Skjalið er á ensku uns þýðing er birt. Fyrir þýskan rétt og mál í Þýskalandi gildir þýski texti skilmálanna.

Privacy policy

Effective date: 9 September 2026

This privacy policy explains how TRAVELDATASERVICE (“we”, “us”, “our”) processes personal data when you visit our website, create a hotel-owner account, pay a SaaS subscription, or use the TravelDataService Hotel Booking Engine booking engine.

It does not replace a hotel’s own privacy policy. Guest stays are booked with the property. That hotel is the controller of the guest’s booking file (see Roles).

1. Controller

TRAVELDATASERVICE Greece specialist travel agency & travel shop Owner: Jean Ioannis Arampatsis (sole proprietorship (Einzelunternehmen)) Müllerstr. 47 80469 Munich Germany Phone: +49 (0) 89 2609410 Email: info@tdsreisen.com VAT identification number: DE455705699

Contact for privacy requests: info@tdsreisen.com

We are established in Munich, Germany. The competent data-protection supervisory authority for Bavaria is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

2. What this service is

TravelDataService Hotel Booking Engine is a white-label booking engine for hotels and property managers who already use Beds24. We do not replace Beds24. We provide a website widget and a billed SaaS dashboard.

• Guests book on the hotel’s website.
• Inventory, prices, extras, deposits, booking questions, and confirmation emails stay in Beds24.
• If the property uses Stripe in Beds24, the guest pays through that Stripe account. We never take lodging money on our Stripe account and we do not use Stripe Connect for guest stays.
• The hotel owner pays us a monthly subscription on our Stripe account.

TRAVELDATASERVICE also operates a travel-agency business. That retail travel activity is separate from this SaaS. This policy covers the TravelDataService Hotel Booking Engine website, owner dashboard, widgets, and related billing.

3. Roles (GDPR)

When a hotel signs up, they accept our Terms of use, which include a data-processing agreement (Art. 28 GDPR) in section 15 of those terms for guest data we handle as processor.

4. Categories of data we process

4.1 Website visitors

• Technical logs needed to operate HTTPS (IP address, time, URL, user agent) for a short period, for security and abuse prevention
• Language preference cookie for the public marketing page
• Cookie banner choice cookie for the public marketing pages (the word "necessary" or "all", no identifier)
• Optional contact form on / , /pricing and /contact: name, email, optional phone/company/website/location, property and room counts, whether they use Beds24, Single vs Group interest, discount request, message (Contact.md). Legal basis: steps toward a contract (Art. 6(1)(b)) and the tick on the form. Staff read messages in Admin, receive a copy at our published contact email, and may delete them. No newsletter opt-in.
• Demo page counters: on /demo we add 1 to a daily total for “page opened”, “widgets loaded”, “booking engine opened”, “search”, and “booking”, per language and per demo block. No cookie, no identifier, no IP address, no user agent, no session — the stored row is a date, a language, an event name and a number, so nobody can be recognised or singled out. Legal basis: Art. 6(1)(f) legitimate interest in knowing whether our own demo is used.
• No analytics cookies and no advertising cookies unless we add them later and obtain consent

4.2 Hotel owners (our customers)

• Email, hashed password, company name
• Locale preference
• IP and time on login if needed for security
• Beds24 refresh tokens (secret; never shown in the browser or in admin)
• Our Stripe customer id, subscription id, plan, status, invoices
• Optional commission settings
• Account timezone / date format as synced from Beds24 or set in the dashboard
• Photos the owner uploads or imports (stored on our disk to display the booking engine)
• Support correspondence you send to info@tdsreisen.com
• Staff may open your hotel dashboard for support without your password (a short audited session). They cannot delete the organisation or download the GDPR export from that session.

4.3 Guests (hotel customers)

We do not keep a guest profile. Name, email, phone, address, custom question answers, and comments are sent to Beds24 when the booking is created and stay there.

Our thin bookings log (for the hotel dashboard, optional commission, and disputes) contains: Beds24 booking number, dates, occupancy counts, property/room, amounts, currency, status, language, and our checkout reference. No guest name, email, phone, or card data.

Webhook bodies from Beds24 contain personal data. We parse what we need for the columns above and do not store the raw body.

4.4 What we never store

• Card numbers, CVC, or full Stripe guest payment methods
• Passwords in plaintext
• Beds24 v1 API key or propKey (photo import is one-shot; keys exist only in memory for that request, then are discarded)

5. Purposes and legal bases (Art. 6 GDPR)

We do not sell personal data.

6. Guest bookings and payments

If the hotel collects a card, we create the Beds24 booking first, then open Beds24 Stripe Checkout. Unpaid holds are cancelled immediately if Checkout is abandoned, or after 15 minutes. We never store PAN/CVC.

Confirmation, request, and cancellation emails are sent by Beds24 (direct-booking templates). We do not send a second booking email from our servers.

The guest must tick the hotel’s privacy policy and general policy (and cancellation policy when shown) before pay or submit. Agreement (name + date) is written to the Beds24 Info tab. That record lives in Beds24, not in our database.

