Privacy Policy

This policy applies to the public ACL Voice website, contact and demonstration pages, the creation and use of professional accounts, and the provision of the voice receptionist service, including the processing of information collected or communicated during telephone calls from the hotel’s guests or customers.

It does not apply to processing carried out exclusively by the hotel, its property-management system (PMS) or other tools it controls outside the ACL Voice platform, nor to third-party websites that may be linked from the site.

The entity originating the processing described in this policy is:

• Legal name: ACL GESTION
• Registered office: 22 Avenue de Châlons, 93150 Le Blanc-Mesnil, France
• SIREN: 845 388 222
• EU VAT number: FR59845388222
• Contact: contact.voice@acl-gestion.com — Tel. +33 1 89 31 03 41

ACL Voice’s exact role (controller, processor, or joint controller) may vary according to the nature of the processing, the contract concluded with the hotel customer and documented instructions. In particular:

• ACL Voice may act as a controller for data relating to the operation of its website, B2B prospecting, platform user accounts, billing, security and the improvement of its own services, to the extent that ACL Voice determines those processing operations.
• ACL Voice may act as a processor on behalf of the hotel customer when it processes caller data, hotel-guest data, reservation data or other hotel-operations data in order to provide the voice receptionist service, in accordance with the customer’s instructions.
• The hotel customer may act as a controller in respect of data relating to its guests, prospects, staff and callers, where it determines the purposes and means of that processing.

This document does not establish a single, definitive role for all processing operations. Contractual roles are set out, where applicable, in the Data Processing Agreement and the commercial contract.

Depending on the features used, ACL Voice may process some or all of the following categories. The data actually collected depends on what the user, the hotel or the caller communicates, on account settings and on enabled integrations.

Data may be processed for the following purposes, depending on the context:

• To provide, operate and maintain the website and the SaaS platform.
• To create and administer professional accounts, roles and access.
• To answer the hotel’s calls by means of an AI-assisted voice receptionist.
• To recognise speech, interpret the request and generate voice or text responses.
• To consult and, where applicable, create or update reservation information through the hotel’s connected PMS.
• To rely on the knowledge base and instructions provided by the hotel.
• To transfer the call to human staff where configured or requested.
• To provide customer support, follow up requests and manage the B2B commercial relationship.
• To ensure security, fraud prevention, abuse detection and compliance with legal obligations.
• To produce usage statistics and improve the service where legally permitted and, where applicable, on an appropriate legal basis.
• To manage billing, subscription and contractual obligations.

Depending on the processing and ACL Voice’s role, legal bases may include, without limitation:

• Performance of a contract or pre-contractual measures (provision of the SaaS service, account management, support related to the contract).
• The legitimate interests of ACL Voice or of the hotel customer (security, fraud prevention, limited service improvement, B2B prospecting within applicable limits), subject to a balancing test and the right to object where applicable.
• Consent, where required, in particular for certain non-essential cookies or certain optional processing.
• Compliance with a legal obligation (retention of invoices, response to a competent authority, personal-data obligations).

Where ACL Voice acts as a processor, the legal basis for processing vis-à-vis the data subjects (hotel guests, callers) is determined by the controller, generally the hotel.

The service uses artificial-intelligence, speech-recognition, speech-synthesis and language-processing technologies, provided in whole or in part by ACL Voice and/or third-party technology providers. These processing operations are intended to assist the conversation, identify the caller’s intent and perform service-related actions (information, message, reservation, transfer).

These processing operations must not be regarded as producing infallible decisions. Generated responses may contain errors, approximations or incomplete information. Operational information (availability, rates, reservation status) depends in particular on data provided by the hotel and on the availability of its PMS.

ACL Voice does not, by the mere use of the service, intend to take decisions producing legal effects or similarly significantly affecting a person solely on the basis of automated processing within the meaning of Article 22 GDPR. Where human review is required (a complaint, a sensitive situation, a caller’s request, or rules configured by the hotel), a transfer to hotel staff may be offered or carried out.

Further details are set out in the AI & Call Policy.

