ACCOR Privacy Policy

1. Information We Collect

Depending on how you use the Platform, Accor may collect account information such as name, mobile number, email address where provided, authentication information, user type and profile information.

Garage Information: May include garage name, garage owner information, worker information, pincode, garage association and other programme information.

QR and Transaction Information: May include QR identifier, product/SKU, batch information where applicable, scan date and time, rewards generated, campaign applied and the account and garage associated with the scan.

Reward Information: May include balances, Cash Reward transactions, Reward Point transactions, redemption requests, redemption history, gift details and fulfilment information.

Device and Usage Information: May include device type, operating system, app version, device identifiers, IP address, network information, crash and diagnostic information, screens accessed, features used, QR activity, reward activity and error logs.

2. Camera Permission

The Accor App may require camera access to scan Accor QR codes. Camera access is used for QR scanning and related functionality and is not intended for continuous monitoring. Permission is requested through the device operating system.

3. How We Use Your Information

• Create and maintain accounts and authenticate users.
• Identify user category and associate workers with garages.
• Process QR scans and calculate eligible rewards.
• Credit Reward Points and process Cash Rewards.
• Process redemption requests and fulfil rewards.
• Validate campaign and pincode eligibility.
• Prevent fraud and misuse.
• Send service, reward, campaign and account communications.
• Provide customer support and improve Platform performance.
• Maintain security and comply with legal obligations.

4. Legal Basis / Consent

Where required by applicable law, Accor will seek consent before processing personal data. Consent may be withdrawn where legally applicable. Withdrawal may affect functionality where the information is necessary to provide the requested service.

5. Reward & Transaction Data

QR scans and reward information may be retained to calculate rewards, maintain transaction records, investigate disputes, prevent fraud, maintain programme integrity and comply with accounting, tax or legal obligations.

Account deletion does not necessarily require immediate deletion of information that Accor is legally required or otherwise permitted to retain.

6. Sharing of Information

Accor may share information with selected service providers where necessary to operate the Platform, including technology and cloud providers, communication providers, payment or financial service providers, reward fulfilment providers, customer-support providers, fraud-prevention services and other operational vendors.

Information may also be disclosed to legal or regulatory authorities where required by law, court order, government authority or regulatory requirement.

Accor will seek to limit information sharing to what is reasonably necessary for the relevant purpose.

7. Third-Party SDKs

The production application may use third-party SDKs for analytics, crash reporting, push notifications, authentication, security and performance monitoring.

The final published Privacy Policy lists the actual SDK providers implemented in the production build and matches the application's actual data practices.

8. Data Security

Accor will implement reasonable technical and organisational safeguards designed to protect personal data against unauthorised access, loss, misuse, alteration, disclosure and destruction.

Measures may include authentication controls, access controls, encryption where appropriate, secure communications, server-side protections, monitoring, logging and administrative controls.

No digital system can guarantee absolute security.

9. Data Retention

Accor retains information for as long as reasonably necessary for the purposes described in this Policy or as required or permitted by applicable law.

Retention may depend on account status, reward transactions, legal requirements, tax and accounting obligations, fraud prevention, dispute resolution and security requirements.

When information is no longer required, Accor may delete, anonymise or securely dispose of it in accordance with applicable requirements.

10. Account Deletion

Users may request deletion of their Accor account through the account-deletion functionality provided within the application and/or designated web deletion mechanism.

Deletion may not immediately remove information that Accor is legally required or permitted to retain.

11. User Rights

Subject to applicable law, users may have rights to access information, request correction of inaccurate information, request deletion, withdraw consent where applicable, raise a grievance, request information regarding processing and exercise other rights available under applicable data-protection law.

12. Consent Withdrawal

Where processing is based on consent, users may withdraw consent using the mechanism provided by Accor. Withdrawal does not affect processing already lawfully undertaken before withdrawal.

13. Promotional Communications

Accor may send information regarding campaigns, rewards, promotions and programme updates. Where applicable, users may opt out of promotional communications. Service, security and transaction-related communications may continue where necessary.

14. Push Notifications

The app may send notifications relating to rewards, QR scans, campaigns, redemption, account activity and important service updates. Users may control notification permissions through device settings, subject to Platform functionality.

15. Children's Privacy

The Accor App is intended for eligible adults and business participants and is not intentionally designed to collect personal information from children. If Accor becomes aware that a child's personal information has been collected contrary to applicable law, appropriate steps may be taken.

16. Cookies & Similar Technologies

The Accor website or web-based services may use cookies and similar technologies for essential functionality, security, analytics, performance and preferences. Users may control cookies through browser settings where supported.

17. International Data Processing

Depending on infrastructure and service providers, personal information may be processed or stored outside the user's state or country, subject to applicable legal requirements. Where required, Accor will implement appropriate safeguards.

18. Data Breach

In the event of a personal-data breach, Accor will take appropriate measures in accordance with applicable law, including investigation, containment, remediation and notifications where legally required.

19. Third-Party Websites & Services

The Platform may contain links to third-party websites or services. Accor is not responsible for independent third parties' privacy practices. Users should review third-party privacy policies before providing information.

20. Data Accuracy

Users are responsible for ensuring that information provided to Accor is accurate and up to date, including name, mobile number, garage information, worker/owner status and pincode.

21. Automated Processing & Fraud Detection

Accor may use automated rules, systems or analytical tools to identify duplicate QR scans, suspicious transactions, abnormal reward activity and potential account or campaign misuse. Where applicable, users may contact Accor to raise a concern regarding a disputed transaction.

22. Changes to this Privacy Policy

Accor may update this Privacy Policy to reflect changes in the Platform, data-processing practices, legal requirements or security measures. Updated versions will be published through the Platform or website and the Last Updated date will be revised.

24. Governing Law

This Privacy Policy shall be governed by the applicable laws of India, including applicable data-protection and information-technology legislation.

25. Acceptance

By creating an account or continuing to use the Accor Platform, you acknowledge that you have read and understood this Privacy Policy and, where required, provide consent to processing of personal information as described herein.