Last updated: October 06,2021
Oaky B.V. (Oaky, we us or our) is committed to protecting your privacy and takes its responsibilities regarding the security of personal data very seriously. This policy explains how we use personal data and how we protect your privacy in accordance with the General Data Protection Regulation (Algemene Verordening Gegevensbescherming, GDPR).
1. What is Oaky?
Oaky is a tool used by our Customers Accommodation Providers (hotels, hostels, and serviced apartments) to communicate with their guests and to offer specific services and upgrades that relate to the upcoming hotel stay of their guests.
2. Data Controller and Data Processor
In the context of providing our services, the Customer Accommodation Providers is the data controller, and Oaky is the data processor. We process personal data that we collect or receive from the Customer Accommodation Provider. If we have received your personal data from the Customer Accommodation Provider, the Customer Accommodation Provider, as the data controller, has ensured that it has a legal basis to transfer your personal data to us, such as a legitimate interest or that your consent is obtained.
In addition, we may collect, use, store and transfer different kinds of personal data in the course of our business as a Data Controller. We may collect personal data through your use of our website https://oaky.com (the Website).
3. The data we collect about you
Personal data means any information about an individual from which that person can be identified, such as your first and last name, telephone number, postal and electronic addresses, date of birth and payment information. It does not include data where the identity has been removed (anonymous data).
We may obtain personal data directly from you by submitting your personal data to us, for instance when you contact us through our contact details or contact form on our Website. This includes:
- contact details such as name and email address; and
- other information or feedback you provide to us.
We may also collect personal data automatically when you visit or use the Website, such as data collected through cookies. This includes:
- data about your device and browser type (including IP address and MAC address); and
- data about your use of our Website, such as the web pages you have viewed, the hyperlinks you clicked on and websites you visited before you came to our website;
- data about your selected language version of a website;
- data about the chat-box session. This allows the website-support to see previous issues and reconnect with the previous supporter;
- data about the visitor's device and behaviour across devices and marketing channels. This for tracking the use of embedded services by social channels like YouTube videos or Google ads; and
Keeps track of a visitor's identity. This cookie is passed to the marketing platform HubSpot on form submission and used when de-duplicating contacts.
We do not collect any special categories of personal data about you.
4. How we use your personal data
We use the personal data that we collect about you only for specific purposes. This includes to perform the contract we have entered into with Customer Accommodation Providers, to offer our services to you on behalf of the Customer Accommodation Providers, to ensure that your access to and use of our Website is safe and uninterrupted and to assist you with any questions you may have.
|Purpose||Personal data||Legal ground||Retention period|
|Providing the services of Oaky to customers (guests of the Customer Accommodation Providers on behalf of the Customer Accommodation Providers.)|
* Personal data depending on Customer Accommodation Provider.
|We are a data processor. As a result, the Customer Accommodation Providers have a legal ground for processing the personal data.||For the duration of our services to the Customer Accommodation Providers or as otherwise indicated by the Customer Accommodation Providers.|
|To manage our relationship with you and communicate with you regarding:||Necessary for our legitimate interests (to provide support and respond to your questions and comments)||For 2 years of non-activity following the most recent activity using personal data|
|To measure interest in and improve our Website and customise your user experience.||Data about your use of our Website, such as webpages viewed and hyperlinks you clicked on.||Necessary for our legitimate interest (to keep our Website updated and relevant)||For 2 years of non-activity following the most recent activity using personal data|
|To administer our site and diagnose problems, to protect our business, to resolve disputes or troubleshoot problems, to prevent potentially prohibited or illegal activities.||Necessary for our legitimate interests (for running our business, IT services, network security, to prevent fraud and other prohibited or illegal activities).||For 2 years of non-activity following the most recent activity using personal data|
|To send newsletters about product updates, news from the industry, and other relevant information.|
Your consent to receive newsletters.
For the duration of the subscription of the newsletter. This ends whenever you unsubscribe from the newsletter.
5. Which third parties receive your personal data?
We will never sell personal data to third parties without your consent. We will not disclose your personal data to any third party unless we have a legitimate interest in doing so or if you have consented to this. We may only share personal data about you as follows:
- Third party service providers such as Google, Inspectlet, Hubspot, Social Media channels, and GoDaddy (website hosting provider), who provide or facilitate services on our behalf;
- With third-party vendors, sub-processors, consultants and other service providers who are approved by our Customer Accommodation Provider (information about these third parties is specific per Customer Accommodation Provider, and can be answered by your Customer Accommodation Provider);
- In response to a request for information if we believe disclosure is in accordance with any applicable law, regulation or legal process; or
- Partners who we create shared campaigns with. Example: When downloading a content piece created with a partner, your email address will be shared with that partner. We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow third party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
6. Who has access to the data (internal)?
Only authorized internal persons that require access to personal data in order to fulfil their duties to the Oaky Service will have access to the data.
