Pricepoint Privacy Policy

INTRODUCTION

PRICEPOINT provide hotels, hostels, or any other types of hospitality establishments (hereafter “Hospitality establishment”) with a fully automated revenue management system. By using PRICEPOINT applications (hereafter the “Application”), owners of Hospitality establishments can increase both its revenues and occupancy. While the Application can only be used by businesses, business representatives and business owners only, we can collect, use, and communicate “personal information” from the visitors of its website (hereafter the “Visitors”) and from the users of the Application (hereafter the “Users of the Application”. The Application also collects and use Booking data that can be generated by the use of a User’s hospitality establishments by its guests (the “Guests”).

The present policy describes PRICEPOINT collection, use, communication, alteration, retention, and destruction (hereafter the “Processing”) of personal information it receives. It also details the purposes for which the personal information is processed and sets out the policies and practices adopted by PRICEPOINT to ensure the protection of personal information. Finally, it documents the rights of the persons concerned with the personal information regarding the processing of their personal information by PRICEPOINT.

What is “personal information”?

Personal information is any information which relates to a natural person and directly or indirectly allows that person to be identified. Last name, first name, personal telephone number, personal e-mail address, IP address and gender are all examples of personal information.

Person in charge of the protection of personal information

PRICEPOINT is committed to complying with all privacy and processing requirements under the Civil code of Quebec and the Act respecting the protection of personal information in the private sector.

PRICEPOINT has appointed a person in charge of the protection of personal information. The latter has many responsibilities, including:

• Ensuring the effective application of PRICEPOINT’s security measures
• Ensuring compliance of our policies and governance practices with respect to the handling and protection of personal information under the Act; and
• Responding to requests from individuals with respect to personal information, such as requests for access, destruction, or rectification of personal information.

If you have any questions about our governance or our processing of personal information, you may contact our person in charge of the protection of personal information by e-mail at [email protected]

PROCESSING OF PERSONAL INFORMATION

A.         Personal information collected from Visitors

Three types of personal information are collected from Visitors:

1. personal information collected automatically;
2. personal contact information; and
3. personal information collected by third-party cookies and pixels.

1.         Personal information collected from Visitors automatically

i.    What personal information is collected?

The purposes of the personal information mentioned below, PRICEPOINT may collect the following personal information from Visitors:

• the domain name of their Internet service provider;
• the IP address;
• their browser (Explorer, Firefox, etc.) and operating system (Windows, Mac OS, etc.);
• the date and time of their visit;
• the pages they visit and the time they spend there;
• visitors consent toward certain collection and use of personal information; and
• the address of the referring site.

ii.   How is personal information collected?

The above-mentioned personal information is collected automatically when Visitors access the Website.

Some of this personal information is also collected through the placement of temporary cookies owned by PRICEPOINT. The information collected from cookies allows us to improve the performance of the Website and some of its features by performing the purposes mentioned below.

iii.  For what purposes?

This personal information is mainly collected, stored, and used for technical and statistical purposes.

Their main purpose is to ensure that the Visitors can connect to the website and that the Website can function as was intended by PRICEPOINT.

This personal information is also used to count the number of visits to the various pages to identify the most frequented visited pages. It also aims to identify which technologies are used by our Visitors to access the website and to identify the referring sites to the website.

They also serve to register statistical data on Visitors’ behaviour on the Website.

All these purposes are ultimately aimed at:

• improving the performance of the website and ensuring the functionality of its features;
• analyse the general behaviour of Visitors using the Website (for example: to know what are our most popular website pages); and
• evaluating the effectiveness of PRICEPOINT’s efforts to acquire Visitors and Users for the Application.

2.         Personal contact information

i.    What personal information is collected?

A company that desires to contact PRICEPOINT to receive a trial, to inquire about PRICEPOINT’s services (the “Services”) or to receive commercial offers from PRICEPOINT can contact PRICEPOINT by filling in this form https://share.hsforms.com/1PBI1WdaFSfy9wFvisw3Idw54iwy.  To fill in this form, the owner or employee of the company will be asked to enter some information, namely his or her:

• first name and last name;
• work email;
• work phone number;
• property name; and
• property country.

ii.   How is personal information collected?

