Privacy Policy
Guest XP AB, reg. no. 559545-9016 (referred to as “GuestXP”, “we”, “our”, “us”)
1. Introduction to this policy
Guest XP AB, reg. no. 559545-9016 (referred to as “GuestXP”, “we”, “our”, “us”), is responsible for the processing of personal data that we carry out as an independent data controller, for our own purposes. This includes personal data about users of our Service, personal data about our Customers' and prospective Customers' contact persons and other representatives, personal data about other individuals who contact us for any reason, and personal data processed in connection with our Gmail and Outlook integrations, all as further described below. GuestXP also processes personal data as a data processor on behalf of its Customers in order to provide the Service (for example, personal data about individuals who stay with, or otherwise interact with, our Customers, referred to as “Guests”). Such processing is carried out solely on the instructions of, and is governed by the data processing agreement with, the relevant Customer, and Guests should refer to that Customer's own privacy policy for information about such processing; it is not further described in this policy. By accepting this privacy policy, you consent to the processing described herein where consent is our legal basis for processing. If you have any questions or comments regarding our processing of personal data, you are always welcome to contact us directly through the contact details below.
Postal address: Kungstorget 7, 411 17 Göteborg
E-mail address: support@guestxp.io
It is in our best interest to handle personal data as safely as possible. We care about privacy and want to explain here how we process personal data for our own purposes as data controller.
2. Personal data and data controller
The following key terms are used in this policy.
"Personal data" means any information that can directly or indirectly identify a natural living person. Personal data can be, for example, name, telephone number, e-mail address and address, but also other information that can be linked to a physical living person.
“Processing” (and similar words such as ”process”) means any action taken, such as use or handling, by us in relation to personal data. The processing may either be automatic or manual.
“Data controller” means the person who is responsible for certain processing of personal data and thus determines the purposes of the processing. We, Guest XP AB, are the data controller for the personal data that we process for our own purposes, and the purpose of this Privacy Policy is to describe such processing. Where we instead process personal data as a data processor on behalf of our Customer (for example personal data about Guests), our Customer is the data controller for such processing, and it is not further described in this policy.
“Customer” means a hotel or other service provider within the hospitality industry which you visit or from which you buy other services, and to whom we provide our Service.
“Service” means the service provided by us to our Customers, being a “guest experience and loyalty platform” provided with the aim to enhance our Customer’s possibility to adjust and improve the experience of their guests.
3. Processed data, why it is being processed and on which legal basis
Below we describe the personal data we process for our own purposes as data controller, the purpose of such processing, and on which legal basis it is processed. We may also process personal data if you contact us for the purpose of managing such contact. The personal data we then process are those you provide to us, and we will process the personal data in accordance with applicable laws and regulations.
| Personal data | Purposes of processing | Legal basis |
|---|---|---|
| Service users:Name, work e-mail address, phone number, employer, job title, login credentials and usage data of individuals who use the Service on behalf of our Customer. | Providing, administering, maintaining and improving the Service; user account management and support; security and fraud prevention | Performance of our contract with the Customer, and our legitimate interest in operating and improving the Service |
| Customer contacts:Name, work e-mail address, phone number, employer and job title of our Customers' contact persons and other representatives. | Managing the customer relationship, including invoicing, contract administration and communication | Performance of our contract with the Customer, and our legitimate interest in managing our customer relationships |
| Prospective customer contacts:Name, work e-mail address, phone number, employer and job title of contact persons at companies we are in dialogue with, or wish to be in dialogue with, regarding the Service. | Marketing and sales activities, including sending marketing communications, and following up on inquiries | Our legitimate interest in marketing and developing our business |
| Other correspondents:Name, e-mail address, phone number and the content of any correspondence with individuals who contact us for any reason, for example through our website, by e-mail or at events. | Responding to and managing such contact and correspondence | Our legitimate interest in responding to inquiries directed at us |
4. Google Workspace & Microsoft 365 Integrations
This Section applies specifically to our Gmail and Outlook addon integrations (the "Addon"), which allow users of Google Workspace and Microsoft 365 to use certain features of the Service directly within their Gmail or Outlook mailbox.
