Privacy Policy

We will NEVER sell Your Personal Data to Third Parties.

Scope

This Privacy Policy governs the processing of personal data by Hostaway Oy, a company organized under the laws of Finland, under Registration No 2726246-5 (“we”, “us” or “our”) as controller within the meaning of Article 4 no. 7 Regulation (EU) 2016/679 (General Data Protection Regulation – “GDPR”) in connection with our website at http://www.hostaway.com, our mobile applications available to download (“Apps”) and other products and services offered by us through the Website and/or the Apps (collectively, the “Services”).

Personal Data

Your personal data is very important to us. This Privacy Policy provides you with details about the personal data we collect from you, how we process your personal data, and your rights to control the personal data we process about you. Please read this Policy carefully.

Personal data processing for the operation of our website

In order to operate our website, i.e., to maintain it and make it available to you in a secure manner, usage and protocol data are processed, in particular, browser type and version, operating system, the individual device identifier of the user, service provider, IP address, date and time of access, originating website (last selected address) and subpages visited on our website.

This data may also be processed for the detection, analysis, and remediation of technical issues with the website as well as to ensure information security, in particular, to prevent and, if necessary, prosecute any misuse of or attack against the website.

This data may also be anonymized and used in an anonymous form for the improvement of the website and for statistical purposes.

The legal basis for these processing activities is Article 6(1)(f) GDPR. The relevant legitimate interests are the interest in operating our website in a technically secure manner, the interest to protect it against misuse or attack, and the interest to measure our website´s effectiveness and improve it.

Personal data processing in connection with Cookies

Our website uses cookies and similar technologies (for the purposes of this Privacy Policy, we refer to these technologies individually and collectively as “Cookies”). Cookies are text files containing small amounts of information that are stored in your web browser and your system. If the website is accessed, such a cookie can be installed in the system and browser.

We use various types of Cookies:

• Strictly necessary cookies allow certain website functionalities such as user login and account management. The website cannot be used properly without strictly necessary cookies. The legal basis for the processing of personal data via such cookies is Article 6(1)(f) GDPR. The relevant legitimate interest is the interest in operating the website and its features.
• Performance cookies are used to analyze how the website is used. The legal basis for the associated processing of personal data is your consent in conjunction with Article 6(1)(a) GDPR.
• Targeting cookies are used to identify visitors between different websites, e.g. content partners or banner networks, and deliver targeted advertising. The legal basis for the associated processing of personal data is your consent in conjunction with Article 6(1)(a) GDPR.

For more info about the cookies We make use of, please visit Our Cookie Information page.

Personal data processing in connection with contact forms, support etc.

The website provides a variety of features to contact us, in particular, to receive support, the contact form to schedule a demo call or to get pricing information, or to enquire about Hostaway’s Partnership or Affiliate programs.

In these cases, contact data (in particular, an e-mail address, full name, number of properties managed, phone number) and usage and protocol data (in particular date and time of usage, IP address) as well as the content of your message and/or request may be processed for the purpose of handling the same. The data may also be processed for the detection, analysis and remediation of technical issues with the contact form as well as to ensure security, in particular to prevent and, if necessary, prosecute any misuse of the contact features.

The legal basis for this processing is Article 6(1)(f) GDPR. The relevant legitimate interests are the interest to provide an official and secure way of getting into contact with us and handling any associated communication. Where your request is directed at establishing or performing a contractual relationship between you and us, the legal basis for this processing activity is instead Article 6(1)(b) GDPR.

Personal data processing in connection with Referral and Affiliate programs

The website provides the possibility to sign up for the Referral and Affiliate programs. When you participate in our Referral and Affiliate programs as a referrer, we may process certain personal data to verify your eligibility, including your name, e-mail address, and contact information, and to perform the contractual agreement underlying the Referral and Affiliate programs. If you participate in our Referral and Affiliate programs as a referee, we may process personal data, including your name, e-mail address, account data, and information on your contract and payment conditions, to perform both the contractual relationship with you and the contractual agreement underlying the Referral and Affiliate program with your respective referrer.

