Privacy
Privacy policy
Under Articles 13 and 14 of Regulation (EU) 2016/679 («GDPR») and Italian Legislative Decree 196/2003, this policy explains how BVH Consulting processes the personal data of visitors to the Hospia website and of people who use the platform as customers or as members of a customer's team.
This is a translation of the Italian policy, which prevails in case of discrepancy.
1. Who the controller is
Hospia is a service of BVH Consulting, which decides why and how the data described on this page is processed and is therefore the data controller.
- Data controller
- BVH Consulting
- Data protection contact
- Anouar Jamali, CTO, BVH Consulting
2. Who this applies to
Visitors to the Hospia website and platform customers: owners and staff of restaurants, hotels and resorts who create an account, manage their websites or ask for support.
Guests of the properties. When you book a table or a room, complete online check-in, order from the QR menu or subscribe to the newsletter on the website of a property that uses Hospia, the data controller is the property. BVH Consulting processes that data only on its behalf and following its instructions, as data processor (Art. 28 GDPR). You will find the property's policy on the «Privacy» page of its website; to exercise your rights, contact the property. If you write to us, we will forward your request to it.
3. What data we process
- Browsing data: IP address, date and time, requested page, browser. It is needed to run and protect the website: the IP address is used to limit sign-in attempts, not to profile you. The Hospia website uses no third-party analytics or advertising tools.
- Account data: name, email, password (stored only in hashed, unreadable form), two-step verification settings and language.
- Customer business data: business name, team roles, plan and billing details (company name, VAT number, tax code, address, SDI code, certified email).
- Payments: card details are entered directly on Stripe; we only receive the outcome and the amount of the payment.
- Support: messages, attachments and information you send us in tickets or by email.
- Activity log: who did what in the dashboard (e.g. publishing, permission changes, sign-ins by our team for support through «Sign in as», always logged).
4. Why we process it, on what basis and for how long
| Purpose | Legal basis | Retention |
|---|---|---|
| Creating and managing your account, providing the platform and support | Performance of a contract or pre-contractual steps (Art. 6(1)(b) GDPR) | For as long as the account exists; on closure the data is deleted, except what must be kept by law |
| Invoicing, accounting and tax obligations | Legal obligation (Art. 6(1)(c)) | 10 years, as required by Italian tax and civil law (Art. 2220 of the Civil Code) |
| Security: protecting sign-ins, preventing abuse, activity log | Legitimate interest in protecting the platform and customer data (Art. 6(1)(f)) | Anti-abuse counters: a few minutes; sessions: up to 30 days; activity log: for the duration of the relationship |
| Service emails: sign-ins, invitations, alerts, deadlines and essential news | Performance of a contract (Art. 6(1)(b)) | For as long as the account exists |
| Answering requests sent by email or through forms | Pre-contractual steps or legitimate interest in replying (Art. 6(1)(b) and (f)) | As long as needed to handle the request |
| Encrypted backup copies | Legitimate interest in service continuity (Art. 6(1)(f)) | Overwritten on rotation: kept for 14 days |
We do not send marketing messages without your consent and we do not sell data to third parties. We make no decisions based solely on automated processing that produce legal effects on you.
Providing the data required to create an account is necessary: without it we cannot provide the service.
5. Who we share data with
Data is processed by authorised staff of BVH Consulting and by providers that help us deliver the service, appointed as data processors under a contract that binds them to use it only for this purpose:
- Hostinger: servers that run the platform and store the data (European Union)
- Email service provider: sending service emails (sign-ins, invitations, notifications) (European Union)
- Stripe: subscription payments and, when a property enables them, guests' online payments (Ireland / United States)
- Anthropic: AI assistant for texts and translations, only when you use it (United States)
Other services are involved only if a customer property enables them (e.g. channel manager, e-invoicing intermediary, WhatsApp Business, Google for maps and reviews). Data may also be disclosed to public authorities when required by law.
6. Transfers outside the European Union
Platform data is stored on servers in the European Union. Some providers (for example those based in the United States listed above) may access it from outside the EU: in those cases the transfer relies on the EU-U.S. Data Privacy Framework, where the provider is certified, or on the standard contractual clauses approved by the European Commission (Arts. 45 and 46 GDPR).
7. How we protect data
Encrypted connections (HTTPS), passwords stored with hashing algorithms, two-step verification available for every account, role-based permissions, activity log, limits on sign-in attempts and encrypted backups.
8. Your rights
At any time you can ask to access your data, rectify it, erase it, restrict its processing, receive it in a readable format (portability) and object to processing based on legitimate interest (Articles 15–22 GDPR). If you gave consent, you can withdraw it without affecting processing already carried out.
You also have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the authority of the EU country where you live.
10. Changes
We may update this policy when the service or the law changes. The date of the last update is shown at the top; we notify customers by email of significant changes.