Source: https://www.hebsdigital.com/privacy-policy/eu-privacy-statement
Timestamp: 2019-04-18 20:21:33+00:00

Document:
We take the protection of personal data very seriously. If you are in the European Economic Area and we collect personal data relating to you in the context of the offering of goods or services, even if provided free of cost, or if we collect data when monitoring your behavior which takes place within the European Economic Area, your personal data will be subject to Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”).
In this Privacy Statement we, HEBS Digital, One Penn Plaza, 48th Fl, New York, NY 10119, USA (“We” or “HD”) will inform you about how we process and use personal data which is subject to the GDPR and on the specific rights you have in connection with your personal data which is subject to the GDPR.
Please note that the GDPR Privacy Statement applies only to personal data which is subject to the GDPR and therefore expressly does not apply to (a) data which is not personal data such as data on corporations or other legal entities, and (b) personal data not falling within the scope of the GDPR such as personal data of data subjects who are not in the European Economic Area.
Many of our customers are organizations and companies (so-called legal entities). If you contact us as an employee of an organization or a company, we will store and process the categories of data described herein below generally in relation to this organization or company, but may link it to the information that you are employed by such organization or company and are our contact person.
HEBS Digital, HOSPITALITY EBUSINESS STRATEGIES, INC.
1.2 We have designated a representative in the European Union in accordance with Art. 27 of the GDPR.
Our representative has been mandated to be addressed in addition to us or instead of us by, in particular, supervisory authorities and data subjects, on all issues related to processing, for the purposes of ensuring compliance with the GDPR. Our designation of a representative is without prejudice to legal actions which could be initiated against us directly.
is us as the entity which, alone or jointly with others, determines the purposes and means of the processing of personal data.
comprises Hospitality Tech Holdings LLC (d.b.a NextGuest Technologies), One Penn Plaza, 48th Fl, New York, NY 10119 and all of its subsidiaries (as we are one).
also referred to as a “web service” in this Privacy Statement.
is any service normally provided for remuneration, at a distance (i.e. without the parties being simultaneously present), by electronic means (i.e. by means of electronic equipment for the processing (including digital compression) and storage of data) and at the individual request of a recipient of services.
is the restriction on the processing of stored personal data such that they are only processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest and that you are informed before this restriction is lifted.
We offer software and related services (software as a service, hosting, support) to hotels, agencies and other hospitality industry customers (collectively “Hospitality Provider(s)”). In the context of those services we process personal data of travellers, guests and other customers of the Hospitality Providers on behalf of those Hospitality Providers (“Processing Services”) on the basis of contract processing agreements which provide that personal data are processed only on behalf of, and in accordance with the instructions of, the Hospitality Providers.
We subcontract Processing Services to HEBS Digital Europe, Tallinn, Estonia (“HEBS Europe”), a member of our group of undertakings. We have concluded a contract processing agreement with HeBs Europe to ensure that personal data are processed only on behalf of, and in accordance with the instructions of, the Hospitality Providers.
This Privacy Statement therefore does not apply to any Processing Services and such Processing Services are exclusively governed by the data protection policies of the respective Hospitality Provider. For further information you must refer to the privacy statement of the respective Hospitality Provider.
In this Section we will inform you about how we process and use personal data in relation to you which we collect in connection with our website at www.hebsdigital.com, the dispatch of newsletters and other web services, and on the specific rights you have in this respect.
This processing will take place for the fulfillment of the existing contract of use with you, as far as it serves the purpose of the technical implementation of the website’s use (legal basis for processing: Art. 6 no. 1 lit. b) of the GDPR) and to otherwise protect our legitimate interest in making our website as user-friendly, safe and attractive as possible and in promoting the sale of our products and services (legal basis for processing: Art. 6 no. 1 lit. f) of the GDPR). We will assume that your interests do not conflict with this, because the measures described below are taken in order to limit processing to an appropriate degree.
We will also use the data described above to draw conclusions about your interests from your use and to adapt our website’s offerings according to your interests (profiling) in order to make our website as user-friendly, safe and attractive as possible and thus promote the sale of our products and services. We do this for the preservation of our aforementioned legitimate interests (legal basis for processing: Art. 6 no. 1 lit. f) of the GDPR) and, where applicable, on the basis of your consent as described in Sec. 4.1.2 (legal basis for processing: Art. 6 no. 1 lit. a) of the GDPR). For further information please refer to the following Section 4.1.2.
Targeting / Advertising Cookies (see Sec. 4.1.2.5).
Usage Tracking – We use the analytics described in Sec. 4.3 to provide analysis of our users’ on-going usage of the website. This allows us to adapt our website’s offerings according to our users’ interests and facilitates on-going improvements to the website.
