Skip to main content Skip to navigation
    hotelcomply

    Privacy Policy

    Last Updated: July 26, 2025

    For the complete and up-to-date Privacy Policy, please visit: https://www.iubenda.com/privacy-policy/10497323

    HotelComply ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website (hotelcomply.com) and services (collectively, "Services"). We comply with the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), the General Data Protection Regulation (GDPR) for EU/UK residents, and other applicable laws. If you are a California resident, please see the "California Privacy Rights" section. For EU/UK residents, see the "GDPR Rights" section.
    By using our Services, you consent to this Privacy Policy. If you do not agree, please do not use the Services. We may update this Policy—changes will be posted here with the "Last Updated" date. Continued use constitutes acceptance.

    1. Information We Collect

    We collect information in these categories:

    Personal Information You Provide:

    When creating an account, using Services, or contacting support, we collect name, email, hotel business information, account credentials, and compliance data/records.

    Automatically Collected Information:

    Device data (IP address, browser type), usage data (pages visited, time spent), cookies data (see Cookies section), and location data (derived from IP for general region).

    From Third Parties:

    If integrated (e.g., Opera PMS), we may receive guest profiles (names, emails) for compliance processing, with your consent.

    Sensitive Information:

    We may process sensitive PI (e.g., health preferences) if provided for compliance, but only with consent where required.
    We do not knowingly collect data from children under 16. If we learn of such collection, we delete it immediately.

    2. How We Use Your Information

    We use information for:
    • Providing/maintaining Services (e.g., ROPA generation, DSAR processing).
    • Technical support and communications.
    • Improving Services and developing features.
    • Fraud prevention and security.
    • Legal compliance and rights enforcement.
    • Marketing (with opt-in consent).
    Under GDPR (Article 6), our lawful bases are: consent (marketing), contract performance (Services), legitimate interests (improvements/security, balanced with your rights), and legal obligations (compliance).

    3. Sharing and Disclosure of Personal Information

    We share information with:
    • Service Providers: AI services (for compliance analysis), infrastructure (Supabase for storage), under strict contracts limiting use to our instructions and requiring security.
    • Business Partners: With consent, for integrations (e.g., Opera PMS).
    • Legal Requirements: To comply with laws, subpoenas, or protect rights/safety.
    • Business Transfers: In mergers/acquisitions, with notice.
    • Aggregated Data: De-identified data for analytics (not PI).
    We do not sell PI. For CCPA, we share categories like identifiers with service providers for business purposes (no monetary value). No sharing with affiliates without consent.
    For GDPR, international transfers use Standard Contractual Clauses (SCCs) or adequacy decisions (Article 46).

    4. Data Security

    We use industry-standard measures: encryption (in transit/rest), access controls, regular audits, and breach response plans. However, no system is 100% secure—use strong passwords.

    5. Data Retention

    We retain PI as needed for Services (e.g., compliance records 3-7 years), legal obligations, or disputes. Deletion occurs upon request or when no longer necessary (§1798.105 CCPA; Article 17 GDPR).

    6. Cookies and Tracking Technologies

    We use cookies for functionality, analytics, and marketing. Categories: essential (no consent needed), performance, targeting. Manage via browser settings or our cookie banner (opt-out for non-essential). See our Cookie Policy for details.

    7. California Privacy Rights (CCPA/CPRA)

    California residents have rights:
    • Know: Categories/sources/purposes of PI collected/shared (§1798.110).
    • Access: Specific PI (§1798.100).
    • Delete: Non-exempt PI (§1798.105).
    • Correct: Inaccurate PI (§1798.106).
    • Opt-Out: Sale/sharing (§1798.115, §1798.135) via "Do Not Sell/Share My Info" link.
    • Limit Sensitive PI: Use/disclosure (§1798.121).
    • Non-Discrimination: No penalties for exercising rights (§1798.125).
    • Opt-Out of Automated Decision-Making: Profiling if applicable (§1798.185).
    Submit requests at hotelcomply.com/user-request or [email protected]. We respond in 45 days (extendable to 90 with notice), free twice/year. Verification via email/ID. Authorized agents must provide permission.
    In the last 12 months, we collected/shared (no sales): identifiers (for Services) with providers like Supabase.

    8. GDPR Rights (for EU/UK Residents)

    If GDPR applies (e.g., EU guests), our lawful bases are contract (Services), consent (marketing), legitimate interests (security). Rights (Articles 15-22):
    • Access/Portability: Copy of your data.
    • Rectification: Correct inaccuracies.
    • Erasure: Delete non-essential data.
    • Restriction/Objection: Limit or object to processing.
    • Withdraw Consent: Anytime.
    Contact [email protected]. We respond in 30 days. Transfers use SCCs. Complaints to supervisory authority (e.g., ICO in UK).

    9. Other Privacy Rights

    Depending on your location (e.g., Virginia, Colorado), you may have similar rights—contact us to exercise.

    10. Changes to This Policy

    We update as needed; check "Last Updated" date.

    11. Do Not Sell or Share My Personal Information

    California residents have the right to opt-out of the sale or sharing of their personal information under CCPA §1798.115 and §1798.135. We do not sell personal information for monetary value. However, some data sharing activities may be considered "sharing" under CCPA.
    To exercise your right to opt-out of data sharing, you can:
    To exercise your other privacy rights (access, delete, correct data), you can:
    We will process your opt-out request within 15 business days and will not discriminate against you for exercising this right.

    12. Contact Us

    [email protected] or hotelcomply.com/user-request.