Use HotelConnect24 Responsibly. Protect the Platform. Protect Hotels and Guests.

Scope of This Policy

This Acceptable Use Policy (“AUP”) applies to use of HotelConnect24 services operated by Bigmedia24 Dynamics Ltd., including where applicable:

• public HotelConnect24 websites;
• Partner accounts;
• hotel dashboards;
• booking functionality;
• APIs;
• webhooks;
• integrations;
• HotelConnect24 Network functionality;
• developer functionality;
• support systems;
• Property content;
• reservation information; and
• other connected HotelConnect24 technology.

This AUP applies to Hotel Partners, authorised hotel users, developers, technology partners and any other person or organisation given access to protected HotelConnect24 functionality.

Authorised Use

HotelConnect24 may only be used for legitimate purposes within the scope of the access, permissions and functionality granted to you.

You must not access or attempt to access functionality, systems, accounts or data for which you do not have permission.

Possession of a technical URL, endpoint, identifier, token or other information does not itself create authorisation to use it.

Accounts, Passwords and Credentials

Users must protect authentication credentials associated with HotelConnect24.

You must not:

• share personal login credentials with unauthorised persons;
• publish passwords or authentication secrets;
• publish private API keys;
• expose access tokens unnecessarily;
• sell or transfer account access without authorisation;
• use credentials belonging to another user without permission; or
• deliberately leave compromised credentials active.

If you reasonably believe credentials have been compromised, you should revoke, rotate or change them where possible and notify HotelConnect24 where assistance is required.

Unauthorised Access

You must not attempt to gain unauthorised access to HotelConnect24 or connected systems.

Malware and Harmful Technical Activity

HotelConnect24 must not be used to create, upload, transmit, host, execute or distribute malware or other harmful code.

Prohibited activity includes:

• viruses;
• ransomware;
• trojans;
• credential-stealing software;
• malicious scripts;
• destructive payloads;
• botnet activity;
• cryptojacking;
• malicious redirects; and
• code intended to compromise connected systems.

HotelConnect24 may immediately isolate or block activity that presents a credible security threat.

Fraud, Impersonation and Deception

HotelConnect24 must not be used to facilitate fraud or deliberate deception.

You must not:

• register a Property you are not authorised to represent;
• impersonate another hotel, business or individual;
• create deliberately fictitious reservations for fraudulent purposes;
• manipulate booking records to avoid legitimate charges;
• misrepresent the origin of a booking;
• provide false verification information;
• misrepresent Property identity or ownership;
• use HotelConnect24 to facilitate payment fraud; or
• use deceptive practices to obtain Guest or Partner credentials.

Property, Rate and Booking Data

Hotel Partners must not knowingly submit materially false or misleading Property, rate, availability or reservation information.

This includes deliberate manipulation of:

• room availability;
• room types;
• rate plans;
• Property facilities;
• location information;
• cancellation conditions;
• tax or mandatory-fee information;
• booking status;
• Guest occupancy;
• HotelConnect24 Network attribution; or
• other material reservation information.

Ordinary mistakes should be corrected promptly once identified. This section is directed at deliberate or materially negligent misuse, not accidental administrative errors.

Guest Data and Personal Information

Access to Guest information must be limited to legitimate purposes connected with reservations, accommodation services, legal obligations or other lawful hotel operations.

You must not:

• browse Guest records without a legitimate business reason;
• sell Guest data obtained through HotelConnect24;
• publish reservation information publicly;
• use Guest data for unrelated profiling without a lawful basis;
• export personal data merely to build unrelated databases;
• share Guest data with unauthorised third parties; or
• use HotelConnect24 as a repository for unnecessary sensitive personal data.

Use of personal data is also subject to applicable data-protection law, the Privacy Policy and, where applicable, the Data Processing Agreement.

APIs, Webhooks and Integrations

APIs, webhooks and integration interfaces may only be used within their documented and authorised scope.

Users and connected systems must:

• authenticate using authorised credentials;
• protect API keys and tokens;
• follow applicable API documentation;
• respect endpoint permissions;
• validate requests and responses appropriately;
• handle webhook secrets securely where provided;
• respect rate limits;
• avoid unnecessary or excessive requests; and
• stop using revoked or expired credentials.

A technically discoverable endpoint is not necessarily a public or authorised API endpoint.

Automated Access, Bots and Machine-to-Machine Use

Legitimate automation is an intended part of many hospitality workflows, but automation must use authorised interfaces and operate responsibly.

Automated access is permitted where it is:

• provided through an authorised API or integration;
• expressly supported by HotelConnect24;
• approved under an applicable agreement; or
• otherwise clearly authorised.

Automated systems must not be used to overwhelm services, circumvent security controls or access information outside their authorised scope.

Scraping, Harvesting and Bulk Extraction

Users must not perform unauthorised bulk extraction of protected HotelConnect24 information.