The personal information is collected directly from Visitors who provide the above information to us by completing an electronic form.

iii.  For what purposes?

The personal information is collected and used mainly for communication and marketing purposes. They aim to:

• create more comfortable and personalized communications with Visitors;
• identify the Visitor preferred language;
• choose an appropriate license for a Visitor (based on the country of location); and
• contact the Visitors to inform them of our products and services or to offer them a trial.

3.         Personal information collected by third-party “cookies.”

PRICEPOINT also allows third parties to collect information with cookies or pixels. The collected information might constitute personal information.

i.    Warning: collection of personal information allowing the person concerned to be identified, located, or profiled

Some of these third party collect personal information by using technology that includes functions allowing the person concerned to be identified, located, or profiled. Such technology can be activated by allowing the collection of personal information for these purposes in the pop-up that asked for visitors consent at their entry of the Website or by consenting to their activation in the page “Preferences”.

ii.   Main purposes

These third parties mainly collect personal information to:

• Identify visitors;
• Ensure the security of the Website;
• Conduct diagnostics or use the data for analytic and research purposes;
• Offer advertisements and sending targeted advertisements to Visitors; and
• Providing personalized services, content, and ads to Visitors.

iii.  For a full list of purposes

The table below identifies all the organizations using third-party cookies and pixels that PRICEPOINT allows on its Website. The table also provides links to these companies’ privacy policies and relevant documentation.

Table 1: List of third-party cookies and documentation

Links to other Websites

The website sometimes provides links to other websites owned by other organizations. When you visit those websites, you will not be subject to this Privacy Policy, but to the one of the external websites if it has one.

B. Personal information collected from Users of the Application

i.    What personal information is collected?

Users of the Application are required to communication some information (some of which is or might be personal information) to PRICEPOINT namely:

• first and last name;
• work email address;
• work phone number;
• property name;
• address of the hospitality establishment; and
• IP address.

ii.   How is personal information collected?

Most of this information is provided directly by a User of the Application in an electronic form when it is asked to enter its account profile details during its first login.

However, the IP address is collected automatically once a User of the Application provides its profile details.

The information related to the business bank account is provided directly by the User of the Application who must provide these details to use PRICEPOINT Application and Services. These details will likely be collected at the end of PRICEPOINT trial period.

iii.  For what purposes?

This information is collected and used by PRICEPOINT to ensure:

• that PRICEPOINT can communicate with the Users of the Application;
• that PRICEPOINT can deliver the Services; and
• that the Users of the Application pay PRICEPOINT for its Services and use of the Application.

C.         What personal information PRICEPOINT collects as Booking Data

i.    What information is collected?

PRICEPOINT also collects Booking data from hospitality establishments through the use of the Application’s by its Users. The information collected is:

• the check-in date of the Guests;
• the check-out date of the Guests;
• which room they rented;
• how many Guests were in the room;
• their nationality;
• the amount they paid ;
• their booking method (e.g. website used to book the services, by phone…);
• the purpose of their trip;
• the date of their booking; and
• whether or not they were part of a group.

Any Booking data collected that could constitute personal information is de-identified by PRICEPOINT. This means that the information collected does not allow to directly identify the person it concerns. Moreover, no Booking data that would constitute personal information is stored in PRICEPOINT’s database.

ii.   How is personal information collected?

All this information is provided by the Users of the Application. The User of the Application communicate this information automatically through their software connected to the Application (for example their Hospitality establishment Property Management System (hereafter “PMS”) or Channel management system software (hereafter “CM”)).

iii.  For what purposes?

Booking data is used by PRICEPOINT to generate price recommendations to its Users and to track demand patterns.

COMMON PURPOSES OF VISITORS and USERS PERSONAL INFORMATION AND OF THE BOOKING DATA

PRICEPOINT may need to use and communicate personal information to ensure its compliance with the Law, a court order, or a legal process.