We use a number of cookies which are strictly necessary to allow you to access our websites, to move between pages and to receive services which you have requested.
We utilize other cookies to analyse how our visitors use our websites and to monitor website performance. This allows us to provide a high-quality experience by customizing our offering and quickly identifying and fixing any issues that arise. For example, we might use performance cookies to keep track of which pages are most popular, which method of linking between pages is most effective, and to determine why some pages are receiving error messages.
Adobe Website Analytics: Refer to Section 4.3 for more details.
In order to maximize your user experience we collect, analyze and store information such as time on site, pages visited, bookings initiated and completed, traffic type (paid organic, etc.), geographic and demographic information and web browser and device type in order to offer you more relevant content when you re-visit our sites. In order to protect your privacy, this information is processed to make it less personally identifying, e.g. IP addresses are truncated (the trailing octet of the IP address is replaced with 0's) before geo-coding and storing, email addresses and other personally identifying information is hashed in an irreversible manner, etc.
We also allow certain third party advertisers and partners to collect information about your use of the website through first and third-party cookies in order to serve adverts to you. They may also analyse this data in order to serve adverts to you on other third-party websites.
Log files are deleted after 120 days. Session cookies expire and are deleted at the end of your browser session. Persistent cookies (including the cookie described in Sec.4.2) may be set to expire from 30 days to 1 year depending on the function of the cookie. After expiry of those periods information will be deleted or made anonymous.
4.2.1 Our website uses Adobe Analytics, a web analysis service of Adobe Systems (https://www.adobe.com/about-adobe.html), 345 Park Avenue, San Jose, CA 95110-2704, USA ("Adobe").
4.2.4 We use Adobe Analytics for the purposes set forth in Section 4.1 and the preservation of our legitimate interest described therein (legal basis for processing: Art. 6 no. 1 lit. f) of the GDPR) and, where applicable, on the basis of your consent as described in Sec. 4.1.3 (legal basis for processing: Art. 6 no. 1 lit. a) of the GDPR).
4.2.5 We have concluded a contract processing agreement with Adobe Systems Software Ireland Limited to ensure that personal data is processed only on our behalf and in accordance with our instructions. The contract processing agreement with Adobe contains guarantees for an adequate level of protection in the form of Adobe's participation in the Privacy Shield Program.
4.3.1 Our website uses technologies such as Pardot provided by salesforce.com, inc, The Landmark @ One Market Street, San Francisco, CA 94105, USA ("SFDC“).
4.3.2 We have concluded a contract processing agreement with SFDC to ensure that personal data is processed only on our behalf and in accordance with our instructions. The contract processing agreement contains guarantees for an adequate level of protection in the form of SFDC's participation in the Privacy Shield Program.
4.4.1 If you register via our website or by other means to receive electronic newsletters, we will store and process your registration data (the registration form will show you which registration data we collect and store and whether entries are mandatory or voluntary) for an unlimited period of time until you unsubscribe or we cancel the newsletter dispatch in order to fulfil the existing contract with you for the receipt of the newsletter (legal basis for processing: Art. 6 no. 1 lit. b) of the GDPR). The IP address assigned to you by the internet service provider (ISP), and the date and time of registration will also be stored when you register. The purpose of this is to protect our legitimate interest in preventing and, if necessary, prosecuting misuse of our services (legal basis for processing: Art. 6 no. 1 lit. f) of the GDPR). In addition, we will store and process your consent to receive the newsletter for the retention period specified below. This serves to protect our legitimate interest in being able to prove in the event of a dispute that you wished to receive the newsletter (legal basis for processing: Art. 6 no. 1 lit. f) of the GDPR).
4.4.2 The registration for our newsletter which is powered by Pardot technologies of SFDC (see Sec. 4.3) takes place in a so-called double opt-in procedure. This means that after registration you will receive an e-mail asking you to confirm your registration. This confirmation is necessary to prevent unauthorized use of your e-mail address by another person.
4.5.1 If you register on our website and create a user account (the registration form will show you which registration data we collect and store and whether entries are mandatory or voluntary), all personal data collected in connection with this user account will be stored in this user account until you request to delete the user account or until we cancel the user account for the performance of our contractual relationship on use of the respective website or web service (legal basis for processing: Art. 6 no. 1 lit. b) of the GDPR). The IP address assigned to you by your internet service provider (ISP), and the date and time of registration will also be stored when you register. The purpose of this is to protect our legitimate interest in preventing and, if necessary, prosecuting misuse of our services (legal basis for processing: Art. 6 no. 1 lit. f) of the GDPR).
4.5.2 Our website contains a contact form, powered by Pardot technologies of SFDC (see Sec. 4.4), which you can use to submit communications to us. When submitting information through the contact form, you are required to enter certain information which we will use for responding to your request. The contact form enables you to submit additional information on a voluntary basis.
