarding receipt of our promotional messages. You can limit the information you provide to us and participation in promotions and marketing programs is voluntary. You can limit the communications that Luckey sends to you. Please see below after this table.
Complying with our legal and regulatory obligations including where our processing is required for the establishment, exercise or defence of legal claims.
We are subject to various legal obligations which require us to share (sharing is an example of processing) specific elements of your personal data with regulatory or legal bodies such as local councils, national governmental departments, regulatory bodies etc.
If you do not want to receive marketing material, please take the following steps:
- To opt-out of marketing emails, simply click the link labeled “unsubscribe” at the bottom of any marketing email we send you or access the notification settings in your Airbnb Account.
- To revoke permissions that you may have given to send promotional text messages, text STOP in response to any message.
Please be aware that you may, at any time, refuse to supply us with your data. We will then inform you of any possible consequences this refusal may have and when the provision of such data is mandatory. Please be aware that there are some laws that require us to retain your data for some time after you choose to leave us (see Section 6 below).
5. Recipients and sharing of your personal data
5.1 Sharing between Luckey and other Users
We may share your information with other Users to make sure you are receiving the Service you expect from us. For example:
- If you are a guest, certain limited information will be shared with the host of the property you have booked and the contractors and subcontractors who support that host and the practicalities of your stay. This includes your name, profile picture, language, travel dates, check-in/out plans and any other information you have volunteered.
- If you are a host and you have a confirmed booking, certain limited information will be shared with the guest about you and the property to facilitate the booking, including your profile, full name, and practical details of accessing and the contents of the property.
We do not share your billing / payment details with any other Users.
Please be aware that we will not share your profile or your reviews on our public websites or app. If you volunteer this information, we expect it will be via third parties such as your applicable booking platform.
5.2 Service providers (processors)
Our service providers have limited access to your personal data as necessary to provide their services on our behalf. They fall into the following categories:
- The advisors responsible for overseeing our day to day operations (eg, our lawyers, accountants and auditors);
- Our contractors and subcontractors in the following categories:
- Payment providers;
- Data hosting providers;
- Providers of customer and user relationship management software;
- Internal and external communication and knowledge hosting providers; and
- Data security support;
- Partners with whom we work in order to execute our day-to-day operations (e.g. city managers, welcomers, cleaning services, debt collectors);
- Public authorities and related officials with a legal right of access; and
- The Airbnb group companies for the purpose of technological support.
We may also share your personal data with third parties if we are involved in any merger, acquisition, reorganisation, sale of assets, bankruptcy or other insolvency, or in contemplation of any of the previous listed events, eg, due diligence.
5.3 Compliance with the Law, Responding to Legal Requests, Preventing Harm and Protection of our Rights
We may disclose your information, including personal information, to courts, law enforcement, governmental authorities, tax authorities, or authorized third parties, if and to the extent we are required or permitted to do so by law or if such disclosure is reasonably necessary for any of the following reasons:
(i) to comply with our legal obligations;
(ii) to comply with a valid legal request or to respond to claims asserted against us;
(iii) to respond to a valid legal request relating to a criminal investigation or alleged or suspected illegal activity or any other activity that may expose us, you, or any other of our Users to legal liability;
(iv) to enforce and administer our Agreements or Terms of Service; or
(v) to protect the rights, property or personal safety of Luckey, its staff, its Users or members of the public.
For example, if permitted based on any of the above factors, host tax information may be shared with tax authorities or other governmental agencies.
These disclosures may be necessary to comply with our legal obligations, for the protection of your or another person's vital interests or for the purposes of our legitimate business interest in keeping all aspects of out Services secure, preventing harm or crime, enforcing or defending legal rights, facilitating the collection of taxes and prevention of tax fraud or preventing damage.
Where appropriate, we may notify you about legal requests unless:
(i) providing notice is prohibited by the legal process itself, by court order we receive or by applicable law, or
(ii) we believe that providing notice would be futile, ineffective, create a risk of injury or bodily harm to an individual or group, or create or increase a risk of fraud.
In instances where we comply with legal requests without notice for these reasons, we may attempt to notify you about the request after the fact where appropriate and where we determine in good faith that we are no longer prevented from doing so.
6. Personal data retention
If you are a host, your data is stored for the whole duration of your registration for our Services and for a period of five years from the date you de-registered. This is determined by our legal and regulatory obligations relating to our Services.
If you are a host or a prospective host, we will continue to market to you for three (3) years from the date you de-registered. At the end of the three year period, we will contact you again to find out if you wish to continue receiving marketing communications from us. As explained above, you can unsubscribe from such marketing communications at any time by contacting us and letting us know.
If you are a guest, your data is stored for the whole of the duration of your booking with us, and for a period of three (3) months after your most recent booking.
