Privacy policy

1.Our two roles

For people who visit this website, request a demo, write to us or use a hotel account (hotel owners and staff), LodgeLoom is the data controller: we decide why and how that data is processed.

For hotel guests, the hotel is the controller and LodgeLoom is a processor acting on the hotel’s documented instructions, under a data processing agreement (DPA) signed with each hotel. If you stayed at, or booked with, a hotel that uses LodgeLoom, the hotel is your first point of contact for your data. We help the hotel answer you.

2.What data we handle

Depending on how you interact with LodgeLoom, we process the following categories of data:

• Website visitors: technical data needed to deliver pages securely (IP address in server logs, the language you chose). We do not use analytics or advertising trackers.
• Contact and demo requests: your name, email, optional phone number, hotel name, number of rooms and your message, plus your IP address to prevent abuse of the form.
• Hotel accounts: name, email, role (owner, manager, receptionist, housekeeping), the properties you can access, an optional two-factor authentication secret and a quick-switch PIN, and an audit log of the actions you take.
• Hotel guests, on behalf of the hotel: contact details, stay details, special requests, the guest-registry fields Greek law requires for each adult (name, nationality, identity document type and number, birth date), messages exchanged with the hotel, and marketing consent with the time it was given. Identity document numbers are encrypted at rest.
• Payments for direct bookings: card payments are processed by Viva Wallet. LodgeLoom stores only payment metadata such as amounts, status and transaction references, never full card numbers.

3.Why we use it and on what legal basis

• To provide the service a hotel has signed up for: performance of a contract (Article 6(1)(b) GDPR).
• To answer demo and contact requests: steps taken at your request before entering a contract (Article 6(1)(b)) and our legitimate interest in replying to enquiries (Article 6(1)(f)).
• To keep the platform secure, prevent abuse and keep audit logs: our legitimate interest in protecting the service and its users (Article 6(1)(f)).
• To meet legal obligations, for example accounting or responding to lawful requests from authorities (Article 6(1)(c)).
• For hotel guests, the hotel determines the purposes and legal basis, such as performing your booking and meeting its guest-registry obligations.

4.Who we share data with

We do not sell personal data. We share it only with service providers that help us run LodgeLoom, each bound by a data processing agreement:

• Hetzner (Germany): hosting of the application and database on EU servers, managed through Laravel Forge.
• Cloudflare: domain name service and delivery network that protects and speeds up the website.
• Viva Wallet: card payments for hotels’ direct bookings.
• Beds24 or Smoobu: the channel manager each hotel chooses to connect, to synchronise reservations and availability.
• Anthropic (Claude): drafting suggested replies and translating guest messages. Hotel staff review and approve every message before it is sent; nothing is sent automatically.
• Postmark, where enabled: delivery of transactional email such as confirmations.
• Chatwoot, where enabled: live chat between a hotel and its guests.

Some providers, such as Anthropic, may process data outside the European Economic Area. In those cases transfers are covered by the European Commission’s Standard Contractual Clauses or an equivalent safeguard.

5.How long we keep data

• Contact and demo requests: up to 24 months after our last exchange, unless they lead to a contract.
• Hotel account data: for as long as the hotel’s contract runs, then deleted or returned within 30 days, except where we must keep records by law.
• Guest data: according to the hotel’s instructions and the retention periods of Greek law that apply to the hotel.
• Server logs: kept for a short period for security and troubleshooting.

6.How we protect data

• Encryption in transit (TLS) for every connection, and encryption at rest for identity document numbers.
• Role-based access: each person sees only what their role and assigned properties allow.
• Optional two-factor authentication for every account, and per-person audit trails.
• Hosting on EU servers with regular backups.

7.Your rights

You have the right to access, correct, delete, restrict or port your data, to object to processing based on legitimate interest, and to withdraw consent at any time. Our GDPR page explains each right and how to use it. To make a request, write to support@lodgeloom.com.

You can also lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).