Privacy Policy

UpStay Privacy Policy

This Privacy Policy explains what data we collect from visitors to our website www.upstay.tech (including all subdomains, the “Site“) and/or our services and in connection with our events, and sales and marketing activities, how we process and protect personal data and your rights and choices with respect to your personal data.

What is the purpose of this privacy policy?

UpStay provides a software product and services (together, the “Services“) that enable hospitality industry companies (i.e., UpStay’s “business partners“) to offer their customers (“guests“) the opportunity to upgrade their room and other elements of their hotel stay experience, subject to each business partners’ individual discretion and the availability of the offering. Protecting privacy is important to us and to our business partners. This is why we are committed to ensuring the security and confidentiality of the personal data we receive and process from our business partners as part of the services we provide to them. We are also committed to providing a software product that meets industry best practices and regulatory requirements for privacy and data protection. The purpose of this Privacy Policy is to inform UpStay’s business partners and guests about our privacy and data handling practices. This Privacy Policy also applies to data we collect from visitors of the Site and in connection with our events, and sales and marketing activities.

What personal data does UpStay process?

As a third-party service provider to our business partners, UpStay generally receives personal data that was initially disclosed by guests to our business partners in connection with a hotel booking or purchase, for the purpose of providing the Services to our business partners in accordance with the applicable service contract.

UpStay may also receive from its business partners information about guests’ service requests (e.g. pre-ordered hotel amenities, room category, board type). When such information is processed by UpStay and is associated to an individual, it is treated as personal data for the purposes of this Privacy Policy.

We collect from our business partners, prospects and Site visitors information that is entered on our Site or sent to us electronically, for example when business partners purchase our Services or when our Site visitors request more information. We may also collect personal data that you provide to us when you attend one of our events, during phone calls with sales representatives or when you contact customer support.

From where does UpStay obtain personal data?

a) Personal Data About Guests:

UpStay obtains personal data provided by guests in connection with a booking or purchase of hotel services from hospitality industry companies that are our business partners, for the purpose of enabling guests to participate in booking upgrades and related services provided by UpStay in accordance with the applicable service contract.

b) Personal Data About Business Partners, Prospects, Site Visitors:

UpStay obtains the personal data that it processes, stores and discloses when this data is provided to us or collected as described under the “What personal data does UpStay process?” paragraph.

What are the legal basis and purposes for which UpStay processes personal data?

We use guests’ information to provide the Services to the hospitality industry companies we work with as business partners. We will also use this information to help improve product features or provide service enhancements and support our business partners in their current program and ongoing growth pursuant to our service contract.

The use of an individual’s personal data will be limited to the purposes for which it was collected by our business partners – to provide the booking upgrades and related services – as agreed to in our service agreement with our business partners.

It is the responsibility of our business partners to ensure that they lawfully obtain personal data from guests. As UpStay provides the technology upon which our business partners provide services to guests, when guests wish to change their options regarding their personal data, UpStay will process such wishes on behalf of our business partners and pursuant to their instructions.

We use our business partners’, prospects’ and Site visitors’ personal data as necessary to respond to inquiries regarding our services, fulfil the relevant contract, send promotional emails and other communications (so long as you agree to receiving these communications) and as necessary for our legitimate interests in the processing.

How long does UpStay retain personal data?

UpStay retains guests’ personal data for the duration of our service agreement with our business partners, unless a longer or shorter retention period is requested, required or permitted by applicable laws.

We keep the other personal data subject to this Privacy Policy only for as long as is reasonably necessary for the purposes described in this Policy, or for the duration required by law, whichever is the longer.

To which countries does UpStay transfer personal data as part of offering its services?

As part of our service offering and to meet our contractual obligations, we transfer personal data from its source of origin to Israel, the United States, and our business partners’ residential countries. We may also subcontract processing to, or share, guests’ personal data with third parties located in countries other than their home country.

Does UpStay share personal data with third parties?

UpStay shares guests’ personal data to third parties only as necessary to fulfil its service contract with its business partners and pursuant to its business partners’ instructions, or otherwise required by the applicable law.

UpStay shares its business partners’, prospects’ and Site Visitors’ personal data with third parties who support its business operations or as required or permitted by the applicable law.

What privacy rights do individuals have regarding their own personal data?

