1. Introduction
This Privacy Policy explains how personal data is collected, used, stored, and shared when you use the HBX Group Self-Serve Advertising Portal (the “Portal”). The Portal is a service offered by HBX Group International PLC (“HBX Group”). The technology powering the Portal is provided by Platform 195 Ltd (“Platform 195”) through its Uplift Hub platform. This Privacy Policy applies to authorised users of the Portal. References to “you” and “your” in this policy should be read accordingly. HBX Group process personal data in accordance with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”), together with any other data protection laws applicable to the processing. Where HBX Group acts as data controller in respect of individuals located in the European Economic Area (EEA), the processing is also governed by Regulation (EU) 2016/679 of the European Parliament and of the Council (“EU GDPR” or “GDPR”). HBX Group is subject to both the EU GDPR and the UK GDPR where relevant to the respective data subjects. References to “UK GDPR” throughout this policy should be read as including the EU GDPR where the latter applies.2. Data Controller
The data controller of the personal data you have provided us with is HBX Group.3. Data Protection Officer (DPO)
HBX Group has a Global Data Protection Officer to respond to queries, requests or clarifications regarding the processing of personal data. You can contact DPO at dataprotection@hbxgroup.com or at our postal address, mentioned in section 10.4. Data We Collect
4.1 Registration and Account Data
- Hotel identification number and associated property details
- Contact name, email address, and business role
4.2 Campaign and Transaction Data
- Package selections and campaign configurations (hotel selection, start date, source market, targeting)
- Purchase history, invoicing, and financial records
- Payment data (when online payment is enabled): masked card details, payment authorisation tokens, transaction identifiers, and related billing information processed via our payment service provider. This functionality is not active in the current phase of the Portal and this policy will be updated prior to its activation.
4.3 Usage and Performance Data
- Campaign delivery metrics: impressions, clicks, click-through rates, conversions.
- Product analytics data (processed only where you consent - see section 4): records of the actions you take within the Portal, such as campaigns created, line items configured, creatives uploaded and reports exported, together with the time of each action and the account and role associated with it. These records are linked to your account through a pseudonymised identifier.
- Device and technical data (processed as part of analytics only where you consent -see section 4): limited technical information about the device and software you use to access the Portal, such as device type, browser and browser version, operating system, and screen or window size. We use this to understand how the Portal performs across different devices and to improve the interface. Collecting some of this information involves accessing information stored on your device; we do this only with your consent.
- Technical and security data: IP address and related connection information are processed where necessary for the security, integrity and operation of the Portal and to prevent fraud or misuse. This is processed on the basis of our legitimate interests in securing the service, separately from the consent-based analytics above, and your IP address is not used for product analytics.
4.4 Communications
- Automated lifecycle emails (registration, purchase, launch, expiry, completion reports)
- Support correspondence
5. Purposes and Legal Basis
We process your data for the following purposes:- Service delivery (contractual necessity): account creation, campaign configuration, delivery, and reporting
- Invoicing and financial records (contractual necessity): processing purchases and maintaining transaction records
- Communications (contractual necessity/ legitimate interest): transactional notifications and campaign lifecycle emails
- Product analytics and service improvement (consent): where you opt in, we analyse your individual interactions with the Portal - linked to your account through a pseudonymised identifier, and including limited technical and device information (such as device type, browser and screen size) - to understand how features are used and how the Portal performs across devices, and to improve it. This processing takes place only where you have given consent, and may involve accessing information stored on your device. You may withdraw your consent at any time (see section 10), which will stop this processing going forward without affecting the lawfulness of processing carried out before withdrawal. Declining or withdrawing consent does not affect your access to, or use of, the Portal.
- Security and fraud prevention (legitimate interest): protecting the Portal and detecting misuse
- Legal compliance (legal obligation): tax records, regulatory requirements
6. How Data is Shared
6.1 Between HBX Group and Platform 195
Platform 195 is a data processor. Platform 195 processes personal data on behalf of HBX Group to operate the Uplift Hub platform, manage campaign delivery, and generate performance reporting. Platform 195 does not use your personal data for its own independent purposes. Platform 195 processes the consent-based product analytics described in sections 3.3 and 4 strictly as a processor, acting on HBX Group’s documented instructions and under the data processing agreement between HBX Group and Platform 195. Separately, Platform 195 may generate and use genuinely anonymised or aggregated data - data that does not identify, and cannot reasonably be used to single out, any individual - for its own purposes, including monitoring and improving the performance, security and functionality of the Platform, producing aggregate insights and benchmarks, and developing related products and services. Platform 195 does not use individual-level or pseudonymised Portal data for its own purposes.6.2 Third-Party Service Providers
- Ad server (Kevel): Campaign configuration and targeting data is shared with Kevel to deliver Sponsored Listings across Hotelbeds and Bedsonline.
