GDPR

Hi lovely customers,

The GDPR (General Data Protection Regulation) entered into force on May 25th 2016 and officially applies as of May 25th 2018, and changed the data protection framework within Europe. To help you understand better what we both have to do as a result of the GDPR when you become our customer, we have created this page.

Now is the time to grab yourself a yummy cup of coffee or tea. Find out what we're doing, and what you need to do under the GDPR when you become a customer of Oaky (and when you use any other data processor).

You can always reach out to us at privacy@oaky.com if you have any questions at all.

What do Oaky customers need to do?

1. Update your Privacy Policy
   The legal requirement to inform the guests of the processing activities (e.g. through a privacy policy), is an obligation for the Customer Accommodation Provider as the data controller. Please make sure your Privacy Policy is properly communicated to your users about how you are using Oaky (and any other similar services) to process personal data and for which purposes the processing takes place (for example, by means of providing upgrades, bike rental, restaurant reservations, etc.). This requirement is also part of Oaky’s Terms of Service, but the GDPR can heavily penalize you if this is not done clearly
   
   Example: “We may share your personal data with third parties offering services to us. An example of such a third party offering services to us is Oaky B.V. We may use the Oaky services to communicate with you and to offer you specific services and upgrades that relate to your stay with us. Oaky acts as a data processor of your personal data on behalf of us, with the purpose of offering Oaky services to us. We require all third party service providers to respect the security of your personal data, to treat it in accordance with the law and to process your personal data only in accordance with our instructions.”
   *Please note that this text is merely a suggestion and that the hotels remain responsible for providing adequate information to the data subjects.
2. Sign the Data Processing Agreement (DPA)Sign the Data Processing Agreement (DPA)
   The data controller is obliged to sign a DPA with all of its processors. We have prepared this DPA together with our legal counsel to be in compliance with GDPR.
   Click here to view our Data Processing Agreement: www.oaky.com/dpa
   
3. Check whether opt-in consent is required for sending emails through Oaky
   As said above, applicable local law may require the hotel to obtain opt-in consent of guests for sending marketing emails with Oaky. If the messages have an informational character only, most likely, this does not qualify as a marketing message. We recommend carefully checking whether opt-in consent of guests is required when using Oaky.

What are the answers to 5 GDPR questions Oaky customers need to know?

As a data controller, you need to be able to answer five questions relating to your data processors towards your guests. These five questions are:

1. Which personal data does Oaky process on behalf of the Customer Accommodation Providers?
2. What is the purpose of the processing activities of Oaky?
3. How long does Oaky store the data for?
4. Which third parties have access to personal data (internal and external)?
5. How is the data protected?

To help you answer these questions, check out our privacy policy.

Oaky (as data processor) is not legally required to have a privacy policy for the guests of the hotels, as it only processes the personal data on behalf of the Customer Accommodation Providers. The legal requirement to inform the guests of the processing activities (e.g. through a privacy policy), is an obligation for the Customer Accommodation providers as the data controller.