HotOps · Last updated: 7 September 2026
Responsible for the website, hotel registrations, contract and billing data, and support requests:
For personal data that a hotel processes through HotOps for its own hotel operations – in particular lost property, room assignment and staff data – the relevant hotel is the controller. HotOps processes this data on the hotel's behalf under a data processing agreement (DPA).
Where a hotel provides HotOps to its staff, the hotel as employer decides the purposes, scope, legal basis and duration of operational processing. HotOps processes this data as a processor acting on the hotel's instructions. This notice supplements but does not replace the employer's own privacy information. Questions and data subject requests about operational data should therefore first be directed to the relevant hotel.
All approved users of a hotel can see the name, role, position, department, department-lead status and last login time of other approved users of the same hotel in the internal team directory. Email addresses and pending accounts are visible there only to authorised hotel admins and the HotOps superadmin. Tasks, handovers, comments, announcements and other operational content are visible according to the assigned roles, departments and recipient groups. This information is not shared with other hotels.
| Category | Data | Purpose |
|---|---|---|
| Hotel and user account | Name, business contact details, hotel and billing data, access credentials | Registration, contract, access control, billing and support |
| Hotel operations | Staff name, email, role, department, position and last login time; optional date of birth and profile photo; tasks, handovers and chat messages; repairs, complaints, room status and announcements | Organisation and documentation of hotel operations, and internal display of the hotel team |
| Lost property | Description, date found, room number, storage location, photo, status | Handling of lost property |
| Device and technical data | Push token, IP address, app, browser and device information, login and access timestamps, and technically necessary request and error logs | Provision of the app, push notifications, IT security, abuse prevention and error analysis |
| Communication | Sender, email address and content of a support request | Handling and documentation of support requests |
Voluntary profile information can be changed or removed in the profile, unless the hotel has made it operationally mandatory. Photos and free text may in individual cases contain personal information. Please do not enter special categories of personal data, such as health data, unless strictly necessary and legally permitted.
When using the public contact form, HotOps processes name, email address, optionally hotel name and phone number, and the content of the message. The information is stored directly in the protected HotOps support inbox and triggers a push notification to the HotOps superadmin. No external form or email-delivery services are used for this process.
HotOps processes its own contract, registration and support data for the initiation and performance of contracts (Art. 6(1)(b) GDPR), to comply with legal obligations (Art. 6(1)(c) GDPR), and to safeguard legitimate interests in secure, efficient operation and abuse prevention (Art. 6(1)(f) GDPR). For processing within hotel operations, the relevant hotel determines the legal basis and informs its guests and staff.
HotOps does not transfer data to third parties for its own advertising purposes. Contractually bound providers are used to deliver the service: Supabase for database, authentication, the internal support inbox and protected file storage, and Expo for push notifications. Support messages are stored within HotOps and are accessible only to the sender and the HotOps superadmin. Providers receive only the data required for their respective service. Subprocessors are engaged under the data processing agreement with the hotel and are disclosed or approved according to the procedure agreed there.
If a staff member actively triggers the optional AI photo analysis or text correction, only the selected photo from the lost-property log is transmitted to OpenAI via a time-limited access link, or the entered operational context is transmitted. Photos of technical defects are not analysed by AI. OpenAI only produces a suggestion, which is reviewed by a staff member before saving; no automated decision is made.
The HotOps database is set up in an EU region. Depending on the provider and support service, processing may take place outside the EU/EEA. Where no adequacy decision applies, appropriate safeguards, in particular EU Standard Contractual Clauses, are agreed. Information about the subprocessors currently used, and a copy or description of the applicable safeguards, can be requested at info@hotops.app.
HotOps uses TLS encryption, role-based access rights, tenant-separated database access control, and a non-public photo store with time-limited access links.
Where the requirements are met, you have the right to access, rectification, erasure, restriction of processing, data portability and objection. Please direct requests about hotel operational data to the relevant hotel first; requests about HotOps' own data to info@hotops.app. You also have the right to lodge a complaint with a data protection supervisory authority. HotOps is generally supervised by the Bavarian State Office for Data Protection Supervision.
The data required for registration, login and the respective processing must be provided; without it, use of the relevant function is not possible. HotOps does not make any decisions based solely on automated processing with legal or similarly significant effects within the meaning of Art. 22 GDPR.
HotOps does not use marketing or analytics trackers. The web application may store technically necessary local browser data, for example to limit failed login attempts. You can delete this through your browser settings.
HotOps may update this privacy policy if features, service providers used, or legal requirements change. Material changes will be announced in an appropriate manner. The version published at the time applies; the update date is shown above.