Version 1.0 · effective date to follow

ALiSiO Privacy Policy

Version 1.0 · effective {{EFFECTIVE_DATE}}

This policy explains how {{PROVIDER_NAME}}, {{PROVIDER_ADDRESS}} ("we"), processes personal data as controller: on our website, when you contact us, when we contact accommodation businesses, and when businesses and their staff use ALiSiO.

Are you a hotel guest? Your hotel decides how your booking and stay data is processed; we process it only on the hotel's behalf as a processor. Please read the privacy notice of your hotel (linked in your booking confirmation and on your guest page) and contact the hotel to exercise your rights.

1. Contact

Controller: {{PROVIDER_NAME}}, {{PROVIDER_ADDRESS}}. Privacy contact: {{PRIVACY_EMAIL}}. We have not appointed a data protection officer because we are not legally required to; the privacy contact handles all data protection requests.

2. Our website

Server logs. When you open our website, our server records the IP address, date and time, requested page, referrer and browser information. We use this data to deliver the website and to protect it against attacks (legitimate interest, Art. 6(1)(f) GDPR). Log files are deleted after {{LOG_RETENTION_DAYS}} days unless needed to investigate an incident.

Cookies and local storage. We use only technically necessary storage: a session cookie when you log in to ALiSiO, and — only when you start a conversation in the website chat — an identifier in your browser so the conversation continues on the next page. We do not use analytics, advertising or tracking cookies and do not load fonts or scripts from third-party servers. No consent banner is needed for this; the legal basis is § 25(2) of the German TDDDG and comparable national rules, and Art. 6(1)(f) GDPR.

3. Chat, contact and demo requests

If you write to us through the website chat, a contact or demo form, by email, phone or messaging services (for example WhatsApp, Telegram, Viber, Instagram, Facebook), we process your name, contact details, the name of your business and the content of the conversation to answer you and, where you wish, to prepare an offer (Art. 6(1)(b) and (f) GDPR).

Answers in the website chat and drafts of our replies may be prepared by an AI assistant (see recipients). A person of our team is responsible for the conversation, and you can ask for a person at any time.

When you contact us through a messaging service, that service also processes your data under its own terms.

We keep enquiries that do not lead to a contract for up to 24 months after the last contact.

4. Contacting accommodation businesses

We offer ALiSiO to hotels and other accommodation businesses. For this we collect business contact data of such businesses from publicly available sources — the business's website, public directories and business profiles: name of the business, address, public phone number and email address, and the name and role of contact persons where published (Art. 14 GDPR). We use this data to contact the business about our service (legitimate interest, Art. 6(1)(f) GDPR).

We follow the national rules on electronic marketing: in countries where advertising by email requires prior consent, we send emails only after consent or at the business's request. Every message states who we are and how to object.

You can object at any time to this use of your data, for example by replying "no" or writing to {{PRIVACY_EMAIL}}. We then stop contacting you and keep only the minimum data needed on a block list to respect your objection. Otherwise we keep prospect data for up to 24 months after the last contact.

To reduce undeliverable emails we may check whether an email address exists using an email verification service.

5. Customers and users of ALiSiO

When a business uses ALiSiO, we process the data of its contact persons and users: name, email, phone, role, language, login and activity logs, and the contract and billing data (Art. 6(1)(b) GDPR; security logs: Art. 6(1)(f)). We keep invoices and accounting records for the periods required by tax and accounting law (up to 10 years, Art. 6(1)(c)); other account data is deleted when the contract ends, subject to Section 13 of our Terms of Service.

We send users service and legal notices (for example changes to our terms) — this is part of the contract. Newsletters or offers are sent only with consent or, for existing customers, about our own similar services with an easy way to unsubscribe in every email.

6. Recipients

We use service providers who process data on our behalf under data processing agreements:

7. Transfers outside the EU

Some providers are located in the USA. We transfer data to them only on the basis of the EU–U.S. Data Privacy Framework (for certified recipients) or standard contractual clauses of the European Commission (Art. 45, 46 GDPR). You can request a copy of the safeguards from {{PRIVACY_EMAIL}}.

8. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to withdraw consent at any time with effect for the future (Art. 7(3)).

Right to object (Art. 21). Where we process data on the basis of legitimate interests, you may object at any time for reasons arising from your particular situation; you may object to direct marketing at any time without giving reasons.

You also have the right to lodge a complaint with a supervisory authority, in particular in the country of your residence or place of work. Our lead authority is the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz).

9. Deleting your data

To have your data deleted, write to {{PRIVACY_EMAIL}} (subject "Delete my data") from the address or number you used to contact us. We delete the data within 30 days unless we are legally obliged to keep it, and confirm the deletion. This also applies to conversations with us through WhatsApp, Instagram or Facebook.

10. No automated decisions

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

11. Changes

We update this policy when our processing changes. Each version has a version number and date; previous versions remain available at https://beta.alisio.rozum.one/legal/privacy. Customers are notified of material changes as set out in our Terms of Service.