Privacy Policy

The protection of personal data is important to us. Your personal data will be processed by us when using the Beds24 app, visiting our websites, when using our services and when contacting us as a supplier, service provider or comparable contractual partner. In the following, we would like to inform you about the nature, extent and purpose of the processing of your personal data. The terms we use, such as "Processing" or "Responsible" follow the content of the definitions of the General Data Protection Regulation (Article 4 GDPR).

Beds24 (hereinafter also: we) provides its customers with Software as a Service. Our customers can use this service to generate and manage their guests’ bookings which they receive directly, via their own websites or third parties and link these with other processing operations.

Insofar as Beds24 processes customers’ booking data, Beds24 acts as a data processor. Rights and obligations arising from data processing ensue in this respect from a separate agreement.

I. What types of data are processed for what purpose?

We process personal data only to the extent necessary to provide a functional app, website, content and services or with the consent of the user. An exception applies in cases where prior consent is not possible or where the processing of the data is permitted by other applicable legal provisions.

1. Data collection for contract execution with customers

If you make use of our SaaS as a paid service or in the context of a free trial, we will process the data entered in order to provide our services. The basic information we process includes:

Inventory data (e.g., names, addresses).
Contact information (e.g., e-mail, phone numbers).
Contract data (e.g., contract, term, customer category).
Payment details (e.g., bank details, payment history).
Usage data (e.g., data that includes both the temporal criteria of your use of our service and the extent of its use.).
Meta / communication data (e.g., device information, IP addresses).

The processing of this data serves the purpose of enabling the provision of the contractually agreed services; in particular to get in touch with you and to bill for services rendered to you. The legal basis for the processing of the data transmitted in the course of sending an e-mail is Article 6 (1) letter b GDPR.

2. Data collection for contract execution with supplier, service provider or comparable contractual partner

Insofar as you conclude contracts with us for the delivery of goods and services or submit preparatory offers to us or we request such, we will process your personal data insofar as this is necessary for the execution of the contract. The basic information we process includes:

Inventory data (e.g., names, addresses).
Contact information (e.g., e-mail, phone numbers).
Contract data (e.g., contract, term, duration).
Payment details (e.g., bank details, payment history).

II. Data deletion and storage duration

The data processed by us are deleted or limited in their processing in accordance with Articles 17 and 18 GDPR. Unless expressly stated otherwise in the context of this privacy policy, the data stored by us are deleted as soon as they are no longer required for their intended purpose and the deletion does not conflict with any statutory storage requirements. Insofar as the data is not deleted because it is required for other and legitimate purposes, its processing will be restricted, i.e. that data is blocked and not processed for other purposes. This applies, for example, to data that must be kept for commercial or tax reasons. In accordance with legal requirements in Germany, data is stored for 6 years pursuant to § 257 paragraph 1 HGB (account books, inventories, opening balance sheets, annual accounts, commercial letters, accounting documents, etc.) and for 10 years pursuant to § 147 Abs. 1 AO (books, records, financial reports, accounting documents, commercial and business letters, documents relevant to taxation, etc.).

III. Your rights

If your personal data are processed by us, you are a concerned person within the meaning of the GDPR. You then have the following rights in relation to us or the "controller" within the meaning of the GDPR:

Who is responsible for processing personal information?

Responsibility for the processing of personal data lies with Beds24 GmbH, Haussee Str. 14, D-16798 Fürstenberg, legal@beds24.com, Managing Director: Mark Kinchin.

Right of access to personal data

You may request confirmation from us as to whether personal information concerning you is processed by us. You can then request information from the controller regarding the following:

The purposes for which the personal data are processed;
The categories of personal data being processed;
The recipients or categories of recipients to whom the personal data relating to you have been or will be disclosed;
The planned period of storage of personal data concerning you or, if specific information is not available, criteria for determining the duration of storage;
The existence of a right to rectification or erasure of personal data concerning you, a right to restriction of processing by the controller or a right to object to such processing;
The existence of a right of appeal to a supervisory authority;
All available information on the source of the data if the personal data are not collected from the data subject;
The existence of automated decision-making including profiling under Article 22 (1) and (4) GDPR and, at least in these cases, meaningful information about the logic involved and the scope and intended impact of such processing on the data subject.

You have the right to request information about whether the personal data relating to you are transferred to a third country or to an international organization. You can request the appropriate guarantees in accordance with Art. 46 GDPR in connection with such transfers.

Right to Correction

You have a right to the correction and/or completion of your personal data by the controller, insofar as the processed personal data concerning you is incorrect or incomplete. The controller must make the correction without delay.

Processing restriction

You may request the restriction of the processing of your personal data under the following conditions:

If you contest the accuracy of your personal information for a period of time that enables the controller to verify the accuracy of your personal information;
The processing is unlawful and you reject the deletion of personal data and instead demand the restriction of the use of personal data;
The controller no longer needs personal information for the purposes of processing, but you need it for the purposes of enforcing, exercising or defending legal claims;
If you have objected to the processing in accordance with Art. 21 (1) GDPR and it is not yet certain whether the legitimate reasons of the person responsible outweigh your reasons.

