UpStay Privacy Policy
What is the purpose of this privacy policy?
What personal data does UpStay process?
As a third-party service provider to our business partners, UpStay generally receives personal data that was initially disclosed by guests to our business partners in connection with a hotel booking or purchase, for the purpose of providing the Services to our business partners in accordance with the applicable service contract.
UpStay may also receive from its business partners information about guests’ service requests (e.g. pre-ordered hotel amenities, room category, board type). When such information is processed by UpStay and is associated to an individual, it is treated as personal data for the purposes of this Privacy Policy.
We collect from our business partners, prospects and Site visitors information that is entered on our Site or sent to us electronically, for example when business partners purchase our Services or when our Site visitors request more information. We may also collect personal data that you provide to us when you attend one of our events, during phone calls with sales representatives or when you contact customer support.
From where does UpStay obtain personal data?
a) Personal Data About Guests:
UpStay obtains personal data provided by guests in connection with a booking or purchase of hotel services from hospitality industry companies that are our business partners, for the purpose of enabling guests to participate in booking upgrades and related services provided by UpStay in accordance with the applicable service contract.
b) Personal Data About Business Partners, Prospects, Site Visitors:
UpStay obtains the personal data that it processes, stores and discloses when this data is provided to us or collected as described under the “What personal data does UpStay process?” paragraph.
What are the legal basis and purposes for which UpStay processes personal data?
We use guests’ information to provide the Services to the hospitality industry companies we work with as business partners. We will also use this information to help improve product features or provide service enhancements and support our business partners in their current program and ongoing growth pursuant to our service contract.
The use of an individual’s personal data will be limited to the purposes for which it was collected by our business partners – to provide the booking upgrades and related services – as agreed to in our service agreement with our business partners.
It is the responsibility of our business partners to ensure that they lawfully obtain personal data from guests. As UpStay provides the technology upon which our business partners provide services to guests, when guests wish to change their options regarding their personal data, UpStay will process such wishes on behalf of our business partners and pursuant to their instructions.
We use our business partners’, prospects’ and Site visitors’ personal data as necessary to respond to inquiries regarding our services, fulfil the relevant contract, send promotional emails and other communications (so long as you agree to receiving these communications) and as necessary for our legitimate interests in the processing.
How long does UpStay retain personal data?
UpStay retains guests’ personal data for the duration of our service agreement with our business partners, unless a longer or shorter retention period is requested, required or permitted by applicable laws.
We keep the other personal data subject to this Privacy Policy only for as long as is reasonably necessary for the purposes described in this Policy, or for the duration required by law, whichever is the longer.
To which countries does UpStay transfer personal data as part of offering its services?
As part of our service offering and to meet our contractual obligations, we transfer personal data from its source of origin to Israel, the United States, and our business partners’ residential countries. We may also subcontract processing to, or share, guests’ personal data with third parties located in countries other than their home country.
Does UpStay share personal data with third parties?
UpStay shares guests’ personal data to third parties only as necessary to fulfil its service contract with its business partners and pursuant to its business partners’ instructions, or otherwise required by the applicable law.
UpStay shares its business partners’, prospects’ and Site Visitors’ personal data with third parties who support its business operations or as required or permitted by the applicable law.
What privacy rights do individuals have regarding their own personal data?
Data subjects in the European Union (EU) have certain rights with respect to the processing of their personal data, described below (for these purposes, reference to the EU also includes the European Economic Area countries of Iceland, Liechtenstein and Norway and, where applicable, Switzerland).
a) Guests' Rights:
Guests have the right to submit the following requests regarding their personal data to our business partners to whom guests have previously provided their personal data, subject to applicable law:
Request access to and/or correction of their own personal data; Request the erasure of their own personal data; Request that UpStay’s business partners stop processing or restrict the processing of their own personal data; Request that UpStay business partners provide them with their personal data in a structured, commonly used and machine-readable format and transmit those data to another organization; Upon notification from our business partners of a guest’s request to exercise her rights, we will enable such requests to ensure our business partners’ compliance with applicable regulatory requirements in accordance with the service contract with the applicable business partner.
b) Business Partners', Prospects', Site Visitors’ Rights:
How does UpStay protect personal data?
UpStay will take reasonable precautions, including the implementation of appropriate physical, electronic and administrative procedures, to protect personal data from loss, misuse and unauthorized access, disclosure, alteration and destruction. Although we employ technical safeguards, we cannot guarantee the security of personal data on or transmitted via the Internet.
How is this privacy policy enforced at UpStay?
UpStay follows an internal compliance monitoring process, to assure compliance with this Privacy Policy and periodically verifies that it is accurate, comprehensive for the information intended to be covered, prominently displayed, completely implemented and accessible, and in conformity with privacy and data protection legislation applicable to UpStay.
Information according to Art 27 EU GDPR
We appointed GDPR-Rep.eu as representative according to Art 27 GDPR. If you want to make use of your GDPR data privacy rights, please visit: https://gdpr-rep.eu/q/12535979
Contact GDPR-Rep.eu:
- Maetzler Rechtsanwalts GmbH & Co KG
- Attorneys at Law
- c/o Ancillary Streams Ltd. (UpStay)
- Schellinggasse 3/10, 1010 Vienna, Austria
- Please add the following subject to all correspondence:
- GDPR-REP ID: 12535979
How to contact UpStay?
UpStay acts as the data processor for the processing of guests’ personal data on behalf of hospitality industry companies that are UpStay’s business partners, pursuant to our service contract with the applicable business partner.
We act as the data controller for the processing of personal data about our business partners, prospects and Site visitors for the purposes described in this Privacy Policy.
Questions, comments or complaints regarding our Privacy Policy or data processing practices can be emailed directly to UpStay’s Data Protection Officer: dpo@upstay.tech