Where the hotel connects its property-management system, ACL Voice may transmit, receive or update availability, rate and reservation data in order to fulfil the caller’s or user’s request. ACL Voice does not warrant that such information is accurate, complete or up to date if the PMS is unavailable, slow, misconfigured or supplies incorrect data.

The hotel remains responsible for the quality of the data it makes available through its PMS, knowledge base and settings.

Data may be disclosed, to the extent necessary, to the following recipients:

• Authorised ACL Voice personnel (support, operations, security, administration), subject to a confidentiality obligation.
• The hotel customer and its authorised users, via the dashboard and the service features.
• Third-party technology providers and technical service providers (hosting, telephony, speech recognition and synthesis, artificial intelligence, messaging, managed services), acting under instructions and appropriate contractual measures.
• Administrative or judicial authorities where required by law.
• Advisers (legal, accounting, audit) in the course of their assignments, subject to confidentiality.

ACL Voice does not sell the personal data of callers or hotel customers to third parties for independent marketing purposes.

Data are, so far as possible, processed within the European Union / European Economic Area. However, certain third-party technology providers may process data from, or grant access to data in, countries outside the EU/EEA.

Where a transfer outside the EU/EEA takes place, ACL Voice seeks to frame that transfer with a recognised mechanism (adequacy decision, standard contractual clauses, and additional measures where applicable), without this constituting a guarantee of the absence of any residual risk.

The precise list of processors and locations is not published in this policy, in order to avoid inaccurate or incomplete information. It may be communicated to professional customers in the contractual framework, in particular through the Data Processing Agreement.

Data are retained for a period proportionate to the purpose pursued, to legal obligations and to operational needs, then deleted or anonymised, subject to longer retention obligations (for example billing, evidence, security).

The precise retention periods for call recordings, transcripts, logs and reservation data may depend on account configuration, the customer’s instructions and legal obligations. Where a period has not yet been defined uniformly, it will be specified in the contract, in the account settings or upon request to contact.voice@acl-gestion.com.

By way of illustration of principles, and without constituting binding contractual periods: account data are generally retained for the duration of the contractual relationship and then for a limited period after it ends; call recordings, where enabled, are retained according to the customer’s settings; security logs may be retained for longer for incident-detection purposes.

No specific numerical periods are stated in this policy. Final operational periods must be completed by ACL Voice ([RETENTION PERIODS]) after internal validation and, where applicable, review by a DPO.

ACL Voice implements technical and organisational measures designed to protect data against unauthorised access, loss, alteration or disclosure, proportionate to the risks. These measures may include access control, authentication, encryption in transit where applicable, logging, environment segregation and internal procedures.

No system being free of risk, ACL Voice cannot guarantee absolute security. Customers and users must also protect their credentials, limit internal access and report any incident.

Where the GDPR applies, data subjects may, under the conditions provided by the applicable rules, exercise the following rights:

• Right of access.
• Right to rectification.
• Right to erasure.
• Right to restriction of processing.
• Right to object, including to processing based on legitimate interests.
• Right to data portability, where the legal conditions are met.
• Right to withdraw consent, where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.
• Right to give instructions concerning the fate of data after death, where applicable under French law.

To exercise these rights: contact.voice@acl-gestion.com. Where ACL Voice acts as a processor, the request may need to be addressed to the hotel as controller, ACL Voice then seeking to assist the hotel in accordance with the contract.

Proof of identity may be requested where necessary to prevent unauthorised access. ACL Voice endeavours to respond within the applicable legal time limits.

Without prejudice to any other remedy, any data subject has the right to lodge a complaint with the competent supervisory authority. For France, that authority is the Commission nationale de l'informatique et des libertés (CNIL). Data subjects in another EU/EEA Member State may also contact the authority of their place of residence, place of work or of the alleged infringement.

ACL Voice may update this policy to reflect changes to the service, providers, regulation or internal practices. The date of last update is indicated at the top of the page. In the event of a material change, ACL Voice will endeavour to inform professional customers by a reasonable means (for example an in-product notification or email).

For any question relating to this policy, personal data or legal matters: contact.voice@acl-gestion.com. Postal address: 22 Avenue de Châlons, 93150 Le Blanc-Mesnil, France.