Legal

Privacy policy

TMBTP Limited (trading as Otel AI) - Privacy Statement

1. Your personal data which we collect and obtain

1.1 This Privacy Statement ("Statement") sets out the basis on which TMBTP Limited trading as Otel ("we", "our", "us" or "Otel") of 3rd Floor, 61 Thomas St, The Liberties, Dublin, Dublin 8, D08 W250, Ireland, processes personal data which we collect relating to you or which you provide to us. The information provided by you will be held by Otel as a data controller unless otherwise stated.

1.2 This Statement applies to Otel's website and platform (the "Platform"). Otel works hard to protect your right to privacy and the protection of your personal data. We want you to feel secure that when you deal with Otel, your personal data are in good hands. Otel protects your personal data in accordance with applicable laws and our data privacy policies. In addition, Otel maintains the appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing and/or against accidental loss, alteration, disclosure or access, or accidental or unlawful destruction of or damage thereto.

1.3 Otel collects personal data from hotels and hospitality businesses, including in particular guest and employee personal data. In some cases, this means also processing personal data relating to former/prospective employees/directors or agents, suppliers, business contacts, shareholders of those hotels and hospitality businesses. If the data we collect are not listed in this Statement, we will give individuals (when required by law) appropriate notice of which other data will be collected and how they will be used.

1.4 We may collect and process the following personal data about you:

Category of personal information	Types of personal information
Personal details, contact details, and identifiers	You may give us information about you by filling in forms on the website, or by corresponding with us by email. The information you give us may include the following: Name; Pronoun; Email; Username; and Miscellaneous other personal identifiers.
Guest data	Guest profile ID, first name, last name, and title; country/nationality and language; VIP status and category; company name and travel agent name (where applicable); reservation attributes including arrival and departure dates, length of stay, room type, rate code, market segment, booking channel, payment method, walk-in flag, average daily rate (ADR), and total revenue; and reservation traces and notes entered by hotel staff.
Employee data	Employee name; salary; employment type (full-time, part-time, or hourly); and visa status (where applicable).
Commercial and market information	Data from non-property management system commercial sources (including revenue management and benchmarking tools) consists of aggregated commercial and market data only. Typically, no personal data flows from those systems, however it may be mixed with the following headings: Account management information; Project support and delivery related personal data; Commercial history of service delivery; and Commercial emails between you and us when it is sent to a dedicated mailbox or via other electronic communication means such as for administering payments, billing related issues, and Platform subscription management, including follow-up.
System and application access data	Login credentials and authentication data; user access permissions and roles within the Platform; session tokens; and system activity logs associated with your Platform account.
Device information	If you use the website or Platform on your device, we may collect data about your device.
Log information	Details of your use of the website and Platform including, but not limited to, traffic data, weblogs, analytical SDKs and other communication data and the resources that you access.
Location information	We collect data indicating your location while you are using the website or Platform.
Information we receive from other sources	From time to time, we may obtain personal data from other sources aside from you, such as through marketing leads, data integrations with third-party hotel management systems, or data imports from your existing operational systems.

2. How and why we process your personal data

2.1 The following table demonstrates what legal basis Otel relies on when we process personal data, and for what purpose we process personal data:

Legal bases and purposes
Purpose(s)	Legal basis	Indicative personal data processed
Managing our commercial relationshipStandard email communications with you relating to work and work products including support incidents and Platform-related queries.Personal data may be ingested through meeting notes, on calls with you, when we visit your business locations, or through your use of the Platform.Access to the website and PlatformTo provide you with access to the website and Platform and to enable you to use the website and Platform.	Necessary for the performance of a contract to which you are a partyThe personal data processing is necessary for the purpose of us providing our services, including the Platform, to you or your organisation.	Personal details, contact details, and identifiers. Guest data Employee data Commercial and market information System and application access data Device information Log information Location information Information we receive from other sources
Improving website functionality and efficiencyTo provide, improve, test and monitor the effectiveness of the website and Platform.To monitor metrics such as total number of visitors, traffic data and demographic patterns.Responding to queries and complaintsTo process and respond to any queries or complaints you submit to us via the website.Client profilingTo build up a profile of you as a client and assess your suitability for certain services or Platform features which we offer.Advertising and marketingTo provide you with advertising and marketing material relating to services which we offer.	Necessary for the purposes of the legitimate interests pursued by OtelThe processing of these categories of personal data are necessary for the purposes of providing our services, including the Platform.	Personal details, contact details, and identifiers. System and application access data Device information Log information Location information Information we receive from other sources
Sensitive personal dataOtel may process a limited amount of special category personal data when permitted by data protection laws with your consent.	ConsentYou give your full express consent to have your data processed by us.	Health/medical information (such as disability or dietary requirements/allergies such as for events).
Legal claimsTo file legal proceedings.To investigate, establish, exercise or defend a legal claim.To settle legal claims.	To defend, establish or be a party to legal claimsWe may process your personal data as necessary in order for us to establish, investigate, exercise or defend a legal claim to which you are a party.	Personal details, contact details, and identifiers. Guest data Employee data Commercial and market information System and application access data Device information Log information Location information Information we receive from other sources

3. Who we share your personal data with

3.1 We may disclose your personal data to some or all of the following recipients:

Regulatory authorities and law enforcement agencies (where we are under a duty to disclose or share your personal data in order to comply with any legal or regulatory obligation or request).
External advisors (for example, lawyers, accountants and auditors) as necessary or desirable to protect our legitimate and legal interests.
Service providers for logistical and IT service purposes, including the following:
- Hosting provider: Amazon Web Services (AWS), a cloud hosting and infrastructure (eu-west-1, Ireland);
- AI service providers: large language model services OpenAI and Anthropic, which are used within the Platform on zero data retention enterprise terms; and integration partners.
- Third-party hotel management system providers: to the extent data flows from those systems into the Platform. We also use standard business IT programs and Platform-specific infrastructure and hosting providers.

