Clear Purpose
Information should be processed for a legitimate and defined operational, contractual, security or other applicable purpose.
HotelConnect24 Data Protection
Use Data Carefully. Limit Unnecessary Access. Protect the People Behind the Booking.
HotelConnect24 can process information relating to hotels, partner users, travellers, reservations and technical platform activity. Our data-protection approach is built around purpose limitation, controlled access, data minimisation and appropriate handling throughout the data lifecycle.
Responsible Data Lifecycle
Collect What Is Needed. Control Access. Retain It for a Reason.
Data Protection
HotelConnect24 Data Protection Framework
Protect data through purpose, minimisation, access controls, security measures and responsible lifecycle management.
Collect
Use
Protect
Retain
Property & Partner Data
Information needed to onboard and operate participating accommodation businesses and authorised partner accounts.
Traveller Information
Personal information may be involved where required to support a booking or related service.
Reservation Data
Booking information required to support the relevant accommodation and reservation workflow.
Technical Information
Operational and security-related information may be processed where necessary to run and protect the platform.
Purpose → Minimum Necessary Data → Controlled Access → Responsible Retention
The exact handling depends on the relevant service, relationship and applicable processing purpose.
Responsible
Purpose First
Know why information is being processed
Minimum Necessary
Avoid collecting data without a clear need
Controlled Access
Limit information to authorised users and systems
Lifecycle Management
Review retention instead of keeping everything indefinitely
Data Protection Principles
Build Data Protection into the Workflow.
Responsible data handling starts before information reaches the database. The purpose, required fields, permissions and retention approach should be considered when the workflow is designed.
Data Minimisation
Collect and use information that is relevant to the workflow rather than requesting additional personal data simply because it may be useful later.
Restricted Access
Data access should reflect the user's role, property relationship, technical purpose and authorised operational need.
Security Safeguards
Data protection depends on appropriate technical and organisational security measures around access, infrastructure and application workflows.
Retention Discipline
Information should not be kept indefinitely simply because storage is available. Retention should remain connected to an ongoing need.
Transparency
Relevant privacy information should explain important categories of processing, recipients and rights without making unsupported promises.
Data by Purpose
Different Workflows Need Different Information.
HotelConnect24 is not one single data-processing activity. Partner registration, hotel operations, reservations, support and integrations can each involve different information and responsibilities.
The platform should therefore avoid treating every data item as though it has the same purpose, retention period or access requirement.
✓
Partner onboarding
Use business and contact information needed to evaluate and establish the partner relationship.
✓
Hotel operations
Use property and account information needed to provide the relevant platform functionality.
✓
Bookings
Use relevant reservation information to support the accommodation transaction and related workflow.
✓
Security & support
Use relevant technical or account information to diagnose issues, protect access and respond to support requests.
Illustrative Data Flow
PURPOSE-BASED
01
Collect
Receive information required for a defined workflow
Need
02
Validate
Check whether data is usable and appropriate for the workflow
Check
03
Use
Process information for the applicable operational purpose
Purpose
04
Share Where Required
Provide data only to relevant authorised systems or recipients
Limit
05
Retain or Remove
Review continued need according to the applicable purpose and obligations
Review
Information Categories
What Types of Information Can Be Involved?
The exact information processed depends on the service being used, the property, the booking flow and the relationship between the parties.
Processing Roles
The Data-Protection Role Can Depend on the Workflow.
HotelConnect24 may have different responsibilities in different contexts. The legal and contractual role should be determined by who decides the purpose and means of the relevant processing activity.
HotelConnect24 as Decision Maker
For some activities, HotelConnect24 may determine why and how certain information is processed for its own business or platform purposes.
- Partner and account administration
- Platform security and abuse prevention
- HotelConnect24 support operations
- Business communications and relationship management
Processing on Behalf of a Hotel or Partner
For some services, HotelConnect24 may process information on behalf of a hotel or other business under the applicable contractual arrangement.
- Relevant reservation workflows
- Guest information connected to supported hotel services
- Technical processing required to deliver an agreed service
- Processing subject to the applicable business agreement
Important:
The examples above are general platform descriptions and do not by themselves
determine the legal role for every processing activity. The applicable role
depends on the actual service, decisions made by the parties and the relevant
contractual and legal context.
Data Lifecycle
Protection Should Continue After Data Has Been Collected.
A privacy-aware workflow considers what happens after information enters the platform: who can see it, where it needs to move, how long it remains necessary and when it should be removed or anonymised where appropriate.
The lifecycle should reflect the actual purpose of the information rather than applying one universal treatment to every data category.
✓
Collection
Request information only where there is a defined reason to process it.
✓
Access
Limit visibility to authorised users, services and approved integrations.
✓
Transfer
Share relevant information only where the workflow or applicable relationship requires it.
✓
Retention
Review whether information is still required rather than keeping it indefinitely without purpose.
Responsible Data Lifecycle
Illustrative operational model
01
Purpose Defined
Understand why the information is needed.
02
Minimum Data Collected
Request what the workflow reasonably requires.
03
Access Restricted
Make the information available only to relevant authorised parties.
04
Processing Monitored
Protect relevant operational and technical workflows.
05
Retention Reviewed
Remove or retain according to ongoing need and applicable obligations.
Access & Individual Requests
Privacy Requests Need the Right Route and the Right Identity Check.
Depending on the applicable processing context, individuals may have rights relating to information about them. Requests need to be evaluated according to the relevant role, applicable rules and identity of the requester.
