Privacy policy

1. Controller

The controller for this website and for our customers’ accounts (hosts, hotels, car rental companies) is:

[To be completed: company name and legal form]
[To be completed: address]
Email: [To be completed: privacy contact email]

Data protection officer: [To be completed: name and contact, if appointed]

2. Roles in guest messaging

When guests message a property, hotel or rental company through Bonporta, the respective host is the controller under the GDPR. Bonporta acts as processor (Art. 28 GDPR) under a data processing agreement with the host. Guests should direct questions about their data to their host first; we forward any requests we receive.

3. Visiting this website

When you visit the website, our server processes technically necessary data: IP address, date and time, requested address and browser identifier, for delivery and security (Art. 6(1)(f) GDPR). Server logs are deleted after [To be completed: retention period, e.g. 14 days].

We use no tracking or advertising cookies and embed no analytics, fonts or content from third parties. All fonts and images are served from our own server.

4. Host accounts

For sign-up we process name, email address, password (stored only as a hash), company details and the content you add (house book, extras, service providers). Legal basis: contract (Art. 6(1)(b) GDPR).

After you sign in we set one strictly necessary session cookie to keep you signed in. It contains no profile data and becomes invalid when you sign out or the session expires.

5. Guest and service provider data

On behalf of the host we process: name, phone number or messenger ID, language, stay details, message content including photos and voice notes, booked extras and payment status. For service providers: name, phone number, language and job details.

The first message tells guests that an AI is replying (Art. 50 EU AI Act) and includes a privacy notice. Offers after the stay (“Discover”) are only sent with separate, explicit consent, which can be withdrawn at any time by replying “STOP”.

Guest data is not used to train AI models.

6. Sub-processors and recipients

• Hosting: [To be completed: hosting provider, registered office], data centre in the EU.
• Meta Platforms Ireland Ltd. (WhatsApp Business Platform), if the host uses WhatsApp. Processing in third countries is possible (EU-US Data Privacy Framework or standard contractual clauses).
• Telegram ([To be completed: responsible Telegram entity]), if guests use the Telegram bot.
• Anthropic ([To be completed: contracting entity]) as provider of the AI model that drafts and translates replies, without training on the data. Transfer to the USA is possible; basis: [To be completed: DPF certification or standard contractual clauses].
• Stripe Payments Europe, Ltd. for payment links. Hosts are the sellers; guests enter payment details directly with Stripe and we do not see them.
• [To be completed: email or SMS delivery service, if any]

7. Retention

We delete conversation and stay data [To be completed: period, e.g. 90 days] after departure unless the host sets a shorter period or statutory retention applies (e.g. payment records: up to 10 years). Consents for “Discover” are stored with a timestamp while valid and afterwards as evidence for [To be completed: period]. Host account data is deleted after the contract ends and statutory periods expire. House book and data can be exported at any time.

8. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). You can withdraw consent at any time with effect for the future. You may also lodge a complaint with a supervisory authority; the competent authority is [To be completed: competent supervisory authority].

9. Security

Tenants are separated, data is encrypted in transit and every action in the system is logged. Access codes are only issued for the relevant time window.