Prohibited activity can include:

• scraping protected Partner dashboards;
• harvesting Guest information;
• extracting reservation databases without authorisation;
• systematically copying protected Property data beyond permitted use;
• harvesting email addresses or contact information for spam;
• circumventing technical controls intended to limit extraction; or
• using protected HotelConnect24 data to create an unauthorised competing database.

Ordinary search-engine indexing of public pages can be permitted subject to HotelConnect24 technical controls such as robots directives and applicable law.

Bulk commercial extraction, model-training use or systematic reuse of protected HotelConnect24 datasets requires appropriate authorisation where rights or access restrictions apply.

Rate Limits and Technical Controls

HotelConnect24 may apply rate limits, quotas, concurrency controls, request-size limits or other technical safeguards.

You must not deliberately circumvent those controls by methods such as:

• rotating accounts to evade limits;
• rotating credentials solely to bypass quotas;
• distributing abusive requests across multiple sources;
• manipulating headers or identifiers to defeat enforcement;
• repeatedly retrying requests in a way that creates avoidable load; or
• using undocumented endpoints to bypass supported workflows.

If legitimate hotel operations require higher limits, the appropriate route is to discuss the technical requirement with HotelConnect24.

Interference with HotelConnect24 Systems

You must not deliberately impair the availability, integrity or performance of HotelConnect24.

This includes:

• denial-of-service activity;
• resource exhaustion attacks;
• deliberately excessive API calls;
• malformed traffic intended to disrupt systems;
• attempts to corrupt data;
• deliberately creating reservation loops;
• webhook loops designed or knowingly allowed to cause disruption;
• interference with monitoring or logging;
• tampering with security controls; or
• attempts to interfere with other Partners' access.

Hotel and Partner Content

Content submitted to or distributed through HotelConnect24 must be lawful and appropriate to the relevant hospitality service.

Partner Content must not:

• deliberately misrepresent a Property;
• contain fraudulent claims;
• infringe third-party intellectual-property rights;
• unlawfully disclose personal data;
• contain malware or malicious links;
• impersonate another business;
• contain unlawful discriminatory booking restrictions;
• promote illegal activity; or
• otherwise violate applicable law.

HotelConnect24 may request correction or remove access to content that materially violates this Policy.

Intellectual Property and Rights of Others

Users must only upload or distribute content that they are authorised to use.

This includes:

• hotel photographs;
• logos;
• trademarks;
• Property descriptions;
• videos;
• maps or illustrations;
• software;
• documentation; and
• other protected material.

You must not knowingly use HotelConnect24 to infringe copyright, trademark or other intellectual-property rights.

Repeated or serious rights violations may result in restrictions where legally and contractually appropriate.

Illegal Content and Unlawful Activity

HotelConnect24 must not be used to store, publish, distribute or facilitate content or activity that is unlawful under applicable law.

Examples can include content or activity involving:

• fraud;
• identity theft;
• unauthorised access;
• malware distribution;
• unlawful threats;
• illegal exploitation;
• criminal financial activity;
• unlawful sale of restricted goods or services; or
• other content that a competent authority or applicable law requires to be restricted.

HotelConnect24 will assess reports according to the actual content, applicable law and the service involved rather than assuming that every allegation automatically requires removal.

Spam and Unauthorised Messaging

HotelConnect24 communication functionality must not be used for unsolicited bulk messaging or other unlawful electronic marketing.

You must not:

• send spam through HotelConnect24 systems;
• harvest Guest addresses for unrelated bulk marketing;
• send deceptive booking messages;
• spoof sender identity;
• send phishing messages;
• misrepresent communications as HotelConnect24 messages; or
• use communication tools in violation of applicable direct-marketing law.

Operational communications legitimately connected with a reservation or hotel service are distinct from promotional marketing.

Payment and Financial Abuse

HotelConnect24 must not be used to facilitate payment abuse, fraudulent refunds or manipulation of financial records.

Prohibited activity includes:

• fraudulent payment instructions;
• deliberately falsifying transaction status;
• manipulating booking values to evade legitimate fees;
• misrepresenting refunds;
• using stolen payment credentials;
• attempting to obtain full Guest card credentials through HotelConnect24 messages; or
• using HotelConnect24 to facilitate money laundering or other unlawful financial activity.

Security Testing and Vulnerability Research

HotelConnect24 welcomes responsible reporting of genuine security concerns, but this does not create unrestricted permission to test, scan or exploit HotelConnect24 systems.

Unless HotelConnect24 has expressly authorised a security test, you must not:

• conduct destructive penetration testing;
• access another user's data;
• exfiltrate Guest or Partner information;
• perform denial-of-service testing;
• deploy malware;
• use social engineering against HotelConnect24 staff or Partners;
• physically attack infrastructure;
• persist inside a compromised system; or
• publish sensitive vulnerability details before HotelConnect24 has had a reasonable opportunity to investigate and mitigate the issue.

Where formal testing authorisation is granted, the authorised scope and conditions govern that testing.

Responsible Vulnerability Reporting

If you discover a potential HotelConnect24 security issue during ordinary authorised use, please report it through HotelConnect24 rather than exploiting the issue.