PRICEPOINT may also use and communicate personal information to ensure its own legal protection in the event of:

• a dispute caused by the action or inaction of a Visitor or a User of the Application that is detrimental or potentially detrimental to PRICEPOINT,
• a violation of PRICEPOINT Terms and conditions by a User or Visitor; or
• in the event of a dispute between a Visitor or User with PRICEPOINT.

The personal information may also be shared with public authorities, computer service providers or cybersecurity providers to be used to evaluate and improve safety and security measures or to prevent or detect fraud.

In addition, personal information may be accessed, used, or rectified to respond to complaints, requests for access or rectification of personal information in or withdrawal of consent in accordance with the procedures set out below. If an applicant has the right to access or rectify his or her personal information or withdraw its consent to the use or communication of personal information, PRICEPOINT will have to use, rectify, or communicate the applicant information to both authenticate the applicant and to comply with his or her request.

Communication and transfer of personal information

To fulfill the purposes of the personal information PRICEPOINT communicate or transfer the personal information of Users of the Application and Visitors to multiple entities.

A.         Communication of Visitors personal information by third-party cookies

By using the Website, Visitors consent that their personal information will be sent through the use of third-party cookies to the following entities for the purposes identified in the above-mentioned Table 1: List of third-part cookies and documentation. The Visitors understand and consent that the information collected by these entities will be send beyond Quebec borders.

• HubSpot
• Google
• Google DoubleClick
• LinkedIn
• Microsoft (Bing)
• Meta (Facebook)

B.   Communication of Users of the Application personal information

By using the Application, Users of the Application consent that their personal information will be sent to the following entities:

• HubSpot whose Privacy policy can be read here (https://legal.hubspot.com/privacy-policy).
• HubSpot stores the personal information of Visitors on secure servers outside of Quebec.

C.         Communication for both Visitors and User of the Application

PRICEPOINT mostly communicate Visitors’ personal information to a service provider, agent, or company if such communication is necessary for the performance of a mandate or the execution of a service or business contract that it entrusts to that person or organization. By « necessary », we mean technical necessity. PRICEPOINT thus share information to service providers, cloud service providers, database providers and server providers.

For this reason, all Visitors and Users of the Application must understand and consent that their personal information will be communicated to the entities and purposes mentioned below.

The Visitors and Users of the Application must understand and consent that the information collected by these entities can be sent beyond Quebec borders.

Limits on communication and use of personal information by PRICEPOINT

The personal information collected is destroyed or anonymized upon completion of the purpose for which it was collected unless, of course, the Law requires PRICEPOINT to retain them.

Security of personal information

We have put in place appropriate and reasonable physical, organizational, contractual, and technological safeguards to protect personal information against loss, theft, and unauthorized access, disclosure, copying, use or modification. PRICEPOINT use multiple governance practices and policies to protect personal information. Indeed, PRICEPOINT provides for, among other things:

• an internal access management policy for employees of PRICEPOINT which restricts access to personal information. Under this policy, members of our staff are only required access to personal information if this access is necessary to perform their duties;
• internal privacy procedures for PRICEPOINT to ensure that personal information is not monitored, overheard, intercepted, accessed, lost or used for purposes other than those identified above while working at or off the premises of PRICEPOINT;
• a registry of confidentiality incidents which helps PRICEPOINT records any problems, minor or major, that may affect your personal information to ensure that they do not recur;
• a retention schedule to ensure that personal information is destroyed when it is no longer required for the purposes identified above and when its retention is no longer required by the Law;
• a confidentiality incident response plan, which enables PRICEPOINT to respond effectively and quickly to breaches affecting your personal information;
• logs of access to your personal information; and
• annual training sessions for its staff to ensure that they adopt good privacy practice.

Moreover, the person in charge of the protection of personal information of Users of the Application will be notified without delay of any violation or attempted violation of any obligation concerning the confidentiality of any Booking data. Following such an incident, we will allow the person in charge of the protection of personal information of Users of the Application to conduct any verification relating to confidentiality requirements.