We (and our contractors) have implemented and continue to implement and update all necessary administrative, organisational, physical and technical measures to help protect your personal data against unauthorized access, loss, destruction or alteration. Some of the safeguards we use to protect your information include firewalls, encryption and access controls.
If you know or have reason to believe that your Luckey account credentials have been lost, stolen, misappropriated or otherwise compromised or in case of any actual or suspected unauthorized use of your Luckey account, please contact us following the instructions in Section 2 above.
8. International Transfer
Whilst we are a French company, we use third parties to support our operations as explained above.
In particular, your personal data may be processed in the United States (US) by our corporate group and by our third party processors. These processors acting on our behalf are self-certified under the "Privacy Shield". This is a structure agreed between the US and the European Union under which European data controllers are allowed to transfer personal data to and instruct US processors to act on the controller’s behalf, provided those processors certify that they are compliant with the Shield’s privacy principles (see European Commission decision of 12 July, 2016). For further information, please visit the Privacy Shield website.
Our colleagues in Canada also have access to personal data. Canada’s local law (the Personal Information Protection and Electronic Documents Act) has been deemed to provide an essentially equivalent or adequate level of data protection by the European Commission.
Cookies are text files, often encrypted, which are transferred and stored on your computer or smartphone when you visit a website or use an app. They allow the website or app to operate more effectively both technically and from a business perspective.
We use two different types of cookies for various purposes:
- Session cookies, which normally expire when you close your browser; and
- Persistent cookies, which remain on your device after you close your browser or app, and can be used again the next time you access our Website.
We also use other technologies with similar functionality to cookies, such as web beacons, pixels, mobile identifiers and tracking. This technology allows us to recognize you when you return. They also help us provide a customized experience and can enable us to detect certain kinds of fraud.
We also allow cookies and similar technologies from third parties, including analytics providers and social media platforms, including Facebook. This helps us analyse use of our Website, improve our marketing and advertising and reduce risk. For example, to help us better understand how people use our Website and approximately where those Users are based, we work with a number of analytics partners, including Google Analytics. To prevent Google Analytics from using your information for analytics, you may install the Google Analytics Opt-Out Browser by clicking here.
Also, third parties cookie and tech providers may use tracking technologies to serve ads that they believe are most likely to be of interest to you and measure the effectiveness of their ads both on our Website and on other websites and online services. Targeting and advertising cookies we use may include Google, and other advertising networks and services we use from time to time.
For more information about targeting and advertising cookies and how you can opt out, you can visit the Network Advertising Initiative’s opt-out page, the Digital Advertising Alliance’s opt-out page, or http://youronlinechoices.eu. To opt out of Google Analytics for display advertising or customize Google display network ads, you can visit the Google Ads Settings page.
To the extent advertising technology is integrated into our Website and you opt-out of tailored advertising, you may still receive advertising content. In that case, the advertising content will just not be tailored to your interests. Also, we do not control any of the opt-out functionality described above and are not responsible for the availability or accuracy of these mechanisms.
We may use social plugins provided and operated by third parties, including Facebook’s Like Button. As a result of using this sort of third party functionality, you may send information about your interactions with our Website to the third party. That third party may be able to link that information to your account with them. Please refer to the third party’s privacy policies to learn more about its data practices, including how they would use such information.
10. Your rights
You have a number of rights under the privacy laws, including:
The right of access: you may request from us access to, or copies of, the personal data we process about you, including the nature and purposes of processing and details of data sharing.
The right of rectification: you have the right to rectify your personal data that we hold at any time if it is inaccurate or incomplete.
The right of erasure: you have the right to erase your personal data held by us in certain circumstances.
The right to restriction of processing: you have the right to obtain the restriction of processing of your personal data by us in certain circumstances.
The right to data portability: You have the right to receive your personal data in a readable format from us and to demand its transfer to the recipient of your choice.
The right to object: you have the right to object to processing by us in certain circumstances, including where the processing is for direct marketing purposes.
The right not to be subject to a decision based solely on automated processing, where that processing results in a legal consequences for you or otherwise significantly affects you. Please be aware that Luckey does not carry out any automated decision making.
Right to leave instructions after your death: if you have exercised this right, we will respect your instructions or those of your nominated individual in accordance with French law.
You may exercise the above-mentioned rights by writing to us, either electronically at email@example.com or in hard copy at 1 bis Cité du Paradis, 75010 Paris. When contacting us, please supply a copy of a valid, signed identification document and provide specific details about the right you wish to exercise and what end result you are seeking. For example, if you would like access to your data, please let us know if there is a specific time window you are interested in.
If you are not happy with our response to your exercise of your rights, or any other aspect of the processing of your personal data by us or on our behalf, you can complain to the French data protection authority, the CNIL. The CNIL’s details are set out at Section 2 above.
11. Modifications to this Policy