Last Updated: November 3, 2026

This Privacy Policy ("Policy") applies to https://petitsoleilslo.com/ and Petit Soleil ("Company") and governs data collection and usage. For the purposes of this Privacy Policy, the Company is 1473 Monterey St., LLC, doing business as Petit Soleil, located at 1473 Monterey Street, San Luis Obispo, California 93401. The Company's website is a Hotel site.
This Policy applies to information collected through the Company's website, reservation and booking channels, communications, and operations at the Hotel. It applies to hotel guests, prospective guests, website visitors, individuals submitting inquiries, event, banquet and group customers, individuals visiting the property, and people communicating with the Hotel for customer service.
Condesa is operated by a separate legal entity. Although Petit Soleil and Condesa have related ownership and management relationships and share limited information to facilitate guest room charges, Condesa is not operated by the Company. This Policy describes the information-sharing practices between Petit Soleil, Condesa and their shared management company, Good Lion Hospitality, where applicable. Condesa's independent restaurant operations are separate from the Hotel's operations.
By using the Company's website or services, you acknowledge that you have had the opportunity to review this Policy. Where consent is required by applicable law, the Company will obtain that consent separately.

Collection of your Personal Information

In order to better provide you with products and services offered, the Company may collect personally identifiable information, such as your:

• First and last name
• Mailing address
• Email address
• Phone number
• Reservation and booking information, including arrival and departure dates, room type, reservation source, rate, arrival time, and stay history
• Names and age ranges of additional guests or occupants
• Company or employer name, business billing details and contact information for corporate reservations, events, banquets and group bookings
• Government-issued identification information, where collected for identity verification, age verification, fraud prevention or other legally permitted purposes
• Payment and transaction information, including payment tokens, the last four digits of payment cards, transaction history and billing information
• Guest preferences, room assignment preferences, housekeeping requests and other service requests
• Special requests and information voluntarily provided concerning dietary restrictions, food allergies, accessibility requirements, medical needs or service animals
• Information relating to guest complaints, disputes, incidents, property damage, chargebacks and insurance or police matters
• Photographs or other documentation relating to property damage or incidents
• Communications you have with the Company, including emails, text messages, telephone communications and survey responses
• Information submitted through event inquiries, group inquiries, customer service requests and other communications

If you purchase the Company's products and services, we collect billing and payment information. This information is used to complete the purchase transaction.
Payment information provided through the Hotel's Mews property management and payment environment is processed through Adyen and tokenization services. The Company's current Mews payment-card retention setting is 90 days. Stored payment tokens are automatically cleared according to the applicable retention setting. Certain reservation, payment and accounting records, including the last four digits of a payment card and historical transaction records, may remain available for reconciliation, accounting, refunds, disputes or other legally permitted purposes.
Payment Card Security & Truncation (Cal. Civ. Code § 1747.09): In accordance with California Civil Code Section 1747.09 and applicable payment card industry (PCI-DSS) standards, the Company does not store complete credit or debit card numbers, magnetic stripe data, or card security codes (CVV/CVC) in plain text or paper files. All printed or electronic receipts provided to guests display only the last four digits of the payment card number and omit card expiration dates.
Food and beverage transactions are processed through Toast. Where a guest requests that a Condesa restaurant transaction be charged to a Hotel room, the necessary guest name, room number and transaction information may be shared between the businesses to complete the charge.
Physical credit card authorization forms, where used, contain only the last four digits of the guest's payment card. Hotel employees do not manually record or retain complete credit card numbers or card security codes.
The Company may visually inspect government-issued identification at check-in. The Company may also introduce electronic identification scanning in the future. If electronic scanning is implemented, information extracted from the identification document and an image of the document may be collected for identity verification, age verification, fraud prevention and other purposes permitted by applicable law. The Company's intended retention period for electronically scanned identification images and associated scan information is no more than three days, subject to applicable legal requirements. Information obtained through electronic scanning will be used only for purposes permitted by applicable law.
Electronic Identification Scanning Notice (Cal. Civ. Code § 1798.90.1): When inspecting or electronically scanning government-issued identification at check-in, the Company collects and processes extracted identification information strictly in compliance with California Civil Code Section 1798.90.1. Scanned identification data is used solely for identity verification, age verification (including compliance with liquor access rules), credit/debit card fraud prevention, or as otherwise required by law. The Company does not sell, rent, or transfer scanned identification data to third parties, and retains scanned identification images and associated data for no longer than three (3) days, unless longer retention is required by law or necessary for an ongoing fraud or safety investigation.
The Company may collect additional personal information from you when you provide information through our website, reservation channels, or directly to Hotel employees. For example, guests may voluntarily provide information about food allergies, dietary restrictions, medical conditions, accessibility requirements, service animals or other special accommodations. Such information is not routinely solicited but may be noted when provided to the Hotel so that the Company can respond to the guest's request.
The Company may also collect information regarding additional room occupants, including their names and age ranges. Children's names are collected only when a child is the guest occupying the room without an adult present.
We do not collect any personal information about you unless you voluntarily provide it to us, it is provided to us through a reservation or other third-party service, or it is collected automatically through our website, communications or property operations. However, you may be required to provide certain personal information to us when you elect to use certain products or services.
These may include: (a) making a reservation or booking; (b) submitting an inquiry or communicating with the Hotel; (c) signing up for special offers or promotional communications; (d) sending us an email or text message; (e) submitting payment information when reserving or purchasing products and services; or (f) providing information for an event, banquet or group booking.
We also may gather additional personal or non-personal information in the future.