If the processing of your personal data has been restricted, your personal data may be processed only with your consent, or for the purposes of asserting, exercising or defending legal claims or protecting the rights of another natural or legal person, or for reasons concerning the important public interest of the Union or of a Member State.

If processing is restricted according to the conditions referred to above, you will be informed by the controller before the restriction is lifted.

Deletion right

You may request that your personal information be deleted immediately if one of the following applies:

Your personal data are no longer necessary for the purposes for which they were collected or otherwise processed.
You revoke your consent to the processing in accordance with Art. 6 paragraph 1 letter a or Art. 9 paragraph 2 letter a GDPR and there is no other legal basis for processing.
You register an objection in accordance with Art. 21 paragraph 1 GDPR to the processing and there are no overriding justifiable reasons for the processing, or you register an objection to the processing in accordance with Art. 21 paragraph 2 GDPR.
Your personal data has been processed unlawfully.
The deletion of the personal data concerning you is required to fulfil a legal obligation under European Union law or the law of the Member States to which the controller is subject.
The personal data relating to you were collected in relation to information society services offered in accordance with Article 8 (1) GDPR.

Right to information disclosed to third parties

If the controller has made the personal data concerning you public and is obligated to delete this data in accordance with Article 17 (1) of the GDPR, the controller, taking into account the available technology and implementation costs, shall take appropriate measures, including of a technical nature, to inform data controllers who process the personal data that you as an affected person have demanded that such data controllers delete all links to this personal data or to copies or replications of this personal data.

Exceptions

The right to deletion does not exist if the processing is necessary

to exercise the right to freedom of expression and information;
to fulfil a legal obligation which requires the processing under the law of the European Union or of the Member States to which the controller is subject, or to carry out a task which is in the public interest or in the exercise of official authority conferred on the controller;
for reasons of public interest in the field of public health pursuant to Art. 9 (2) letter h and i and Art. 9 (3) GDPR;
for archival purposes of public interest, scientific or historical research purposes or for statistical purposes pursuant to Article 89 (1) GDPR, to the extent that the right referred to in subparagraph (a) is likely to render impossible or seriously affect the achievement of the objectives of that processing;
to assert, exercise or defend legal claims.

Right to Information

If you have made known to the controller your assertion of your right to the correction, deletion or restriction of the processing of your personal data, the controller is obliged to notify all recipients of your personal data of the correction or deletion of the data concerned or of the restriction of its processing unless this proves impossible or involves disproportionate effort. You have a right to demand that the controller inform you about these recipients.

Data portability

You have the right to receive data relating to your person that you have passed on to the controller in a structured, current and machine-readable format. In addition, you have the right to transfer this information to another person without hindrance by the controller who has provided you with the data relating to your person, provided that

the processing is based on an agreement pursuant to Art. 6 paragraph 1 letter a GDPR or Art. 9 paragraph 2 letter a GDPR or on a contract pursuant to Art. 6 paragraph 1 letter b GDPR and
processing is done by automated methods.

In exercising this right, you also have the right to have the personal data relating to you transmitted directly from one controller to another party, insofar as this is technically feasible. The freedoms and rights of others may not hereby be affected.

The right to data portability does not apply to the processing of personal data necessary for the performance of a task in the public interest or in the exercise of official authority conferred on the controller.

Right to object

You have the right at any time, for reasons arising from your particular situation, to register your objection to the processing of personal data concerning you that takes place pursuant to Art. 6 paragraph 1 letter e or f; this also applies to profiling based on these provisions.

The controller will no longer process the personal data relating to you unless he can demonstrate compelling legitimate grounds for processing that outweigh your interests, rights and freedoms, or the processing is for the purpose of enforcing, pursuing or defending legal claims.

If the personal data relating to you are processed for the purposes of direct marketing, you have the right to object at any time to the processing of your personal data for the purpose of such advertising; this also applies to profiling insofar as it is associated with such direct advertising.

If you object to processing for direct marketing purposes, your personal data will no longer be processed for these purposes.

Regardless of Directive 2002/58 / EC, you have the option, in the context of the use of information society services, of exercising your right to object through automated procedures that use technical specifications.

Right to revoke the data protection consent declaration

You have the right to revoke your data protection consent declaration at any time. The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent prior to the revocation.

Right to complain to a regulator

Irrespective of any other administrative or judicial remedy, you have the right to file a complaint with a supervisory authority, in particular in the Member State of its residence, place of work or the place of alleged infringement, if you believe that the processing of your personal data violates the GDPR.

The supervisory authority to which the complaint has been submitted shall inform the complainant of the status and results of the complaint, including the possibility of a judicial remedy under Article 78 of the GDPR.