Privacy policy

[PLACEHOLDER] Identify the controller: legal entity name, registered address, and the contact point for data protection enquiries. If a Data Protection Officer or EU/UK representative is required, name them here.

[PLACEHOLDER] State clearly that the hotel is the controller of guest personal data and Welvoy acts as processor on the hotel's instructions, and that Welvoy is controller for its own account and website data. Reference the data processing agreement that governs the processor relationship.

[PLACEHOLDER] List the categories actually processed by the product, which at minimum include: guest name and contact details, the guest's WhatsApp number, check-in details, identity document images captured during check-in, housekeeping and dining requests, and ops console user accounts and audit log entries.

[PLACEHOLDER] Identity documents are a special category in several jurisdictions. State the lawful basis, the retention period and the deletion mechanism explicitly.

[PLACEHOLDER] State the purpose and lawful basis for each category, including performance of the accommodation contract, legal obligations relating to guest registration, and legitimate interests for service operation and security.

[PLACEHOLDER] Explain that messages are delivered over the WhatsApp Business Platform operated by Meta, what Meta receives as a result, and link to Meta's own terms and privacy documentation.

[PLACEHOLDER] List every sub-processor with its role and processing location, and describe how hotels are notified of changes.

[PLACEHOLDER] State where data is stored and processed, and the transfer mechanism relied on for any transfer out of the EEA or UK.

[PLACEHOLDER] State a retention period per data category, with particular care for identity documents and message content.

[PLACEHOLDER] Describe the technical and organisational measures actually in place, including per-hotel data isolation, role separation and audit logging. Do not claim certifications that have not been obtained.

[PLACEHOLDER] Set out data subject rights and how to exercise them, and explain that guest requests are normally routed through the hotel as controller.

[PLACEHOLDER] State what this website sets. If analytics or any non-essential cookie is added later, a consent mechanism must be added with it. As built, this site sets no cookies and loads no third-party analytics.

[PLACEHOLDER] Give the address for privacy enquiries and the supervisory authority a complaint can be made to.