This Privacy Policy describes how the "Foyerhost" platform (hereinafter "Company", "We", "Us") collects, uses, stores, and protects the personal data of its users (Property Owners/Managers) and their end customers (Guests). Foyerhost is committed to fully complying with the European Union's General Data Protection Regulation (GDPR) (Regulation 2016/679).
1. Our Role under the GDPR
For the proper implementation of the legislation, we distinguish two separate roles:
As a Data Controller
We are responsible for the personal data we collect directly from Owners / Managers (name, contact details, billing details) for account creation and the provision of the service (SaaS).
As a Data Processor
We process Guests' personal data strictly and solely on behalf of and under the instructions of the Owners / Managers (who are the Data Controllers of this data), in order to process bookings, handle communication, and fulfill their legal/tax obligations.
2. What Data We Collect
A. Owners / Managers' Data
- Full name, email address, and phone number.
- Billing details (VAT number, Tax Office, Headquarters Address).
- Bank details (IBAN) exclusively for the remittance of bookings or fees (e.g., Climate Resilience Fee).
- Passwords for distribution channels (if provided for integration).
B. Guests' Data
- Full name, email, phone number.
- Booking data (dates, origin platform e.g., Airbnb, Booking.com, booking amount).
- Identification details (Passport Number / Identity Card Number).
- Tax details (VAT number, country of origin) for issuing legal invoices and submitting short-term rental declarations to the competent authorities on behalf of the Owner
- Conversation and message history (including those managed by Artificial Intelligence systems - AI Chatbot).
3. How We Use the Data and Legal Basis
Data processing is based on legal obligation (for tax purposes), the performance of our contract, and your explicit consent. The data is used exclusively for the following purposes:
- 1. The seamless operation of the software (Channel Management, Dynamic Pricing).
- 2. Communication with Guests and provision of 24/7 support.
- 3. Exporting booking data to facilitate the Owner and their external accountant in fulfilling their tax obligations.
- 4. Secure processing of payments and subscriptions.
4. Data Storage and Security
Server Location
All personal data is securely stored on Hetzner servers, geographically located in Germany(within the European Economic Area - EEA), ensuring their full protection based on European standards.
Security Measures
We implement modern encryption methods (SSL/TLS), regular backups, and strict access controls to prevent unauthorized access, alteration, or leakage of information.
5. Sharing with Third Parties (Sub-Processors)
Foyerhost does not sell or rent your personal data. Data transmission is only made to strictly necessary, vetted third-party providers (Data Processors), who are bound by the GDPR:
- Cloud Infrastructure Providers (Servers in Germany — Hetzner).
- Payment Management Platforms (Stripe).
- Channel management (Channex) and pricing (PriceLabs) integration systems.
- Artificial Intelligence (AI) service providers for communication automation.
- Cleaning and maintenance partners (sharing only the strictly necessary booking details).
6. Retention Period and Automatic Data Deletion
We implement a strict data minimization policy:
Owners' Data
Retained for as long as the account is active. After permanent account deletion, only strictly necessary billing information is retained for the period required by current national tax legislation.
Guests' Data (Automatic Deletion)
Sensitive guest identification details (Passport Numbers, ID Numbers, VAT Numbers) entered to fulfill the Owner's tax/legal obligations are automatically and permanently deleted from our systems sixty (60) days after the check-out date of the respective booking. Simple message history may be retained as anonymized data to improve Artificial Intelligence algorithms.
7. Data Breach Notification
As a Data Processor, Foyerhost is committed to notifying the Owner (Data Controller) without undue delay, and in any case within 48 hours, from the moment it becomes aware of any security breach leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of personal data of the guests or the owner themselves.
8. Minors' Data
Our services are not directed at individuals under the age of 18. Any data collection concerning minors (e.g., in the context of a family booking) is carried out exclusively through the adult guest who bears the legal responsibility (parent/guardian).
9. Your Rights
As data subjects, you retain the following rights under the GDPR:
Right of Access
You can request a copy of the data we hold about you.
Right to Rectification
You can request the correction of inaccurate data.
Right to Erasure ("Right to be Forgotten")
You can request the deletion of your data, provided this does not violate a legal obligation to retain it.
Right to Data Portability
To receive your data in a structured, commonly used format.
Note for Guests: If you are a Guest and wish to exercise your rights, your request should initially be addressed to the Property Owner / Manager (Data Controller), who will then give the deletion instruction to our platform.
10. Contact
For any questions, clarifications, or requests regarding this Privacy Policy and the management of your data, you can contact us:
See also our Terms of Use & Service Provision for the full legal framework.
Terms of Use