Google API Services User Data Policy. GuestXP's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Message data processing. When using our Gmail or Outlook addon, we process and retain message data to operate, evaluate, maintain, and improve our services. We do not sell this data, use it for advertising, or share it to train third-party public models.
This Section does not limit or restrict our processing of personal data in connection with other third-party integrations we offer or may offer in the future.
5. Data retention
We will keep the personal data described in Section 3 above for as long as necessary to fulfil the purposes for which it was collected: for example, for as long as the Service user has an active account and thereafter for a reasonable period to comply with legal obligations or to establish, exercise or defend legal claims; for as long as the Customer relationship (or prospective Customer dialogue) is ongoing plus a reasonable period thereafter for the same reasons; or, for other correspondents, for as long as necessary to handle and, where relevant, follow up on the correspondence.
For the retention period applicable to message data processed via our Gmail and Outlook integrations, see Section 3 (Google Workspace & Microsoft 365 Integrations) above. We will delete or anonymize personal data when it is no longer needed for these purposes, and will delete inaccurate personal data as soon as we become aware of such data being inaccurate.
6. Sharing of personal data
From time to time, we may need to share your personal data with third parties outside our organisation, such as our data processors (for example IT service providers and consultants), our group companies, counterparties in litigation, public authorities, and potential purchasers of or investors in the company, and, if applicable, their respective employees, consultants and advisors. We never share more data than is necessary taking into account the purposes of the processing or what is required for such third parties to fulfil their obligations to us and for the fulfilment of the purposes of our processing as set out above.
We choose our suppliers with great care and enter into data processing agreements with all sub-processors, ensuring they may only process personal data in accordance with applicable law and our instructions. We may from time to time use third-party tools or sub-contractors for certain purposes, such as server management.
We may also be required to share your personal data with authorities that have the role of independent data controllers. If an authority is an independent controller, this means that we cannot control how the information provided to the authority is processed. Independent controllers with whom we may need to share your personal data in accordance with legislation or on suspicion of crime include the Police Authority and the Tax Authority. When your personal data is shared with an authority that is an independent controller, that authority's privacy policy and personal data processing applies.
7. Your rights and complaints
You have the following rights as we process your personal data (as detailed in the GDPR):
(i) You have the right to:
- (a)access the personal data that we process about you;
- (b)if any of the data is inaccurate and/or incomplete, have it rectified or completed;
- (c)object to the processing of your personal data;
- (d)require us to erase the personal data we process about you; and/or
- (e)require us to restrict our processing of your personal data.
(ii) You have the right to exercise your right to data portability.
(iii) If our processing of your personal data is based on your consent, you have the right to withdraw that consent (in relation to future processing).
If you wish to exercise your rights, please contact us via the contact details listed in Section 1 above. Please note that the rights listed above are not unlimited and are applied in accordance with the GDPR. For example, your right to invoke the rights listed above may be limited to the extent that we are required to process your personal data (i) under EU law or the national law of an EU Member State, or (ii) to perform a task carried out in the public interest.
You also have the right to complain about how we process your personal data if you believe it is not done in accordance with applicable law. You can do this by contacting the Data Protection Authority at imy@imy.se. Other contact information for the Data Protection Authority can be found here: https://www.imy.se/om-oss/kontakta-oss/.
8. Protection of personal data
We have implemented a high level of security to protect your personal data. Only authorized employees have access to personal data, and we comply with both legal obligations and our internal data protection guidelines.
9. Changes to the privacy policy
We may make changes to this Privacy Policy. The latest version of the policy is always available at guestxp.io/privacy. You will also receive written information about such updates which will be sent to your e-mail address.