Privacy Policy

1. Who we are

[Company legal name], [Address] (“we”, “us”) provides BestDealsHost, a property-management system for hotels and vacation rentals. For the processing described in this policy, we are the controller. You can reach us at [Privacy contact email]. [Data protection officer or EU/UK representative, if appointed.]

2. What this policy covers

This policy covers personal data about the people who use our service on behalf of our customers (“Users”), our customers’ billing contacts, people who sign up or contact us, and visitors to our website.

If you stayed at a property that uses our service, that property decides how your data is used and is responsible for it; we process it only on its behalf (see the Data Processing Agreement). Please contact the property to exercise your rights.

3. Data we collect

• Account data: your name, email address, password (stored only as a secure hash), two-factor authentication settings, language and the companies and roles you belong to.
• Company and billing data: company name, billing email and address, tax ID, plan, invoices and payment status.
• Usage and device data: log-in times, IP address, browser and device information, and the actions recorded in audit and security logs.
• Communications: messages you send us, for example support requests.

4. How we use it and why

• To provide the service and your account — necessary to perform our contract with your organisation.
• To keep the service secure, prevent abuse and investigate incidents — our legitimate interest in a safe service.
• To invoice customers and keep accounting records — legal obligations and contract.
• To send service messages, such as invitations, security alerts, invoices and important changes — contract and legitimate interest.
• To understand and improve how the service is used, using aggregated data where possible — legitimate interest.
• To send product news — only where allowed by law or with your consent; you can unsubscribe at any time.

5. Cookies and similar technologies

We use only what is needed for the service to work: a session cookie that keeps you signed in, and browser storage for preferences such as the theme and the property you last worked on. We do not use advertising cookies. [Analytics tools, if any, and how consent is collected.]

6. Who we share it with

• Service providers that help us run the service, such as hosting, file storage and email delivery, under contracts that protect your data (listed in the Data Processing Agreement).
• The administrators of the companies you belong to, who can see your name, email, role and activity in their workspace.
• Professional advisers, auditors and authorities, where required by law or to protect our rights.
• A buyer or successor, if our business is transferred, under the same protections.

We do not sell personal data.

7. International transfers

Your data is stored in [Primary hosting region]. If it is transferred to a country without an adequate level of protection, we use [Transfer mechanism — e.g. Standard Contractual Clauses].

8. How long we keep it

• Account and company data: for as long as the account exists. When a company’s subscription ends, its workspace data is deleted after 90 days.
• Invoices and accounting records: for [Statutory retention period, e.g. 7 years], as tax law requires.
• Security and access logs: for [Log retention period].
• Backups: deleted data disappears from backups within [Backup retention period].

9. Security

We protect personal data with encryption in transit and at rest, strict access controls, two-factor authentication, audit logging and regular backups. Our staff can view a customer’s workspace only read-only, for a limited time and with a recorded reason.

10. Your rights

Depending on the law that applies to you, you may have the right to access your personal data, have it corrected or deleted, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time. To exercise these rights, contact [Privacy contact email]. Data in a company workspace is controlled by that company; we may refer your request to it.

You also have the right to complain to a data protection authority, such as [Supervisory authority].

11. Children

The service is for businesses and is not directed at children.

12. Changes to this policy

We may update this policy. We will post the new version here with a new version date and, for significant changes, tell Users by email or in the service.