Identity Verification
A privacy request should not become a way for an unauthorised person to obtain another individual's information.
Access Requests
Where applicable, a verified individual may request information about relevant personal data and processing.
Correction Requests
Inaccurate information may need to be reviewed and corrected where appropriate to the relevant processing activity.
Deletion Requests
A deletion request needs to be assessed against the relevant purpose, legal basis, contractual needs and any applicable retention obligations.
Data Copies
Where applicable, information may need to be provided in an appropriate format after the request and identity have been validated.
Restrictions & Objections
Other requests concerning processing may need to be assessed according to the relevant service and applicable legal framework.
Third-Party Processing
Some Platform Functions Depend on External Service Providers.
Where external providers process relevant personal data on behalf of HotelConnect24, their role should be considered as part of the wider data-protection framework.
Hosting & Technical Services
External infrastructure or hosting providers may support systems on which HotelConnect24 services operate.
Email & Messaging Services
Communication providers may support transactional, operational or business communications where configured.
Supporting Services
Other providers may support security, monitoring, support or related platform functions where required for the relevant service.
Retention
Different Information Can Require Different Retention Decisions.
HotelConnect24 should not publish one artificial retention period for all data categories when those categories may exist for different reasons.
01
Active Partner Relationships
Relevant account and business information may remain necessary while a partner relationship and operational account are active.
02
Reservation Information
Booking-related information may need to remain available for operational, support, accounting, dispute or other applicable purposes.
03
Security Logs
Technical records may be retained for an appropriate period where they support platform security, diagnosis or incident investigation.
04
Partner Applications
Information from unsuccessful or incomplete applications should not automatically be treated as permanently necessary.
05
Support Records
Support information may be retained while needed to resolve, document or follow up the relevant issue.
06
Legal or Contractual Requirements
Some information may need to be retained longer where applicable obligations or legitimate claims require it.
Security & Data Protection
Privacy Depends on Security Controls That Actually Protect Access.
Data protection and cybersecurity are related but not identical. Appropriate security controls help reduce unauthorised access, disclosure, alteration and loss of relevant information.
Authentication
Operational access should require appropriate identity verification before a user can reach protected hotel information.
Authorisation
A valid account should still be limited to the properties and data that the user or system is permitted to access.
Secure Connections
Public and authenticated web services should use secure HTTPS connections and appropriately protected server-side systems.
Practical Scope
This Page Explains Principles — Not Every Legal Detail of Every Processing Activity.
More specific information belongs in the Privacy Policy, Data Processing Agreement and applicable partner or service terms.
Important:
This Data Protection page provides a general explanation of HotelConnect24
data-handling principles and platform design. It is not a complete legal
notice for every processing activity and does not replace the HotelConnect24
Privacy Policy, Data Processing Agreement or applicable contractual terms.
The exact data processed, role of the parties, retention period, recipients
and applicable rights can vary according to the service, booking workflow,
jurisdiction and relationship between the parties.
Data Protection FAQ
Common Questions About HotelConnect24 Data Protection.
What types of personal information can HotelConnect24 process?
Depending on the service, HotelConnect24 may process partner contact
information, authorised account information, traveller or reservation
information, support information and relevant technical or security data.
The exact categories depend on the workflow being used.
Does HotelConnect24 collect every possible guest detail?
HotelConnect24 follows a data-minimisation approach. The platform should
request or process personal information that is relevant to the applicable
booking, operational, security or service purpose rather than collecting
additional information without a clear need.
Can every hotel user see every reservation?
No such access should be assumed. Operational access should depend on
the user's authorised account, property relationship, permissions and
the functionality available to that role.
Is HotelConnect24 always the controller of personal data?
No. The role can depend on the specific processing activity. HotelConnect24
may determine some processing for its own platform purposes, while in
other contexts it may process information on behalf of a hotel or another
business under the applicable contractual arrangement.
Does HotelConnect24 use subprocessors?
HotelConnect24 may use external service providers for infrastructure,
communications, security and other operational functions. Relevant
subprocessors are addressed on the Subprocessors page where applicable.
How long does HotelConnect24 keep personal data?
There is no single universal retention period for every category.
Retention depends on the purpose of the data, active business relationship,
reservation requirements, security needs and applicable contractual
or legal obligations.
Can someone request deletion of their data?
A verified deletion request can be reviewed according to the applicable
processing context. Whether particular information can or should be
deleted depends on the relevant purpose, role of the parties and any
applicable retention requirements.
How does HotelConnect24 protect personal data?
HotelConnect24 uses a layered security approach built around dedicated
authentication, authorisation, restricted system exposure, server-side
validation and appropriate operational security controls. See the
Security page for more detail.
Can technology or distribution partners access personal data?
External partners should receive only the information and permissions
required for the approved integration or booking workflow. Access should
not be assumed simply because a technical connection exists.
Where can I find the full HotelConnect24 privacy notice?
The HotelConnect24 Privacy Policy provides the dedicated privacy notice
for relevant HotelConnect24 processing activities. Business customers
should also review the Data Processing Agreement where applicable.
How can I submit a privacy-related request?
Use the official HotelConnect24 contact route and provide enough
information to identify the relevant account, booking or relationship.
HotelConnect24 may need to verify identity before disclosing or changing
personal information.
Responsible Booking Technology Needs Responsible Data Handling.
HotelConnect24 is designed to connect hotel operations and booking workflows while keeping data purpose, access, security and retention part of the platform architecture.