Privacy policy

1. Data controller

AM BURGHUEGEL KG DES KAHN MARKUS & CO.

Freisinger Straße 6, 39038 Innichen (BZ) / San Candido (BZ), Italy

Privacy enquiries: info@staysend.com

2. Hosting and server logs

The website is hosted by Aruba S.p.A. (Via San Clemente 53, 24036 Ponte San Pietro (BG), Italien). The intended hosting region is Italy.

When a page is requested, the web server processes technically necessary log data: IP address, date and time, requested URL, referrer, browser type, operating system, amount of data transferred and status code. The purposes are delivery, stability, error analysis and prevention of abuse. The legal basis is Article 6(1)(f) GDPR. Log retention is: Server: Rotation ab 10 MiB, bis 10 Archive. App: täglich oder ab 10 MiB, bis 10 Archive. Keine einheitliche feste Tagesfrist..

3. Demo and contact enquiries

For a demo request, we process your name, hotel name and email address, plus your website, role, PMS/system and message if provided voluntarily. The data is used only to handle your enquiry, arrange an appointment and potentially initiate a contract. The legal basis is Article 6(1)(b) GDPR; for general communication, Article 6(1)(f) GDPR also applies.

Data is retained until the enquiry has been processed and a decision about working together has been made. Further storage takes place only where required for evidence, limitation periods or statutory retention obligations. A demo request does not automatically subscribe you to a newsletter.

4. Consent management and necessary browser storage

The consent dialog stores your choice under the staysend_consent key in your browser’s local storage so that the website can respect it. Changing or withdrawing consent updates the stored value; a refusal is also retained. The entry remains until browser storage is cleared.

Google Analytics and Google Ads are loaded only after explicit consent to the relevant category. No Google tag is loaded before that consent. Following earlier consent, changes to your choice are passed to tags already loaded; with consent denied, these may still send status signals or measurement requests without cookies. You can change your choice at any time through “Cookie settings” at the bottom of the page.

Your selected interface language is stored in the staysend_ui_language cookie for up to one year. It contains only de, it or en and retains your language choice for later visits. After sign-in, your personal interface language is also stored in your own account.

5. Google Analytics 4

With consent to “Statistics”, Google Analytics 4 may be used. The provider in the EEA is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data processed includes page views, interactions, referrers, approximate location information, browser and device data and pseudonymous identifiers. We do not send names, email addresses or form contents to Google Analytics.

The legal basis is your consent under Article 6(1)(a) GDPR and, where information is stored on or read from your device, section 25(1) TDDDG. Consent is voluntary and can be withdrawn at any time. The current intended retention for user and event data is: yet to be set in Google Analytics.

Google Analytics is loaded only if the operator has enabled measurement and you consent to the “Statistics” category.

6. Google Ads and conversion measurement

With consent to “Marketing”, Google Ads may be used to measure campaign performance and, depending on account configuration, personalise advertising. This may involve processing ad clicks, visited pages, conversion events, browser and device data and pseudonymous cookie or advertising IDs. The Google Ads conversion for this website is a successfully submitted demo request; form contents are not sent to Google.

The legal basis is your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. Consent Mode v2 transmits the states for ad_storage, ad_user_data and ad_personalization. Without marketing consent, all three states remain denied.

7. Storage technologies and lifetimes

Google may use additional storage technologies depending on the product, browser and account configuration. The current Google information applies.

8. Recipients and transfers to third countries

Recipients may include authorised internal staff, hosting/IT providers and, with consent, Google Ireland Limited and affiliated Google companies. Processing in the USA cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework; standard contractual clauses may also be used. The specific transfer mechanism must be checked in Google’s contractual documents.

9. StaySend as SaaS for hotels

When the product is subsequently used, hotel and guest data may be processed for offers, follow-up messages, communication before and after a stay and invitations to book again. The hotel generally remains the controller; StaySend processes data according to documented instructions. Before production use, the data processing agreement, technical and organisational measures, subprocessors, deletion periods and legal bases for transactional and marketing emails must be established.

Facebook and Instagram guest messages

Connected hotel accounts send messages, channel-specific identifiers and supported attachments to StaySend through Meta. Replies are sent through Meta. Content is normally deleted after 180 days. The connection can be revoked and does not constitute marketing consent.

AI for guest messages

When a hotel enables AI for reply suggestions or approved automatic replies, StaySend processes excerpts of the guest message and conversation together with relevant hotel information. The currently configured guest AI uses OpenAI. Message text is sent to OpenAI for this purpose, including connected Facebook and Instagram chats. Depending on the configured provider services, processing may take place outside the EU. AI is not used to make decisions about guests with legal effects.

Before AI processing, StaySend removes recognised email addresses, phone numbers, URLs and reference numbers from the transmitted text. Free text may still contain personal details such as names; complete anonymisation is not guaranteed. Hotel-account credentials and raw message webhooks are not part of the AI text. Staff can pause automation in the conversation.

10. Your rights

Under the GDPR, you have rights of access, rectification, erasure, restriction of processing, data portability and objection. You may withdraw consent at any time with effect for the future. For cookie consent, use “Cookie settings” in the footer; for other enquiries, write to info@staysend.com.

You may also lodge a complaint with a data protection supervisory authority. The competent authority is: Garante per la protezione dei dati personali – https://www.garanteprivacy.it

11. Automated decisions and changes

No solely automated decisions with legal or similarly significant effects are made on this website.

We update this policy when services, configurations or legal requirements change. The version published on this page applies.