If you enter into a contractual agreement with us in your own name, the legal basis for this processing is Article 6(1)(b) GDPR. Otherwise, the legal basis for this processing is generally Article 6(1)(f) GDPR. The relevant legitimate interest is our interest to operate the Referral and Affiliate programs to increase our business.

Personal data processing in connection with the Hostaway Service login

The website provides the possibility to log in to your account to use the Hostaway Service. To operate this feature, your login credentials and metadata regarding your login, such as IP address, date/time of your login etc. are processed.

The legal basis for this processing is Article 6(1)(b) GDPR if the contractual agreement regarding the Hostaway Service is concluded between you and us. If it is instead concluded between the legal entity to which you belong (e.g., your employer) and us, the legal basis is Article 6(1)(f) GDPR. The relevant legitimate interest is our interest in providing our customers with a secure account to use our service.

Personal data processing in connection with the Hostaway Marketplace

The Hostaway Service can be used as an integrated solution in combination with other vacation rental tools and software as listed on the Hostaway Marketplace. When you choose to combine the Hostaway Service with the service of another provider, your personal data may be shared with the respective provider. This pertains to personal data as relevant for the integration to work as required by the Hostaway Service and the third party service, but will in any case, include your name, contact details, and an account ID.

The legal basis for this processing is Article 6(1)(b) GDPR if the contractual agreement regarding the Hostaway Service is concluded between you and us. If it is instead concluded between the legal entity to which you belong (e.g., your employer) and us, the legal basis is Article 6(1)(f) GDPR. The relevant legitimate interest is our interest in providing our customers with a flexible and attractive service offering.

Disclosure

For certain technical processes of data analysis, processing or storage, we use the support of external service providers. These service providers are carefully selected and meet high data protection and data security standards. They are bound by strict confidentiality and process data on our behalf and only according to our instructions.

We also cooperate with companies and other entities that have special expertise in certain areas or on specific topics (e.g. tax auditors, lawyers, consulting firms, logistics service providers). These entities are either subject to a professional secrecy obligation or have been obliged by us to confidentiality. If a transfer of personal data to these entities should be necessary, the legal basis for this is usually Article 6(1)(f) GDPR, as we have a legitimate interest in using the support of these entities.

Where we transfer personal data outside the EU/EEA, we ensure that an appropriate data transfer mechanism is in place. You can request more details on such mechanisms via the contact details below.

Retention

We store your data only as long as it is necessary for the fulfillment of the purposes for which we collected it, including the purposes of fulfilling legal, accounting or reporting requirements. When determining the appropriate retention period for data, we consider the amount, nature, and sensitivity of the data, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process your data, and whether we can achieve those purposes by other means, as well as the applicable legal requirements.

Required or voluntary provision of personal data

The personal data processed for the purposes of the operation of the website and in connection with strictly necessary cookies is collected automatically via the calling system or via placement of these cookies when you access the website. This means that while the provision of the personal data is not statutorily or contractually required, we cannot make the website available to you without processing that data.

The provision of personal data processed for any other purpose described above is voluntary. This means that the provision of the personal data is not statutory or contractually required. However, we cannot make the contact features, the Referral and Affiliate Programs, the Marketplace Partner program, or the Hostaway Service login available to you or use performance or targeting cookies without processing the respective data.

Rights regarding personal data

Providing the relevant statutory requirements are met (cf. Article 15 of GDPR), you have the right to access to your personal data, the right to have it rectified and/or supplemented, the right to have it erased or its processing restricted, the right to data portability and the right to withdraw your consent at any time.

You also have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Article 6(1)(f) GDPR. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing that override your rights, interests, and freedoms or the processing serves the establishment, exercise, or defense of legal claims.

You also have the right to file a complaint with a supervisory authority.

Contact details

Questions about this policy can be directed to support@hostaway.com

You can also address questions to our data protection officer at dpo@hostaway.com