4. Storage and transfers of your personal data

4.1 Otel stores all personal data within the European Economic Area ("EEA"). Our primary hosting environment is located in Ireland. All personal data is held in accordance with appropriate standards of IT security, including AES-256 encryption at rest and TLS 1.2 or higher encryption in transit. Where Otel uses third-party service providers who process data outside the EEA, appropriate transfer mechanisms (such as Standard Contractual Clauses) are in place. If you would like to find out more about the appropriate safeguards that we have in place you can contact us at contact@otelai.com.

4.2 Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to or from the website; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

5. Use of artificial intelligence

5.1 The Platform utilises artificial intelligence ("AI") technologies to process data, including personal data, for the purposes of providing and improving our services. AI is used to analyse data (including personal data) which is ingested into the Platform to generate insights, reports, and recommendations for your hotel or hospitality operations.

5.2 Notwithstanding the use of AI within the Platform, Otel does not engage in automated decision-making (including profiling) which produces legal effects concerning you or similarly significantly affects you, as contemplated by Article 22 of the General Data Protection Regulation. All decisions of material significance are subject to meaningful human oversight and intervention.

5.3 Where the Platform utilises third-party AI services (including large language model providers), Otel takes steps to ensure that any such processing is conducted under enterprise-grade terms that include, where available, zero data retention arrangements. Any transfers of personal data to third-party AI providers outside the European Economic Area are subject to appropriate transfer mechanisms, including Standard Contractual Clauses where applicable.

6. How long we keep your personal data for

6.1 In general, we expect to keep your personal data for as long as is necessary for the purposes for which it was collected. However, please note that in certain circumstances we may hold certain of your personal data for a longer period, for example, if we are processing an ongoing claim or believe in good faith that the law or a relevant regulator may reasonably in our view expect or require us to preserve your personal data. The criteria we will use to determine the period for which we will hold your personal data include: (a) the length of our relationship with you; (b) whether we are under a legal obligation under Irish or European Union law which requires the retention of your personal data; (c) whether the retention of your personal data is required in light of our legal position.

7. Linked websites

7.1 The website, Platform or our services may present links to other websites ("Linked Websites"). We are not responsible for the privacy statements or practices on Linked Websites. This Statement governs only personal data which Otel is a controller of. When accessing Linked Websites, you should read the privacy statement published on the relevant Linked Website. This Statement does not apply to Linked Websites. Please check the statements on such websites before you submit any personal data.

7.2 Otel's website contains links to other websites and resources provided by third parties for your convenience and information only. We accept no liability in connection with any Linked Website, or any contract entered into with any third party on or through a Linked Website. We have no control over the content of those websites or resources and accept no responsibility for them or for any loss or damage that may arise from your use of Linked Websites.

8. Your rights

You have a number of rights in relation to your personal data as set out in the table below subject to the exceptions, set out in applicable law.

Note that in certain circumstances these rights might not be absolute.

Right	Further information
Right of access	You have the right to request a copy of the personal data held by us about you and to access the information which we hold about you. We will charge you for making such an access request where we feel your request is unjustified or excessive.
Right to rectification	You have the right to have any outdated or inaccurate personal data which we hold about you updated or corrected.
Right to erasure	In certain circumstances, you may also have your personal data deleted, for example if you exercise your right to object (see below) and we do not have an overriding reason to process your personal data or if we no longer require your personal data for the purposes set out in this Statement.
Right to restriction of processing	You have the right to ask us to restrict processing your personal data in certain cases, including if you believe that the personal data we hold about you is inaccurate or that our use of your personal data is unlawful. If you validly exercise this right, we will store your personal data and will not carry out any other processing, other than processing your data in line with our retention periods until the issue is resolved.
Right to data portability	You may request us to provide you with your personal data which you have given us in a structured, commonly used and machine-readable format and you may request us to transmit your personal data directly to another data controller where this is technically feasible. This right only arises where we process your personal data on the legal bases of your consent or where it is necessary to perform our contract with you.
Right to object	You have a right to object at any time to the processing of your personal data where we process your personal data on the legal basis of pursuing our legitimate interests.

8.1 You can seek to exercise any of these rights by contacting us at contact@otelai.com.

8.2 We will provide you with information on any action taken upon your request in relation to any of these rights without undue delay and at the latest within one month of receiving your request. We may extend this up to 2 months if necessary however we will inform you if this arises.

8.3 Our lead regulatory authority is the Data Protection Commission ("DPC") which is based in Ireland. You have the right to lodge a complaint with the DPC with regards to our processing of your personal data. You can contact the DPC directly at:

Data Protection Commission, 21-25 Canal Road, Dublin 6, D06 F46C, Ireland
Phone: +353 (0)761 104 800
Email: info@dataprotection.ie

9. Changes to this notice

9.1 We may amend this Statement on occasion, in whole or part, at our sole discretion. Any changes will be posted on this page which will be kept up to date. Please check this Statement regularly for changes.

9.2 If at any time we decide to use your personal data in a manner significantly different from that stated in this Statement, or otherwise disclosed to you at the time it was collected, we will change this Statement, and you will have a choice as to whether or not we can use your personal data in the new manner.

10. Contact

10.1 Questions, comments and requests regarding this Statement are welcomed and should be addressed to contact@otelai.com.