LuxHotel System is designed, built and operated by Bluesquare AI in Tirana, Albania ("we", "us"). This policy explains how we collect, use, keep and share personal data when you visit this website or use LuxHotel System.
1. Who is responsible
For the data of our customers, their staff and visitors to this website, Bluesquare AI is the controller.
For the data of your guests (reservations, contact details, messages), your hotel is the controller and we process it on your behalf, only to provide the Service. We can sign a data processing agreement with you on request.
2. The data we collect
- Contact details: name, email address and phone number of the people at your property who use LuxHotel System or ask us for a demo.
- Property details: hotel name, address, country, number of rooms and rate settings.
- Reservation data: guest names, dates, room types, messages and payments linked to the bookings you manage in the system.
- Technical data: IP address, browser type, sign-in times and diagnostic data, used for security and performance.
- Payment data: details of payment transactions. We never store card numbers ourselves; cards are processed by providers certified to PCI DSS.
3. How we use it, and on what legal basis
- To provide your account and the Service (performance of our contract with you);
- To sync availability, rates and bookings with the booking channels you connect, through Channex (performance of the contract);
- To send confirmations, notices and service emails (performance of the contract);
- To answer demo requests and questions (steps you ask for before a contract);
- To keep the Service secure and improve it (our legitimate interest);
- To meet legal, tax and accounting obligations (legal obligation);
- To measure visits to this website with Google Analytics, only if you accept analytics cookies (consent).
4. Who we share it with
We do not sell or rent personal data. We share it only with service providers that help us run the Service, under contracts that oblige them to protect it:
- Channex.io (United Kingdom): channel manager infrastructure, needed to sync with booking channels;
- Google (Firebase and Google Cloud): database, sign-in, hosting and the handling of demo requests;
- Stripe and POK: payment processing, when you take payments online, with only the data each payment needs;
- Meta (WhatsApp): guest messages, when you use WhatsApp messaging or AI Reception;
- Google Analytics: visit statistics for this website, only with your consent;
- Public authorities: only when the law requires it.
The booking channels you connect receive the data each booking needs, under your own contract with them.
5. Transfers outside the EU
Some providers process data outside the European Economic Area, for example in the United Kingdom and the United States. We only use such transfers with the safeguards the GDPR requires: an adequacy decision (such as for the United Kingdom, or the EU-US Data Privacy Framework) or the European Commission's standard contractual clauses.
6. How long we keep it
Account data is kept while your account is active. After an account is closed, its data is deleted within 90 days, except what tax and accounting law requires us to keep for longer.
7. Security
All traffic is encrypted with TLS. Staff sign in with a one-time code on trusted devices, permissions are set per role and per user, and data is backed up every night. Our support team can only access your account with a code your team reads out, and that access ends after 3 hours. No system can promise absolute security, so keep your sign-in details to yourself.
8. Your rights
Under the GDPR and Albanian data protection law, you have the right to:
- access the personal data we hold about you;
- correct data that is wrong;
- have your data deleted (the right to be forgotten);
- restrict or object to how we process it;
- receive your data and move it to another provider (portability);
- withdraw consent at any time, where processing is based on consent.
To use any of these rights, write to . We answer within one month. Guests of a hotel should contact the hotel first, as it decides how their data is used.
You can also complain to a data protection authority: in Albania, the Information and Data Protection Commissioner, or the authority in the EU country where you live or work.
9. Cookies
This website uses one necessary cookie to remember your cookie choice. Google Analytics cookies are only set if you accept them, and you can change your choice at any time in Cookie settings.
10. Changes to this policy
We may update this policy. We tell customers about material changes by email or in the app, and the date at the top of this page always shows the latest version.