Use of your Personal Information

The Company collects and uses your personal information in the following ways:

• To operate and deliver the services you have requested
• To process, confirm, manage and administer hotel reservations and stays
• To provide you with information, products, or services that you request from us
• To provide you with notices about your reservation, account or stay
• To communicate pre-arrival instructions, check-in and check-out information, during-stay assistance and post-stay surveys or review requests
• To manage room assignments, guest preferences, housekeeping and other guest service requests
• To process payments, room charges, food and beverage transactions, refunds and billing inquiries
• To coordinate guest-requested services, including transportation arrangements and lost-and-found shipping
• To manage corporate reservations, events, banquets, group bookings, contracts and billing
• To respond to guest inquiries, requests, complaints, disputes and incidents
• To maintain property security, investigate incidents, protect guests and employees, and protect the Company's property
• To carry out the Company's obligations and enforce our rights arising from any contracts entered between you and us, including for billing and collection
• To maintain appropriate business, accounting and operational records
• To comply with applicable laws, regulations, legal processes and governmental requests
• To notify you about changes to our website or any products or services we offer or provide through it
• To maintain, evaluate and improve the Company's website, products and services
• To measure website use, understand the effectiveness of marketing campaigns and improve our advertising, where permitted by your cookie preferences and applicable law
• In any other way we may describe when you provide the information
• For any other purpose with your consent or as otherwise permitted by applicable law

The Company may also use your personally identifiable information to inform you of other products or services available from the Company and, where permitted by applicable law, Good Lion Hospitality.
Promotional email and text communications from Petit Soleil require a separate signup. Signing up for Hotel promotional communications does not automatically enroll you in Condesa's or Good Lion Hospitality's promotional messaging programs.