A useful report can include:

• the affected service;
• a concise description of the issue;
• steps required to reproduce it without unnecessary exploitation;
• the potential security impact;
• relevant timestamps; and
• technical information reasonably necessary to investigate.

Security concerns can be routed through the HotelConnect24 Contact page and clearly marked as a security matter.

HotelConnect24 does not currently state that a public bug-bounty programme or financial reward applies unless separately announced.

Circumvention of Security or Access Controls

Users must not intentionally bypass controls designed to protect HotelConnect24 or connected systems.

This includes attempts to bypass:

• authentication;
• authorisation;
• CAPTCHA or anti-abuse controls;
• Cloudflare Turnstile or equivalent protections;
• rate limits;
• access restrictions;
• account suspension;
• network controls;
• API permissions; or
• technical restrictions protecting Guest or Partner data.

Creating another account or using another integration solely to evade a legitimate restriction can itself violate this Policy.

Resource Abuse

HotelConnect24 resources must not be used for unrelated high-resource workloads that interfere with hospitality services or system operation.

Examples include:

• cryptocurrency mining;
• unrelated bulk-compute workloads;
• storage of excessive unrelated files;
• using HotelConnect24 infrastructure as a proxy for unrelated traffic;
• abusive crawling;
• deliberately generating excessive logs or events; or
• other disproportionate use unrelated to the authorised service.

Third-Party Systems and External Channels

Connections to External Channels and technology providers must be used consistently with both HotelConnect24 permissions and the rights granted by the third-party provider.

You must not use HotelConnect24 to:

• circumvent an External Channel's security;
• access third-party data without permission;
• misuse another provider's credentials;
• violate a third-party API's lawful access controls; or
• cause HotelConnect24 to transmit unlawful or unauthorised requests to another service.

HotelConnect24 connectivity does not grant rights to another provider's systems beyond those actually authorised.

Security Monitoring and Abuse Detection

HotelConnect24 may use proportionate technical and organisational measures to protect the service, investigate suspected abuse and enforce this Policy.

These measures can include relevant:

• authentication logs;
• request logs;
• rate-limit information;
• security-event detection;
• network-security controls;
• account activity records;
• anti-abuse signals;
• automated technical security rules; and
• human review where appropriate.

Such measures must be used consistently with applicable data-protection and other legal requirements.

Enforcement of This Policy

HotelConnect24 may take proportionate action where it reasonably determines that this Policy, an applicable agreement or law has been violated.

HotelConnect24 will consider factors such as:

• severity;
• actual or potential harm;
• whether the conduct was deliberate;
• security risk;
• impact on Guests or other Partners;
• previous violations;
• whether the issue can be corrected;
• legal obligations; and
• urgency.

When Immediate Action May Be Necessary

HotelConnect24 may act without advance warning where waiting would create a material risk.

Examples can include:

• active account compromise;
• malware distribution;
• ongoing fraud;
• credential theft;
• unauthorised Guest-data access;
• denial-of-service activity;
• a serious threat to connected systems;
• a legally binding order; or
• another urgent security or legal risk.

Where appropriate and legally required, HotelConnect24 will provide relevant reasons or information after immediate protective action has been taken.

Review of an Enforcement Decision

If a Hotel Partner believes that an account, Property, integration or content restriction has been applied incorrectly, the Partner can ask HotelConnect24 to review the decision.

A review request should include:

• the affected account or Property;
• the relevant restriction;
• why the Partner believes the decision should be reconsidered;
• relevant supporting information; and
• any corrective steps already taken.

Requests can be submitted through Hotel Partner Support or Contact.

A review does not automatically suspend a security restriction while a continuing risk remains.

Where applicable law requires a particular internal complaint or redress procedure, HotelConnect24 will apply the legally required process.

Reports of Illegal Content or Misuse

A person who believes specific information or activity on a HotelConnect24 service is unlawful or materially violates this Policy can report the issue to HotelConnect24.

A useful report should identify:

• the specific content, Property, account or functionality concerned;
• where it appears;
• the nature of the alleged violation;
• relevant supporting information; and
• contact information where appropriate for follow-up.

HotelConnect24 will assess reports according to the service involved, available evidence, applicable law and the rights and interests of affected parties.

Submitting a report does not guarantee that content or an account will automatically be removed.

Changes to This Acceptable Use Policy

HotelConnect24 may update this Policy where reasonably necessary because of:

• new platform functionality;
• security developments;
• new APIs or integrations;
• changes in abuse patterns;
• new legal requirements;
• changes in HotelConnect24 services; or
• clarification of existing rules.

The latest version will be published on this page with an updated revision date.

Where a significant change materially affects existing users and applicable law or contract requires notification, HotelConnect24 will provide appropriate notice.

Questions, Security Reports and Policy Concerns

Contact HotelConnect24 if you need clarification about permitted platform use, want to report a security concern or believe that a HotelConnect24 service is being misused.