- Analytics providers: Pseudonymised or aggregated usage data may be shared with analytics tools to improve Portal performance
- Hosting and infrastructure providers: Cloud hosting, email delivery, logging, error-monitoring and similar infrastructure providers engaged to operate the Portal, in each case acting as sub-processors under written contracts
- Public authorities and judicial bodies: Public administrations - including tax authorities - law enforcement agencies and judicial bodies may be required to act in accordance with applicable legal obligations relevant to HBX Group’s activities in your location
- Corporate transactions & intragroup sharing: Interested third parties and their advisors involved in any operation of structural modification or the contribution or transfer of a business or branch of business activity within HBX Group, where such sharing is necessary for those purposes. The HBX Group local entity may share your personal data with other HBX Group entities for internal administrative and centralized management purposes
- Professional advisers and authorities: Auditors, lawyers, accountants and, where legally required, regulators, tax authorities, courts or law-enforcement agencies
- Payment service provider: When online payment functionality is enabled, payment transaction data will be shared with our payment service provider acting as a sub-processor under a written data processing agreement. This policy will be updated with full details prior to activation of online payment.
7. Data Retention
We will only retain your personal data for as long as we need it for the purposes for which we collect it and to comply with legal, financial, commercial or reporting requirements, or until you withdraw your consent. In some circumstances, we may anonymise personal data so that it is no longer identifiable and we can continue to use it. When we no longer need the personal data, we will delete or destroy it securely. Product analytics data will be retained for 12 months from the date of collection, after which it will be deleted or irreversibly anonymised. However, where you withdraw your consent or exercise your right to erasure, any analytics records linked to your account will be deleted in accordance with your request, without waiting for the expiry of the general 12-month retention period. As these records are linked to your account through a pseudonymised identifier that Platform 195 can resolve on HBX Group’s behalf, we are able to identify and delete the analytics records associated with your account upon receipt of such a request. HBX Group will retain the data collected for the above purposes for the duration of your relationship with HBX Group thereafter, for as long as necessary to comply with applicable legal obligations or to establish, exercise, or defend legal claims.8. Automated decisions
HBX Group does not make decisions that may affect you based solely on the automated processing of your personal data. All decision-making processes related to the processing purposes described above are carried out with human intervention. The profiling indicated for candidate management purposes will in no case be used in decision-making by our organisation that may have legal effects on you or that may significantly affect you.9. International Transfers
HBX Group works with suppliers outside the European Economic Area, the UK, and Switzerland if their data protection regulations are deemed equivalent by relevant authorities. If suppliers are in countries without such equivalence, HBX Group ensures all required privacy safeguards are in place after verifying local laws. Sometimes, your data is transferred abroad when necessary for booking or fulfilling contracts, such as sharing details with hotels or partners in your chosen destination. Safeguards may include contractual clauses, extra guarantees, or binding corporate rules approved by data protection authorities. For EEA citizens, these clauses are available here. Regulations also permit us to transfer your data internationally when needed to deliver requested services. We also inform you that HBX Group has companies outside the European Union, the United Kingdom or Switzerland. In such cases, HBX Group requires these companies to comply with appropriate measures to protect your personal data in accordance with European regulations. For more information about your privacy guarantees, or the destination countries to which we need to transfer your data in order to fulfil our contractual obligations to you, you can contact HBX Group at the addresses indicated in section 10 of this Privacy Policy.10. Your Rights
You may exercise, with respect to the data collected, the rights of access, rectification, object, deletion, limitation and portability of data, in accordance with the regulations on data protection and withdraw your consent, as well as the right to define directives regarding the fate of your data after your death. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. These rights may be exercised by sending a communication:- By email to dataprotection@hbxgroup.com with the subject line “Personal Data”; or
- By post with proof of receipt by HBX Group, indicating “Data Protection” on the envelope, addressed to the following address:
- DPO: Camí Son Fangos, 100, Palma de Mallorca, Spain
- Company: 7th Floor Tower 42, 25 Old Broad Street, London, EC2N 1HN
- By post or email to the addresses indicated above, or
- To the UK Data Protection Authority, the Information Commissioner’s Office (ICO) at www.ico.org.uk, or
- To another personal data protection authority, for example, the competent authority in your usual place of residence, place of work or where the infringement took place. The contact details of the main data protection authorities can be found here.