Despite these various measures, it is still impossible for PRICEPOINT to guarantee the security of personal information entrusted to it. Therefore, if you suspect that your personal information held by PRICEPOINT has been compromised, please notify our Person in charge of the protection of personal information immediately at this email [email protected].

Rights related to PERSONAL INFORMATION

A.   Right of access to personal information

Any person concerned with the personal information held by PRICEPOINT may make a request to access his or her personal information. This means that it can request us to confirm the existence of the of the personal information, to communicate it to him or her and to obtain a copy of it. Any request for access to personal information is made by contacting our person in charge of the protection of personal information in accordance with the law and procedure set out below. The person in charge of the protection of personal information will grant such access to personal information unless we are prevented from doing so by law, have a substantial and legitimate interest in denying access, or if granting access would seriously harm a third party.

B.   Right to rectify personal information

Any person concerned with the personal information held by PRICEPOINT can request to rectify his or her personal information. This request will be granted under certain circumstances including:

• the personal information is inaccurate;
• the personal information is obsolete;
• the personal information is equivocal;
• the personal information is incomplete; or
• the collection of personal information was unjustified.

Alternatively, any person concerned with the personal information held by PRICEPOINT may request to destroy any personal information collected unjustly. They can also ask to deposit their written comments.

Any request for destruction or rectification must be made in writing to our Person in charge of the protection of personal information in accordance with the procedure set out below.

C.   Right to withdraw consent

Finally, person concerned with the personal information may withdraw their consent to certain uses and to certain communication of their personal information by PRICEPOINT in some specific circumstances. Please note that exercising this right may affect the Services provided by PRICEPOINT to the applicant. In the event of such a request, PRICEPOINT will contact you to explain if and how your choice will affect the quality of the Services.

Procedure for making a request for access, rectification, or withdrawal of consent.

All requests for access, correction or deletion must be made in writing to our Person in charge of the protection of personal information. An applicant may contact him by sending an email to [email protected].

An applicant will have to establish his or her identity as the physical person to whom the personal information relates or as a person authorized by law to make the request. The request must be sufficiently detailed to allow our person in charge of the protection of personal information to evaluate and identify the personal information concerned by the request. In particular, the applicant must ensure that our person in charge of the protection of personal information is able to contact him or her to assist in clarifying the request or identifying the Personal Information targeted by his or her request. Our person in charge of the protection of personal information has a duty to process these requests within a maximum of 30 days of receipt at the latest of those two dates: PRICEPOINT reception of the request or the authentication of the applicant identity as the person concerned by the personal information. If the request is not processed within this time frame, the applicant must deem it to have been denied.

If your request is denied, you may contact the Commission d’accès à l’information du Québec using the appropriate forms available at this address www.cai.gouv.qc.ca/diffusion-de-linformation/services-et-formulaires/.

Complaint procedure

You may make a complaint about our privacy practices, policies, and procedures by contacting our person in charge of the protection of personal information to evaluate and identify the Personal Information directly at [email protected].

The person in charge of the protection of personal information will make every reasonable effort to resolve the complaints. The person making the complaint will be informed of the outcome of the investigation within a maximum of 30 days of receipt of the request or the additional time required to complete the investigation.

If you are not satisfied with the handling of your complaint, you may also contact the Commission d’accès à l’information du Québec. A written complaint can be filed with the Commission by visiting the following page: www.cai.gouv.qc.ca/diffusion-de-
linformation/services-et-formulaires/.

CHANGES TO OUR PRIVACY POLICY

We may change this Privacy Policy. Before implementing the changes, however, we will post a notice on our website notifying Visitors and Users of the Application of the upcoming changes. Visitors and Users will also receive a similar notice by email provided, of course, that we possess their email address.

For this reason, it is the responsibility of every Visitors and Users of the Application to ensure that the email address provided is functional, current, and active. We also ask our Visitors and Users of the Application to review this Policy from time to time to ensure that its contents have not changed. To facilitate this process, the date of the last revision is available at the end of this policy.

Montreal, 23rd January 2024