Sharing Information with Third Parties

The Company does not sell, rent, or lease its customer lists to third parties for monetary consideration.
The Company may share data with trusted partners and service providers to help perform statistical analysis, send you email or text messages, process payments, provide customer support, operate reservation and booking systems, manage the property, provide requested services, or arrange for deliveries.
These third parties may receive only the information reasonably necessary to perform their respective services or functions. Their use of information is governed by their contractual obligations, privacy policies and applicable law. Not all third parties operate solely as service providers; some booking platforms, payment providers, advertising providers and other businesses may process information independently under their own privacy policies.
The Company uses or may use the following categories of third parties:
Reservation and booking platforms: Mews, SiteMinder, Booking.com B.V., Expedia, Inc., Airbnb (including Airbnb Travel, LLC where identified as the contracting entity for a U.S. hotel booking), Google LLC through Google Hotels, and Tablet LLC, which operates Tablet Hotels and is associated with Michelin.
Channel management and distribution partners: SiteMinder Hospitality Corporation, DerbySoft, Inc. and Cendyn Group, LLC, including connectivity and distribution integrations involving Google Hotels.
Payment and transaction providers: Adyen through Mews, Toast and related payment and transaction-processing providers.
Property management and administrative services: Good Lion Hospitality, which provides management, administration and accounting services to Petit Soleil and Condesa.
Guest communication and experience providers: Mews, Mews Guest Experience, Akia and Twilio Inc. or its affiliated entities. These providers support reservation confirmations, pre-arrival instructions, check-in and check-out communications, during-stay messaging and post-stay surveys or review requests. The SMS messaging channel within Mews Guest Messaging is operated using Twilio or an affiliated Twilio entity. These providers may process personal information in accordance with their respective privacy notices and applicable contractual and legal obligations. Twilio may process personal information as an independent controller, as described in its applicable privacy notice.
Website and digital services: Tambourine, which manages the Company's website and website technology, and Google LLC, which provides website analytics, advertising and related services.
Marketing and communications providers: Katalyst PR Agency, which assists with the Company's email newsletter and promotional communications.
Technology, connectivity and property services: CITIG (Channel Islands Technology Integrators' Group), which provides information technology and Wi-Fi support; Moncierge, which provides the in-room television interface; and Google and DMSS services used in connection with cloud-based security camera storage and related systems.
Accounting and payroll providers: Good Lion Hospitality, ADP and Toast, as applicable to the services they provide.
Shipping and transportation providers: United Parcel Service (UPS), SLO Safe Ride and Obsidian Luxury Services, where necessary to fulfill a guest's request.
The Company may also share personal information with other vendors, consultants, professional advisers, insurers, auditors, legal representatives and service providers as reasonably necessary to operate the Hotel or protect its legal interests.
Confidentiality of Guest Records (Cal. Civ. Code § 53.5): Pursuant to California Civil Code Section 53.5 and California privacy laws, guest registration records, stay details, and room assignment information are treated as confidential. The Company will not disclose guest registration records or stay history to third parties or law enforcement agencies except: (a) pursuant to a valid search warrant, court order, or judicial subpoena; (b) in exigent circumstances involving an immediate threat to life, health, or personal safety; (c) to report suspected criminal activity occurring on property as permitted by law; or (d) with the express written consent of the guest.

Condesa and Good Lion Hospitality

Condesa is operated by a separate LLC and is not part of the legal entity operating Petit Soleil.
Petit Soleil and Condesa share limited guest information to facilitate restaurant transactions charged to Hotel guest rooms. Condesa employees may access the guest's name and room number when necessary to process a room charge. Condesa employees do not have access to the Hotel's reservation system or full guest records.
The Hotel and Condesa currently use one Toast account for food and beverage transactions. Petit Soleil management may access individual Condesa Toast transactions and charges posted to Hotel guest folios. Condesa management has access to Condesa records. Condesa employees have limited access to the information needed to process room charges.
Email addresses and telephone numbers are not shared directly between Petit Soleil and Condesa for independent promotional marketing.
Good Lion Hospitality manages both businesses and may access the Hotel's Mews system and guest contact information for management, administrative and accounting purposes. Good Lion Hospitality may also use Hotel guest contact information for its own marketing purposes, where permitted by applicable law. Marketing communications from Good Lion Hospitality are separate from promotional communications from Petit Soleil, and you may opt out of each sender's marketing communications separately.

Guest-requested services

The Company may disclose a guest's name, contact information, shipping address or other information reasonably necessary to complete a service the guest requests.
For example, the Company may share information with UPS to arrange shipment of a lost-and-found item or with SLO Safe Ride or Obsidian Luxury Services to arrange transportation requested by a guest.

