Data Processing Policy

Hospy is a product of Hospy Solutions LLC, registered in Delaware, USA. Hospy is a web platform that works as a digital co-host for hospitality businesses, including vacation rentals, hotels, apart-hotels and professionally managed properties. By subscribing to Hospy, it's like hiring a digital employee who handles operational, commercial and customer service tasks. Unlike a human collaborator, Hospy can work 24 hours a day, serve multiple properties simultaneously and execute thousands of actions without errors.

This Personal Data Processing Policy describes how we collect, use, store and protect the personal data of:

• Guests/travelers/tourists, who access Hospy's Secure Links for online check-in, chatting with support agents and purchasing tourist services.
• Commercial clients, such as property managers, hotels and Airbnb hosts.

This policy applies in compliance with the General Data Protection Regulation (GDPR — EU 2016/679), the General Data Protection Law (LGPD — Brazil, Law No. 13,709/2018), and other applicable regulations in the countries where we operate.

Hospy acts in different roles depending on whose data is being processed:

a. Hospy as Data Processor

For the personal data of guests/travelers/tourists, Hospy acts as Data Processor because:

• It processes data on behalf of and under the instructions of property managers, hotels or hosts, who are the Data Controllers.
• It does not determine the purposes or means of processing, but provides a platform to fulfill client instructions.

Hospy collects and manages the data necessary for online check-in, identity validation and compliance with the data controller's legal obligations. This processing is governed by a Data Processing Agreement (DPA) in accordance with Article 28 of the GDPR and Article 39 of the LGPD.

b. Hospy as Data Controller

For the personal data of commercial clients (property managers, hotels, hosts), Hospy acts as Data Controller because:

• It defines the purposes and means of processing, such as account management, invoicing, payments, support and communications.
• It decides how these data are stored, processed and protected.

These data are collected during the platform registration process or during the course of the commercial relationship.

a. From guests/travelers/tourists:

• Name, date of birth, nationality, document type and number, document image, selfie.
• Email address, phone number.
• Booking data: property, stay dates, number of guests.
• In some cases, device location.
• Conversation logs with virtual agents and tourist service requests.

b. From commercial clients:

• Full name, email address, phone number.
• Tax and banking data.
• Business information: company name, managed properties, platform activity.
• Payment history, invoices and communications.

a. For guests/travelers/tourists:

• Enable online check-in and property access.
• Comply with regulatory obligations (authorities, buildings, insurance, etc.).
• Verify identity and prevent fraud.
• Offer additional or tourist services (with prior authorization).
• Handle requests through human or virtual agents.

b. For commercial clients:

• Account, subscription and property management.
• Invoice issuance and payment processing.
• Technical and commercial support.
• Sending relevant notifications and service updates.

We process personal data based on:

• Contract execution: provision of Hospy's service.
• Legal compliance: tax, tributary and security obligations.
• Legitimate interest: service improvement, fraud prevention, internal control.
• Consent: for optional purposes such as marketing or analytics.

Hospy may share data with:

• Property managers, hotels and hosts, to facilitate check-in and access processes.
• Public authorities, if there is a legal obligation.
• Technology providers, such as cloud storage, identity verification and payment processing services.

When data is transferred outside the country of origin (e.g., to the USA), legal safeguards such as Standard Contractual Clauses (SCCs) or international transfer agreements under GDPR and LGPD are applied.

Hospy applies appropriate technical and organizational measures to protect personal data against loss, misuse or unauthorized access.

Retention periods:

• Guests/travelers/tourists: data is deleted after the period necessary to fulfill contractual or legal obligations.
• Commercial clients: data is retained for the duration of the contractual relationship and then for the periods required by law (e.g., accounting or taxes).

a. Guests/travelers/tourists:

Have the right to:

• Access their data
• Rectify incorrect information
• Request deletion
• Restrict or object to processing
• Request portability

How to exercise these rights? Contact the property manager, hotel or host directly. If no response is received, you may write to Hospy for guidance: info@hospy.co.

b. Commercial clients:

Have the right to:

• Access, rectify and delete their data
• Object to processing for promotional purposes
• Request a copy or portability of the information

Contact: info@hospy.co

Access to Secure Links and the admin panel uses cookies to:

• Ensure the technical operation of the platform (essential cookies).
• Analyze system usage (analytics cookies).
• Remember user preferences (personalization cookies).

You can manage cookie usage from your browser settings. See our Cookie Policy for more information.

Hospy may update this policy at any time. Important changes will be communicated on the website, by email or within the platform.

Hospy Solutions LLC may send text messages (SMS) to the phone number provided by the guest or commercial client, solely for the following purposes:

• Confirm and facilitate the online check-in process.
• Share instructions on property access.
• Provide operational support during the stay.
• Offer additional tourist services (such as early check-in, late check-out, transportation, etc.), only when the guest has shown interest or given prior consent.

Express consent and opt-out

By entering their phone number on check-in or contact forms, the data subject expressly agrees to receive transactional or informational communications via SMS. At any time, the user may stop receiving these communications by replying to the message with the word STOP, or by writing to info@hospy.co.

Hospy will not share the phone number with third parties other than the providers necessary for sending these messages (e.g., messaging services like Twilio), and guarantees that they also comply with applicable data protection regulations.