7. Recipients

We disclose data only as needed:

• Beds24 — guest booking payload; property sync; webhooks
• Stripe — owner billing (our account); guest charges only via the hotel’s Beds24 Stripe session
• Hosting — the application and MySQL run on our Plesk (production) or local development. Name the data-centre country/region here before relying on this paragraph. Default for a typical Plesk package: EU/EEA; if the host is outside the EEA, state the country and the transfer tool in section 8
• Staff of TRAVELDATASERVICE who need access to operate the SaaS (no Beds24 refresh tokens in the admin UI)
• Authorities when required by law

Sub-processors we use as processor of guest data (see Terms section 15): hosting (Plesk/MySQL) and Stripe for owner SaaS invoices only. Beds24 is the hotel’s processor, not ours.

The hotel may independently disclose guest data inside Beds24 (for example to OTAs). That is outside this policy.

8. International transfers

Stripe may process billing data in the United States and other countries. Stripe uses GDPR transfer tools (including Standard Contractual Clauses) as described in Stripe’s own privacy policy.

Beds24’s location is determined by that provider and by the hotel’s contract with Beds24.

If our Plesk host is outside the EEA, we will name the country here and the transfer safeguard. Default assumption for this installation: hosting is configured by us; if it is not in the EU/EEA, this paragraph must be updated in Admin → Legal before relying on it.

9. Cookies

We use only strictly necessary cookies:

• Owner session (ms_owner) — hotel dashboard
• Staff session (ms_staff) — platform admin
• Support session (ms_impersonate) — staff viewing an owner dashboard; only valid together with ms_staff
• Landing language (ms_land_lang) — remembers the public-site language
• Cookie choice (ms_cookie_consent) — remembers the answer you gave the cookie banner, for 12 months. It holds the word "necessary" or "all" and nothing else.

A cookie banner is shown on the public marketing pages (/, /pricing, /contact, /capabilities, /jobs, /demo, /privacy, /terms, /imprint). Because everything above is strictly necessary, both answers currently leave the same cookies behind; your answer is recorded so that anything optional we add later starts switched off if you said no. You can change the answer at any time with the Cookies link in the footer. The hotel dashboard and the booking engine do not show a second banner: they use session cookies only, and they are listed here.

The booking engine runs in an iframe on our origin. That cookie is first-party to the iframe, not to the hotel domain. Hotels must mention us and Beds24 in their privacy policy. We provide a paste-in paragraph in the owner dashboard Help.

No analytics, advertising, or social-media tracking cookies in the current product. The /demo counters described in 4.1 use no cookie and no identifier at all.

10. Retention

• Owner account: for the life of the contract, then deletion on owner request subject to legal holds
• Stripe invoices and tax records: as required by German commercial and tax law (typically 10 years, §§ 257 HGB, 147 AO)
• Bookings log amounts, ids, dates, status: as needed for tax, commission, and disputes (aligned with invoice retention when commission was billed)
• Security logs: short period
• Room and property photos: until the owner deletes the gallery or the organisation
• Guest identity data: not retained by us after transit to Beds24 (except the thin log above)
• Public contact inquiries: until staff delete them, or when the person asks us to erase the row

11. Security (Art. 32)

Technical and organisational measures for this product include:

• Encryption in transit (HTTPS) in production
• Passwords stored only as hashes, never in plaintext
• Tenant isolation: queries filtered by organisation; hotel sessions cannot open platform admin
• Staff support login into an owner dashboard requires a valid staff session plus the staff password; it is audited and time-limited
• Secrets (Beds24 refresh tokens, our Stripe keys, webhook secrets) stay on the server; none in the widget or browser
• Webhook authenticity checks (Beds24 custom header; Stripe signature)
• No storage of guest PAN/CVC; unpaid card holds cancelled immediately on abort or after 15 minutes
• Beds24 v1 photo keys exist only in memory for the import request, then discarded
• Raw Beds24 webhook bodies are not stored (they contain guest PII)
• Access limited to TRAVELDATASERVICE staff who need it to operate the SaaS
• Optional origin allowlist for widget APIs
• Rate-limiting of public booking APIs

These measures are also part of the Art. 28 terms in section 15 of the Terms of use.

12. Your rights

Depending on your role:

Hotel owners: access, rectification, erasure, restriction, portability, objection (Art. 15–21). The dashboard Settings page offers organisation export and delete (live engines are cancelled, tokens deleted, Stripe keeps invoices as legally required). Beds24 bookings already created are not deleted by us.

Guests: the hotel is the controller. Requests go to the hotel / Beds24. Our log has no guest name or email to erase; we can still delete or flag a row on the hotel’s instruction.

You may lodge a complaint with BayLDA or another EU supervisory authority of your habitual residence.

No automated decision-making producing legal effects (Art. 22).

13. Children

The SaaS is for business customers. We do not knowingly create owner accounts for children. Guest occupancy (including children as guests of a hotel) is processed only as booking facts the hotel’s Beds24 setup requires.

14. Changes

We may update this policy. The effective date above will change. Material changes that affect owners will be indicated on this page and, where required, in the dashboard.

15. Contact

TRAVELDATASERVICE, Jean Ioannis Arampatsis, Müllerstr. 47, 80469 Munich, Germany info@tdsreisen.com · +49 (0) 89 2609410