Online advertising and analytics

The Company's website uses Google Analytics and Google Ads technologies through Google Tag Manager. These technologies may collect information about website visits, browser and device information, online interactions, advertising activity and cookie identifiers.
Nonessential tracking technologies are blocked until a visitor provides consent through the website's cookie preference banner. When permitted by the visitor's preferences, information may be disclosed to Google for website analytics, advertising measurement, campaign performance and advertising purposes.
Certain advertising disclosures may constitute "sharing" of personal information for cross-context behavioral advertising under the California Consumer Privacy Act, if that law applies to the Company. Visitors may use the cookie preference controls, including the "Do Not Sell or Share My Personal Information" option, to exercise available choices.
The Company may disclose your personal information, without notice, if required to do so by law or in the good faith belief that such action is necessary to: (a) conform to the edicts of the law or comply with legal process served on the Company or the site; (b) protect and defend the rights or property of the Company; and/or (c) act under exigent circumstances to protect the personal safety of users of the Company, or the public.

Tracking User Behavior

The Company may keep track of the websites and pages our users visit within the Company's website, in order to determine what the Company's services are the most popular. This data may be used to understand website usage, measure marketing performance, improve the website and deliver relevant advertising, subject to your cookie choices and applicable law.
The Company's website uses Google Analytics and Google Ads tags through Google Tag Manager. These technologies may collect website activity, device and browser information, cookie identifiers and interactions with advertisements.
The Company's website uses a cookie consent banner that blocks nonessential tracking until a visitor consents. The website also recognizes Global Privacy Control (GPC) signals and applies the associated opt-out preference through the website's consent configuration.
The Company does not currently use dedicated session-recording or heatmap software, based on its present website configuration.
The Company does not claim that every browser's separate "Do Not Track" setting is recognized. The Company's website currently recognizes Global Privacy Control signals as described above.

Automatically Collected Information

The Company may automatically collect information about your computer hardware and software. This information can include your IP address, browser type, domain names, access times, device information and referring website addresses. This information is used for the operation of the service, to maintain quality of the service, and to provide general statistics regarding the use of the Company's website.
The Company's guest Wi-Fi network is provided with technology and support from CITIG. Guests are not required to register or provide personal information to access the guest Wi-Fi network. However, network equipment and service providers may automatically process technical information such as device identifiers, IP addresses and connection timestamps in connection with providing, maintaining and securing network services. The Company's use of guest Wi-Fi does not require guests to create an account or provide an email address.
The Company's in-room television system is provided through Moncierge. Guests may sign into their own personal streaming applications on in-room television devices. The television system is configured to automatically clear guest sign-in sessions and associated personal information at the end of each guest's stay. Streaming providers may independently collect information under their own privacy policies when guests use their services.
The Company also operates video security cameras in public areas of the property. These cameras record video, but do not record audio. Camera footage is stored using cloud-based services and may capture images of guests, visitors, employees and other individuals on the property.

Use of Cookies

The Company's website may use "cookies" to help you personalize your online experience. A cookie is a text file that is placed on your device by a web page server. Cookies cannot be used to run programs or deliver viruses to your computer.
Cookies and similar technologies may be used to support the operation of the website, remember preferences, improve website functionality, measure website performance, analyze visitor activity and support advertising.
The Company's website uses the following general categories of cookies and similar technologies:

• Essential Cookies: These cookies are necessary to the core functionality of the website and some of its features, such as access to secure areas.
• Performance and Functionality Cookies: These cookies are used to enhance the performance and functionality of the website but are nonessential to its use.
• Analytics and Customization Cookies: These cookies collect information that can help us understand how our website is being used. This information can also be used to measure the effectiveness of marketing campaigns or to curate a personalized website experience.
• Advertising Cookies: These cookies are used to make advertising messages more relevant to you, measure advertising performance and support advertising-related services.
• Social Networking Cookies: These cookies may enable visitors to share website content through third-party social networks and other websites.
• Unclassified Cookies: These are cookies that are in the process of being categorized with the help of their providers.

You have the ability to accept or decline nonessential cookies through the Company's cookie preference banner. You may choose which categories of cookies to allow and can change your preferences at any time through the website's cookie settings.
The choices you make regarding the purposes and vendors listed in the cookie preference notice are saved in local storage on the browser or device being used for a maximum duration of 12 months. These choices do not automatically carry over to other devices or browsers.
The Company's cookie preference banner includes an option titled "Do Not Sell or Share My Personal Information." The website also recognizes Global Privacy Control signals and applies those preferences through its consent configuration.
If you choose to decline nonessential cookies, you may not be able to fully experience certain interactive features of the Company's website or services.
You can learn more about how we use cookies by visiting our Cookie Policy.

