Privacy Policy & EU Consent

Welcome to the official EU Privacy and Data Protection Policy for HotelMate Ltd ("HotelMate", "we", "us", or "our"). HotelMate delivers an all-in-one, AI-powered hospitality management ecosystem, comprising our Property Management System (PMS), Booking Engine, Channel Manager, Point of Sale (POS), Guest Self-Service portal, Housekeeping coordination, Accounting, and Customer Relationship Management (CRM).

We operate in strict adherence with European privacy standards, notably:

For the personal data collected through this corporate website and for account administrative contacts of subscribing hotels, the designated Data Controller is:

Our Data Protection Officer monitors ongoing GDPR compliance, conducts Data Protection Impact Assessments (DPIAs) for new AI feature releases, and serves as the primary contact for EU data subjects and European supervisory authorities.

To maintain absolute transparency under GDPR Article 28, HotelMate distinguishes between two distinct capacities in which personal data is processed:

Under the European General Data Protection Regulation, every instance of personal data processing must be backed by an articulated legal basis under Article 6:

Whenever processing is grounded in your consent, HotelMate satisfies the strict standards outlined in GDPR Article 4(11), Article 7, and the European Data Protection Board (EDPB) Guidelines 05/2020:

We collect only the minimum personal data necessary to achieve the designated purposes:

• Identity & Contact Data: First name, last name, hotel/property name, job title, corporate email address, telephone number, and communication records when inquiring via our contact forms.
• Technical & Telemetry Data: Internet Protocol (IP) address, browser family and version, operating system, screen resolution, referral URLs, request timestamps, and anonymized user interaction events.
• Financial & Transaction Data: Invoices, payment confirmation IDs, and billing addresses.Note: Payment card details are processed directly by certified PCI-DSS Level 1 payment processors and are never stored on HotelMate servers.
• Guest Data (Processed on Behalf of Hotels): Names, stay dates, passport/ID details where mandated by local hospitality laws, room choices, and meal preferences. This data is subject to the hotel's own privacy notice and our Processor DPA.

Below is the transparent audit of cookies and local storage tokens utilized across our web application:

To deliver high availability and enterprise-grade reliability, HotelMate engages carefully vetted third-party sub-processors bound by strict confidentiality and data protection agreements under GDPR Article 28:

HotelMate operates its primary European infrastructure within EEA data centers (such as AWS Frankfurt and AWS Ireland). Where personal data is accessed or transferred outside the European Economic Area (for instance, to our specialized R&D center in Sri Lanka or cloud vendor personnel), we ensure an equivalent standard of protection through:

Under Chapter III of the GDPR, European and UK residents possess powerful, enforceable legal rights:

In accordance with GDPR Article 32, HotelMate implements comprehensive state-of-the-art security mechanisms calibrated to risk levels:

We do not retain personal data longer than necessary for the purposes for which it was gathered. Typical schedules include:

• Website Consent Preferences: Retained in your local browser storage for 12 months, after which re-confirmation is requested.
• Sales & Demo Inquiries: Retained for 24 months following the last active communication, unless a customer contract is signed or deletion is requested earlier.
• Client Contract & Billing Records: Retained for 7 years post-contract termination pursuant to statutory tax and financial audit requirements.
• Server Security & Access Logs: Retained on rolling 90-day automated purge cycles.

If you believe that our processing of your personal data infringes European or UK privacy regulations, you have the statutory right under GDPR Article 77 to lodge a formal complaint with a competent Data Protection Authority (DPA), in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement:

We review this Privacy Policy periodically to reflect technological advances, new HotelMate module launches, and evolving European case law. Any material change will be announced via an update banner on our site or by direct notification to active account administrators prior to taking effect.