7. International transfers
Several of our service providers are based outside the European Economic Area (EEA) so their processing of your personal data will involve a transfer of data outside the EEA.
Whenever we transfer your personal data outside the EEA, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:
- We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission.
- Where we use certain service providers, we may use specific contracts approved by the European Commission which give personal data the same protection it has in Europe.
- List all data processors of personal data outside of the EU
- The Rocket Science Group LLC d/b/a Mailchimp, Atlanta, USA
- Google LLC, Mountain View, USA
- Intercom, Delaware, USA
- Slack, San Francisco, USA
- Atlassian, San Francisco, USA
8. How is the data protected?
We take the security of your personal data very seriously. We have put in place appropriate technical and organisational security measures to prevent your personal data from being accidentally lost, used or accessed in unauthorised way, altered or disclosed.
We use secure connections (VPS) which protect all data traffic between you and our Website and/or Web Applications.
We implemented the following technical and organizational measures to protect personal data:
- Prevent unauthorized persons from gaining access to data processing systems with which personal data are processed or used;
- Prevent data processing systems from being used without authorization;
- Ensure that persons entitled to use a data processing system have access only to the personal data to which they have a right of access and a need to know basis. We ensure that the people who can access your personal data are bound by confidentiality obligations.;
- Ensure that personal data is adequately protected during transmission or transport; and
- Ensure that the personal data is processed in accordance with the instructions of our Customer Accommodation Provider.
9. Accuracy of personal data
Oaky makes reasonable efforts to keep personal data in its possession or control, which is used on an on-going basis, accurate, complete, current and relevant, based on the most recent information available to us.
10. Your rights in relation to your personal data
You have certain rights in relation to your personal data, in accordance with applicable law.
You have the following rights with regard to your personal data:
- The right to request access to your personal data. This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
- The right to request or correct your data if it is inaccurate. You may also supplement any incomplete data we have, taking into account the purposes of the processing.
- The right to request deletion of your personal data if:
- your personal data is no longer necessary for the purposes for which we collected or processed it; or
- you withdraw your consent if the processing of your personal data is based on consent and no other legal ground exists; or
- you object to the processing of your personal data and we do not have an overriding legitimate ground for processing; or
- your personal data is unlawfully processed; or
- your personal data has to be deleted for compliance with a legal obligation.
- The right to restrict the processing of personal data, if:
- the accuracy of your personal data is contested by you, for the period in which we have to verify the accuracy of the personal data; or
- the processing is unlawful and you oppose the deletion of your personal data and request restriction; or
- we no longer need your personal data for the purposes of processing, but your personal data is required by you for legal claims; or
- you have objected to the processing, for the period in which we have to verify overriding legitimate grounds.
- The right to data portability. You may request us to receive the personal data that concerns you. You may also request us to send this personal data to a third party, where feasible. You only have this right if it regards personal data you have provided to us, the processing is based on consent or necessary for the performance of a contract between you and us, and the processing is done by automated means.
You can exercise your rights by filing a request by e-mail to your Customer Accommodation Provider or to Oaky via firstname.lastname@example.org. We may need to request specific information from you to help us confirm your identity and ensure your right to exercise any of your rights. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We aim to respond to your request within one month after receiving such a request. However, this one-month term may be extended with two months. In such event, we will inform you within one month after receipt of your request and explain why the extension is necessary.
A cookie may contain information which provide for recognition of you as a visitor of the Website, every time you visit the Website. This helps us to provide you with a good experience and better services. It also allows us to improve our Website.
Except for functional and analytical cookies that have a limited impact on your privacy, we need your consent to place cookies. You have the right to choose whether or not to accept cookies. However, they are an important part of how our Website works, so you should be aware that if you choose to refuse or remove cookies, this could affect the availability and functionality of our Website.
Below you will find an overview of the cookies that we use on our Website:
- First-party cookies: We use local storage cookies for performance purposes. We also use session cookies for authentication purposes.
- Tracking cookies:
- Google analytics: To analyze and improve the web application experience
- Inspectlet: To analyze and improve the web application experience
For more information, we refer to our cookie statement.
However, if you use your browser settings to block all cookies you may not be able to access all or parts of our Website.
12. How to contact us
1017 PR, Amsterdam, the Netherlands
Registration number with the Chamber of Commerce (Kamer van Koophandel): 59032936.
You have also the right to lodge a complaint to the supervisory authority (Autoriteit Persoonsgegevens) about the way we process your personal data. We would, however, appreciate the chance to deal with your concerns before you approach the supervisory authority, so please contact us in the first instance.