Privacy Policy
Last updated: July 23, 2026
1. Data controller
Bookotels is the controller of your personal data (the publishing legal entity and its registered office are set out in our Legal Notice). Data protection contact: [email protected]
2. Regulatory framework
We process your data in accordance with the UK GDPR and the Data Protection Act 2018 (United Kingdom), as well as the EU General Data Protection Regulation (GDPR, EU 2016/679) for visitors and customers located in the European Economic Area.
3. Data collected
We collect: name, email address, phone number, connection data (IP address, logs), browsing data (via analytics cookies, with your consent), professional information (agency, company). For end customers of a booking: name, email, phone, and where necessary the information required for the booking (date of birth, nationality, travel document number).
4. Processing purposes
Your data is processed to: manage your account and authentication, provide the platform's services (search, quotes, bookings, payments), manage the business relationship and support, send professional communications about our services (which you may object to at any time), measure audience and improve our services, and comply with our legal and accounting obligations.
5. Legal basis
Each processing activity relies on a legal basis: performance of the contract (Terms) for providing the services, your consent for analytics cookies, our legitimate interests for business-to-business outreach to our partner agents, for security and for service improvement, and compliance with legal and regulatory obligations.
6. Recipients & processors
Your data may be shared with processors acting on our behalf: Hetzner Online GmbH (hosting, Germany), Cloudflare, Inc. (content delivery and security), Supabase (database and authentication), Stripe (payments), Amazon Web Services / SES (email and document delivery), and PostHog (analytics). Tourism service providers receive only the information strictly necessary to fulfil bookings. We never sell your data.
7. International transfers
Some processors may handle data outside the UK / EU. Such transfers are covered by appropriate safeguards (European Commission standard contractual clauses, the UK International Data Transfer Agreement / addendum, or adequacy decisions).
8. Cookies
We use strictly necessary cookies for the functioning of the site (authentication, security, language preference), which are set without consent as they are essential. We also use analytics cookies (PostHog) only after your consent, collected via our consent banner. You can accept, refuse or withdraw your consent at any time; refusing analytics cookies does not affect access to the site.
9. Retention period
Account data: for the duration of the contractual relationship, then archived for 3 years. Billing data: 6 years (UK accounting requirement). Browsing / analytics data: 13 months maximum. Professional communications: until you unsubscribe, which takes one click from any email or from your agent account settings.
10. Your rights
Under the UK GDPR and the GDPR, you have the rights of access, rectification, erasure, restriction, portability and objection, as well as the right to withdraw your consent. To exercise them: [email protected]. You may lodge a complaint with the ICO (Information Commissioner's Office, UK authority — ico.org.uk) or, if you are in the EU, with your local data protection authority (for example the CNIL in France).
11. Security
We implement appropriate technical and organizational measures: encryption in transit (HTTPS/TLS), secure authentication, restricted data access, logging and regular audits.