Data subjects in the European Union (EU) have certain rights with respect to the processing of their personal data, described below (for these purposes, reference to the EU also includes the European Economic Area countries of Iceland, Liechtenstein and Norway and, where applicable, Switzerland).

a) Guests' Rights:

Guests have the right to submit the following requests regarding their personal data to our business partners to whom guests have previously provided their personal data, subject to applicable law:

Request access to and/or correction of their own personal data; Request the erasure of their own personal data; Request that UpStay’s business partners stop processing or restrict the processing of their own personal data; Request that UpStay business partners provide them with their personal data in a structured, commonly used and machine-readable format and transmit those data to another organization; Upon notification from our business partners of a guest’s request to exercise her rights, we will enable such requests to ensure our business partners’ compliance with applicable regulatory requirements in accordance with the service contract with the applicable business partner.

b) Business Partners', Prospects', Site Visitors’ Rights:

Subject to applicable law, you have the following rights in relation to your personal data: Right of access: If you ask us, we will confirm whether we are processing your personal data and, if so, provide you with a copy of that personal data along with certain other details. If you require additional copies, we may need to charge a reasonable fee; Right to rectification: If your personal data is inaccurate or incomplete, you are entitled to ask that we correct or complete it. If we shared your personal data with others, we will tell them about the correction where possible. If you ask us, and where possible and lawful to do so, we will also tell you with whom we shared your personal data so you can contact them directly; Right to erasure: You may ask us to delete or remove your personal data, such as where you withdraw your consent. If we shared your data with others, we will tell them about the erasure where possible. If you ask us, and where possible and lawful to do so, we will also tell you with whom we shared your personal data with so you can contact them directly; Right to restrict processing: You may ask us to restrict or ‘block’ the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or object to us processing it. We will tell you before we lift any restriction on processing. If we shared your personal data with others, we will tell them about the restriction where possible. If you ask us, and where possible and lawful to do so, we will also tell you with whom we shared your personal data so you can contact them directly; Right to data portability: You have the right to obtain your personal data from us that you consented to give us or that was provided to us as necessary in connection with our contract with you. We will give you your personal data in a structured, commonly used and machine-readable format. You may reuse it elsewhere; Right to object: You may ask us at any time to stop processing your personal data, and we will do so if we are relying on a legitimate interest to process your personal data (unless we demonstrate compelling legitimate grounds for the processing) or if we are processing your personal data for direct marketing; Right to withdraw consent: If we rely on your consent to process your personal data, you have the right to withdraw that consent at any time. This will not affect the lawfulness of the processing of your data before we received notice that you wished to withdraw your consent; Right to lodge a complaint with the data protection authority: If you have a concern about our privacy practices, including the way we handled your personal data, you can report it to the data protection authority that is authorized to hear those concerns. You may exercise your rights by contacting us as indicated under the “How to contact UpStay?” section below.

How does UpStay protect personal data?

UpStay will take reasonable precautions, including the implementation of appropriate physical, electronic and administrative procedures, to protect personal data from loss, misuse and unauthorized access, disclosure, alteration and destruction. Although we employ technical safeguards, we cannot guarantee the security of personal data on or transmitted via the Internet.

How is this privacy policy enforced at UpStay?

UpStay follows an internal compliance monitoring process, to assure compliance with this Privacy Policy and periodically verifies that it is accurate, comprehensive for the information intended to be covered, prominently displayed, completely implemented and accessible, and in conformity with privacy and data protection legislation applicable to UpStay.

Information according to Art 27 EU GDPR

We appointed GDPR-Rep.eu as representative according to Art 27 GDPR. If you want to make use of your GDPR data privacy rights, please visit: https://gdpr-rep.eu/q/12535979

Contact GDPR-Rep.eu:

Maetzler Rechtsanwalts GmbH & Co KG
Attorneys at Law
c/o Ancillary Streams Ltd. (UpStay)
Schellinggasse 3/10, 1010 Vienna, Austria
Please add the following subject to all correspondence:
GDPR-REP ID: 12535979

How to contact UpStay?

UpStay acts as the data processor for the processing of guests’ personal data on behalf of hospitality industry companies that are UpStay’s business partners, pursuant to our service contract with the applicable business partner.

We act as the data controller for the processing of personal data about our business partners, prospects and Site visitors for the purposes described in this Privacy Policy.

Questions, comments or complaints regarding our Privacy Policy or data processing practices can be emailed directly to UpStay’s Data Protection Officer: dpo@upstay.tech