Draft for review. This page reproduces the source legal document, which
still contains
[PLACEHOLDER] fields (effective dates, registered
addresses, tax IDs, URLs, and contact emails) and is pending final legal
sign-off. Complete the placeholders and confirm the wording with legal
before publishing, then remove this note.1. Introduction
This Privacy Policy explains how personal data is collected, used, stored, and shared when you use the HBX Group Self-Serve Advertising Portal (the “Portal”). The Portal is a service offered by Hotelbeds Technology, S.L.U. (“HBX”). The technology powering the Portal is provided by Platform 195 Ltd (“Platform 195”) through its Uplift Hub platform. This Privacy Policy applies to authorised users of the Portal. References to “you” and “your” in this policy should be read accordingly. HBX process personal data in accordance with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”), together with any other data protection laws applicable to the processing. Where HBX acts as data controller in respect of individuals located in the European Economic Area (EEA), the processing is also governed by Regulation (EU) 2016/679 of the European Parliament and of the Council (“EU GDPR” or “GDPR”). As Hotelbeds Technology, S.L.U. is incorporated in Spain, HBX is subject to both the EU GDPR and the UK GDPR where relevant to the respective data subjects. References to “UK GDPR” throughout this policy should be read as including the EU GDPR where the latter applies.2. Data Controller
The data controller of the personal data you have provided us with is HBX3. Data Protection Officer (DPO)
HBX has a Global Data Protection Officer to respond to queries, requests or clarifications regarding the processing of personal data. You can contact DPO at dataprotection@hbxgroup.com or at our postal address, mentioned in section 9.4. Data We Collect
3.1 Registration and Account Data
- Hotel identification number and associated property details
- Contact name, email address, and business role
3.2 Campaign and Transaction Data
- Package selections and campaign configurations (hotel selection, start date, source market, targeting)
- Purchase history, invoicing, and financial records
- Payment data (when online payment is enabled): masked card details, payment authorisation tokens, transaction identifiers, and related billing information processed via our payment service provider. This functionality is not active in the current phase of the Portal and this policy will be updated prior to its activation.
3.3 Usage and Performance Data
- Campaign delivery metrics: impressions, clicks, click-through rates, conversions
- Portal usage: pages visited, features used, session duration
- Technical data: device type, browser, IP address, operating system
3.4 Communications
- Automated lifecycle emails (registration, purchase, launch, expiry, completion reports)
- Support correspondence
4. Purposes and Legal Basis
We process your data for the following purposes:- **Service delivery **(contractual necessity): account creation, campaign configuration, delivery, and reporting
- **Invoicing and financial records **(contractual necessity): processing purchases and maintaining transaction records
- **Communications **(contractual necessity / legitimate interest): transactional notifications and campaign lifecycle emails
- **Service improvement **(legitimate interest): analysing usage to improve the Portal
- **Security and fraud prevention **(legitimate interest): protecting the Portal and detecting misuse
- **Legal compliance **(legal obligation): tax records, regulatory requirements
5. How Data is Shared
5.1 Between HBX and Platform 195
Platform 195 is a data processor. Platform 195 processes personal data on behalf of HBX to operate the Uplift Hub platform, manage campaign delivery, and generate performance reporting. Platform 195 does not use your personal data for its own independent purposes. Platform 195 may, however, generate and use aggregated or anonymised data (which does not identify any individual) for its own purposes, including monitoring and improving the performance, security and functionality of the Platform, producing aggregate insights and benchmarks, and developing related products and services5.2 Third-Party Service Providers
- **Ad server (Kevel): **Campaign configuration and targeting data is shared with Kevel to deliver Sponsored Listings across Hotelbeds and Bedsonline
- **Analytics providers: **Pseudonymised or aggregated usage data may be shared with analytics tools to improve Portal performance
- **Hosting and infrastructure providers: **Cloud hosting, email delivery, logging, error-monitoring and similar infrastructure providers engaged to operate the Portal, in each case acting as sub-processors under written contracts
- Public authorities and judicial bodies: Public administrations—including tax authorities—law enforcement agencies and judicial bodies may be required to act in accordance with applicable legal obligations relevant to HBX Group’s activities in your location
- Corporate transactions** & intragroup sharing**: Interested third parties and their advisors involved in any operation of structural modification or the contribution or transfer of a business or branch of business activity within HBX Group, where such sharing is necessary for those purposes. The HBX Group local entity may share your personal data with other HBX Group entities for internal administrative and centralized management purposes
- **Professional advisers and authorities: **Auditors, lawyers, accountants and, where legally required, regulators, tax authorities, courts or law-enforcement agencies
- **Payment service provider: **When online payment functionality is enabled, payment transaction data will be shared with our payment service provider acting as a sub-processor under a written data processing agreement. This policy will be updated with full details prior to activation of online payment.
6. Data Retention
We will only retain your personal data for as long as we need it for the purposes for which we collect it and to comply with legal, financial, commercial or reporting requirements, or until you withdraw your consent. In some circumstances, we may anonymise personal data so that it is no longer identifiable and we can continue to use it. When we no longer need the personal data, we will delete or destroy it securely. HBX Group will retain the data collected for the above purposes for the duration of your relationship with HBX Group and, even thereafter, until the expiry of any legal liability arising therefrom.7. Automated decisions
HBX does not make decisions that may affect you based solely on the automated processing of your personal data. All decision-making processes related to the processing purposes described above are carried out with human intervention. The profiling indicated for candidate management purposes will in no case be used in decision-making by our organisation that may have legal effects on you or that may significantly affect you.8. International Transfers
HBX Group works with suppliers outside the European Economic Area, the UK, and Switzerland if their data protection regulations are deemed equivalent by relevant authorities. If suppliers are in countries without such equivalence, HBX Group ensures all required privacy safeguards are in place after verifying local laws. Sometimes, your data is transferred abroad when necessary for booking or fulfilling contracts, such as sharing details with hotels or partners in your chosen destination. Safeguards may include contractual clauses, extra guarantees, or binding corporate rules approved by data protection authorities. For EEA citizens, these clauses are available here. Regulations also permit us to transfer your data internationally when needed to deliver requested services. We also inform you that HBX Group has companies outside the European Union, the United Kingdom or Switzerland. In such cases, HBX Group requires these companies to comply with appropriate measures to protect your personal data in accordance with European regulations. For more information about your privacy guarantees, or the destination countries to which we need to transfer your data in order to fulfil our contractual obligations to you, you can contact HBX Group at the addresses indicated in section 9 of this Privacy Policy.9. Your Rights
You may exercise, with respect to the data collected, the rights of access, rectification, object, deletion, limitation and portability of data, in accordance with the regulations on data protection and withdraw your consent, as well as the right to define directives regarding the fate of your data after your death. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. These rights may be exercised by sending a communication:- By email todataprotection@hbxgroup.com with the subject line “Personal Data”; or
- By post with proof of receipt by HBX Group, indicating “Data Protection” on the envelope, addressed to the following address:
- DPO: Camí Son Fangos, 100, Palma de Mallorca, Spain
- Company: 7th Floor Tower 42, 25 Old Broad Street, London, EC2N 1HN
- By post or email to the addresses indicated above, or
- To the UK Data Protection Authority, the Information Commissioner’s Office (ICO) at www.ico.org.uk, or
- To another personal data protection authority, for example, the competent authority in your usual place of residence, place of work or where the infringement took place. The contact details of the main data protection authorities can be found here.