Links

This website contains links to other sites. Please be aware that we are not responsible for the content or privacy practices of such other sites. We encourage our users to be aware when they leave our site and to read the privacy statements of any other site that collects personally identifiable information.
This includes third-party booking platforms, payment services, restaurant services, streaming services and other websites accessible through links on the Company's website or guest communication systems.

Security of your Personal Information

The Company secures your personal information from unauthorized access, use, or disclosure. The Company uses reasonable administrative, technical and physical safeguards designed to protect personal information, including limiting access to guest information to authorized personnel and service providers who need it for legitimate business purposes.
The Company uses third-party systems and service providers for reservation management, payment processing, communications, website management, accounting, security and other business functions. These providers maintain their own security measures and may process information in accordance with their respective contractual and privacy obligations.
When personal information, including payment information, is transmitted through the Company's website or payment systems, it may be protected through encryption and other security measures provided by the relevant systems and service providers.
The Company uses video surveillance in public areas of the property for security, safety, incident investigation and protection of guests, employees and property. These cameras record video only and do not record audio. Only Hotel management is authorized to access security camera footage. Footage is stored through cloud-based systems and is retained for as long as reasonably necessary for security, operational, investigative or legal purposes. Footage may be retained longer where necessary in connection with an incident, investigation, insurance matter or legal claim.
Security footage is not made available to the general public or restaurant employees. Footage may be provided to law enforcement in response to a police request, court order or similar legal avenue.
We strive to take appropriate security measures to protect against unauthorized access to or alteration of your personal information. Unfortunately, no data transmission over the Internet or any wireless network can be guaranteed to be 100% secure.
As a result, while we strive to protect your personal information, you acknowledge that: (a) there are security and privacy limitations inherent to the Internet and electronic systems that are beyond our control; and (b) the security, integrity, and privacy of any and all information and data exchanged between you and us through our website, electronic communications or third-party services cannot be guaranteed.

Retention of your Personal Information

The Company retains personal information for as long as reasonably necessary to fulfill the purposes for which it was collected, operate the Hotel, provide requested services, maintain business records, resolve disputes, prevent fraud, comply with legal obligations and protect the Company's legal interests.
Retention periods may vary depending on the type of information, the purpose for which it was collected, applicable legal requirements, contractual obligations and legitimate business needs.
The Company's current payment-card token retention setting in Mews is 90 days. Following the applicable retention period, stored payment tokens are automatically cleared in accordance with the system's retention rules. Historical transaction records and the last four digits of payment cards may remain for accounting, reconciliation, refunds, disputes and other legally permitted purposes.
If electronic identification scanning is introduced, scanned identification images and related scan information are intended to be retained for no more than three days, subject to applicable legal requirements and permitted purposes.
Security footage, incident records, damage photographs, guest complaints, chargeback documentation, insurance records and police correspondence may be retained for the period reasonably necessary to address security, operational, insurance or legal matters.
Personal information may be retained for longer periods when necessary to comply with tax, accounting, recordkeeping or other legal requirements, to resolve disputes, to enforce agreements or to establish, exercise or defend legal claims.
When personal information is no longer reasonably necessary for its intended purpose and is not required to be retained, the Company will take reasonable steps to delete, destroy, deidentify or otherwise dispose of it.
The Company does not maintain paper guest records as part of its ordinary recordkeeping practices. Any paper guest records that are temporarily created or received are destroyed when no longer needed.

Data Security & Record Retention

Security & Disposal of Customer Records (Cal. Civ. Code §§ 1798.81 & 1798.81.5): The Company maintains reasonable physical, administrative, and technical safeguards to protect personal information from unauthorized access, destruction, use, modification, or disclosure. When physical or electronic records containing customer personal information are no longer required for legitimate business, accounting, tax, or legal purposes, the Company disposes of such records by shredding, erasing, or otherwise modifying the personal information to make it unreadable and undecipherable, in compliance with California Civil Code Section 1798.81.