4.5.3 If you provide us with personal data via the user account or the contact form for a purpose beyond the use of the website or respective web service, such as sending us an offer or product information, we will also store and process this data for this purpose. In order to find more information on how we store and process such data, you will need to refer to the Section of this Privacy Statement that is pertinent to the respective purpose (especially Section 7 et seq.).
4.6.1 We share data with other companies of our group of undertakings. For further information on this and on the safeguards, we have put in place in this respect, please refer to Sec. 11 below.
If you register to use the website or receive a newsletter or complete a contact form and you are already a customer, or if a customer relationship is subsequently established, the information from the registration or contact form for your customer account will be saved and the information in Section 6 shall apply.
Even if a customer relationship does not exist and is not subsequently established, we will also store your registration and the object of your interest in our database of prospective customers and the information in Section 6 will then apply.
5.1 In this Section we will inform you about how we process and use personal data in relation to you that we collect in connection with calls to our telephone hotline and on the specific rights you have in this respect.
5.2 When you call our hotline, our representative will record your name, the date and time of your call and the content of your request in a call log. If you are registered with us in the customer database, this information will be stored in your customer account and the information in Section 6 will then apply. If you express interest in a product or service and there is no customer relationship, this information will be stored in our database of prospective customers and the information in Section 5 will then apply. In all other cases we will record your details in a separate database for call logs.
We will store and process the above information to perform the contractual relationship with you with respect to the delivery or service to which the call relates on the one hand (legal basis for processing: Art. 6 no. 1 lit. b) of the GDPR),, and on the other hand, to safeguard our legitimate interest, in view of your request, in improving our deliveries and services to meet your individual requirements and thus promote the sale of our products and services, if necessary to offer you additional products or services in line with your interests, to document the content of your request for the establishment, exercise or defence of legal claims (legal basis for processing: Art. 6 no. 1 lit. f) of the GDPR).
Unless a longer retention period described in Sec. 9 applies, call logs will be retained for 6 months after the call.
5.3 We share data with other companies of our group of undertakings. For further information on this and on the safeguards we have put in place in this respect, please refer to Sec. 11 below.
6.1 In this Section we will inform you about how we process and use the personal data in relation to you that we collect when you express an interest in our products or services and on the specific rights you have in this respect.
6.2 If you express your interest in our products or services by making an enquiry (e.g. at a trade fair or conference, by e-mail, or via the contact form), we will store your contact data and the subject of your interest in a separate database for prospective customers.
6.3 We will store and process this data in order to process your inquiry and also to safeguard our legitimate interest, in view of your request, in improving our deliveries and services to meet your individual requirements and to thus promote the sale of our products and services and, if necessary, to offer you additional products or services in line with your interests (legal basis for processing: Art. 6 no. 1 lit. f) of the GDPR).
6.4 If your request results in a customer relationship, the data will be transferred to our customer database (cf. Section 6). If no customer relationship is established, the data will be deleted 2 years after the last correspondence with you.
6.5 We share data with other companies of our group of undertakings. For further information on this and on the safeguards we have put in place in this respect, please refer to Sec. 11 below.
6.6 We refer to Sections 9 et seq. for further regarding the possible recipients and storage periods of the above information.
6.7 You can object to the use of your data for direct marketing purposes at any time (cf. Section 10.8).
7.1 In this Section we will inform you about how we process and use personal data in relation to you that we store in our customer database and on the specific rights you have in this respect.
7.2 We will set up a customer account in our customer database if a customer relationship exists or is established with you. The customer account contains your master data (name, address, account etc.). All correspondence and documents (correspondence, orders, contracts, complaints, etc.) within the scope of the customer relationship will then be linked to this customer account.
7.3 We will store and process the above information to fulfil the respective contractual relationship with you with respect to our products and services that you use on the one hand, and, on the other hand, to safeguard our legitimate interest in improving our deliveries and services according to your individual requirements with regard to your concerns and interests and to thus promoting the sale of our products and services, and, if necessary, to offer you additional products or services in accordance with your interests, to document contractual agreements and correspondence for asserting, exercising or defending related legal claims(legal basis for processing: Art. 6 no. 1 lit. f) of the GDPR), to fulfil statutory documentation and document retention obligations (legal basis for processing: Art. 6 no. 1 lit. c) of the GDPR).
7.4 We share data with other companies of our group of undertakings. For further information on this and on the safeguards we have put in place in this respect, please refer to Sec. 11 below.
7.5 We refer to Sections 8 et seq. for further regarding the possible recipients and storage periods of the above information.
7.6 You can object to the use of your data for direct marketing purposes at any time (cf. Section 14.7).

References: Art. 27
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6