Right to Deletion

Subject to certain exceptions set out below and applicable law, on receipt of a verifiable request from you, we will:

• Delete your personal information from our records; and
• Direct our service providers and contractors to delete your personal information from their records, where required and applicable.
• Where required by applicable law, notify third parties to whom we have sold or shared your personal information to delete that information, unless doing so is impossible or involves disproportionate effort.

Please note that we may not be able to comply with requests to delete your personal information, in whole or in part, if it is reasonably necessary for us to maintain the information to:

• Complete the transaction for which the personal information was collected, provide a good or service requested by you, reasonably anticipate a good or service within the context of our ongoing business relationship with you, or otherwise perform a contract between you and us;
• Help ensure the security and integrity of personal information, systems and services, to the extent that the use of your personal information is reasonably necessary and proportionate for those purposes;
• Debug to identify and repair errors that impair existing intended functionality;
• Exercise free speech, ensure the right of another consumer to exercise that consumer's right of free speech, or exercise another right provided for by law;
• Comply with the California Electronic Communications Privacy Act pursuant to Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code;
• Engage in public or peer-reviewed scientific, historical, or statistical research that conforms to or adheres to all other applicable ethics and privacy laws, when deletion of the information is likely to render impossible or seriously impair the achievement of such research, provided that you have provided informed consent;
• Enable solely internal uses that are reasonably aligned with your expectations based on your relationship with us and compatible with the context in which you provided the information; or
• Comply with a legal obligation.

We may also retain personal information when necessary to establish, exercise or defend legal claims, investigate disputes, process outstanding transactions, maintain required financial and accounting records, prevent fraud, or comply with other applicable legal requirements.
If we cannot verify your identity or authority to make the request, we may decline to fulfill the request and will explain the reason, where required by law.

Submitting a Privacy Request

To submit a request to delete your personal information, or to ask questions about how your personal information is handled, you may contact us using the contact information provided at the end of this Policy.
When submitting a request, please provide sufficient information for us to identify you and locate the relevant records. We may request additional information to verify your identity or authority to make the request. We will only use information provided for verification for the purpose of processing and documenting your request, subject to applicable law.
You are not required to create an account to submit a privacy request. We will not request that you provide complete credit card numbers or security codes through an ordinary email communication.
Where the California Consumer Privacy Act applies, we will confirm receipt of a verifiable consumer request within the period required by law and generally respond within 45 calendar days. When reasonably necessary, we may extend the response period by an additional 45 calendar days, provided that we notify you of the extension and the reason for it within the original response period.
We will make reasonable efforts to process your request in accordance with applicable law. Certain information may need to be retained for legitimate business, security, accounting, contractual or legal purposes, even after a deletion request has been received.

California Privacy Rights

California residents may have additional rights concerning their personal information under California law, including the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the "CCPA"), where applicable to the Company.
The CCPA applies to businesses that meet certain statutory requirements. Where the CCPA applies to the Company, California residents may have the following rights, subject to applicable exceptions:
Right to Know and Access: You may request information about the personal information we have collected about you.
Right to Correct: You may request that we correct inaccurate personal information that we maintain about you.
Right to Delete: You may request deletion of personal information we have collected about you.
Right to Opt Out of Sale or Sharing: You may request that we stop selling or sharing your personal information.
California "Shine the Light" Law (Cal. Civ. Code § 1798.83): Under California Civil Code Section 1798.83, California residents who provide personal information to the Hotel are entitled to request and obtain once per calendar year information about customer details shared with affiliates (such as Good Lion Hospitality) for their direct marketing purposes. To submit a "Shine the Light" opt-out or information request, please email reservations@petitsoleilslo.com with the subject line "California Shine the Light Request."

Contact Information

1473 Monterey St., LLC
Doing Business As: Petit Soleil
1473 Monterey Street
San Luis Obispo, California 93401
Email Address: reservations@petitsoleilslo.com
Phone Number: 805-549-0321