Security
Privacy Statement
Last updated: May 13,2025
Oaky B.V. (Oaky, we us or our) is committed to protecting your privacy and takes its responsibilities regarding the security of personal data very seriously. This policy explains how we use personal data and how we protect your privacy in accordance with the General Data Protection Regulation (Algemene Verordening Gegevensbescherming, GDPR).
1. What is Oaky?
Oaky is a tool used by our Customers Accommodation Providers (hotels, hostels, and serviced apartments) to communicate with their guests and to offer specific services and upgrades that relate to the upcoming hotel stay of their guests.
2. Data Controller and Data Processor
In the context of providing our services, the Customer Accommodation Providers is the data controller, and Oaky is the data processor. We process personal data that we collect or receive from the Customer Accommodation Provider. If we have received your personal data from the Customer Accommodation Provider, the Customer Accommodation Provider, as the data controller, has ensured that it has a legal basis to transfer your personal data to us, such as a legitimate interest or that your consent is obtained.
In addition, we may collect, use, store and transfer different kinds of personal data in the course of our business as a Data Controller, including through your use of our website https://oaky.com (the Website). Information about the processing activities we conduct as a controller is set out below.
3. The data we collect about you
Personal data means any information about an individual from which that person can be identified, such as your first and last name, telephone number, postal and electronic addresses, date of birth and payment information. It does not include data where the identity has been removed (anonymous data).
We may obtain personal data directly from you when you submit your personal data to us, for instance when you represent a Customer Accomodation Provider and communicate with us in that capacity, or when you contact us through our contact details or contact form on our Website. The personal data we process in this context is:
contact details such as name and email address; and
other information or feedback you provide to us.
We may also collect personal data automatically when you visit or use the Website, such as data collected through cookies. This includes:
data about your device and browser type (including IP address and MAC address); and
data about your use of our Website, such as the web pages you have viewed, the hyperlinks you clicked on and websites you visited before you came to our website;
data about your selected language version of a website;
data about the chat-box session. This allows the website support to see previous issues and reconnect with the previous supporter;
data about the visitor's device and behaviour across devices and marketing channels. This is for tracking the use of embedded services by social channels like YouTube videos or Google ads; and
data about a visitor's identity. This information is passed to the marketing platform HubSpot on form submission and used when de-duplicating contacts.
We do not collect any special categories of personal data about you.
4. How we use your personal data
We use the personal data that we collect about you only for specific purposes. This includes performing the contract we have entered into with Customer Accommodation Providers, offering our services to you on behalf of the Customer Accommodation Providers, to ensure that your access to and use of our Website is safe and uninterrupted and to assist you with any questions you may have.
Purpose | Personal data | Legal ground | Retention period |
Providing the services of Oaky to customers (guests of the Customer Accommodation Providers on behalf of the Customer Accommodation Providers.) |
* Depending on Customer Accommodation Provider. | We are a data processor. As a result, the Customer Accommodation Providers have a legal ground for processing the personal data. | For the duration of our services to the Customer Accommodation Providers or as otherwise indicated by the Customer Accommodation Providers. |
To manage our relationship with you and communicate with you regarding:
|
| Necessary for our legitimate interests (to provide support and respond to your questions and comments) | For 5 years of non-activity following the most recent activity using personal data |
To measure interest in and improve our Website and customise your user experience. | Data about your use of our Website, such as webpages viewed and hyperlinks you clicked on. | Necessary for our legitimate interest (to keep our Website updated and relevant) | For 5 years of non-activity following the most recent activity using personal data |
To administer our site and diagnose problems, to protect our business, to resolve disputes or troubleshoot problems, to prevent potentially prohibited or illegal activities. |
| Necessary for our legitimate interests (for running our business, IT services, network security, to prevent fraud and other prohibited or illegal activities). | For 5 years of non-activity following the most recent activity using personal data |
To send newsletters about product updates, news from the industry, and other relevant information. |
| Your consent to receive newsletters. | For the duration of the subscription of the newsletter. This ends whenever you unsubscribe from the newsletter. |
To manage our contractual relationship with customers, partners, and contractors |
| Contractual obligation - where an agreement is in place | For 7 years after the end of the contract |
To provide access to and manage the Oaky solution. To ensure platform security and prevent unauthorized access. To offer customer support and resolve issues. To analyze product usage and improve features. |
| Contractual Obligation – Necessary to provide the service as per the agreement with the hotel. Legitimate Interest – Ensuring security, service optimization, and customer support. Legal Obligation – Complying with data security regulations (e.g., GDPR, industry standards). | Product-generated logs by Oaky's services Audit logs: 2 years after the last logged General logs: 30 days of the last logged Logs within Oaky's IT systems: Retained for as long as necessary to be able to find back "what happened when by whom" |
5. Which third parties receive your personal data?
We will never sell personal data to third parties. We will not disclose your personal data to any third party unless we have a legitimate interest in doing so or if you have consented to this. We may only share personal data about you as follows:
Third-party service providers, including Google, Hotjar, Hubspot, Social Media channels, and GoDaddy (website hosting provider), who provide or facilitate services on our behalf;
With third-party vendors, sub-processors, consultants, and other service providers who are approved by our Customer Accommodation Provider (information about these third parties is specific per Customer Accommodation Provider, and can be answered by your Customer Accommodation Provider);
with competent supervisors, authorities, judicial bodies or other parties, when we would be legally obliged to do so, or if this is necessary in the context of legal proceedings or to establish or exercise our legal rights (for example, in the context of the handling or institution of complaints or proceedings);
Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy policy; and
Partners who we create shared campaigns with. Example: When downloading a content piece created with a partner, your email address will be shared with that partner. We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
6. International transfers
Several of our service providers are based outside the European Economic Area (EEA) so their processing of your personal data will involve a transfer of data outside the EEA.
Whenever we transfer your personal data outside the EEA, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:
We transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission (under a so-called ‘Adequacy Decision’).
We use specific contracts approved by the European Commission, which give personal data the same protection it has in Europe (the so-called Standard Contractual Clauses).
We ensure the recipient is certified under the EU-US Data Privacy Framework;
We currently transfer personal data to the following parties outside of the EEA:
The Rocket Science Group LLC d/b/a Mailchimp, Atlanta, USA for the purpose of sending secure Emails to hotel guests
Google LLC, Mountain View, USA, for the purpose of importing email data only used by Customer Accommodation providers that send Client Personal Data via Email to Oaky and for the purpose of internal communication
Intercom, Delaware, USA, for the purpose of communicating with customer accommodation providers
Slack, San Francisco, USA, for the purpose of internal communication
Atlassian, San Francisco, USA, for the purpose of logging tickets and internal communication
Hubspot, Cambridge, Massachusetts, USA, for the purpose of sending communications, either marketing or informational to prospects and customers
Gong, Palo Alto, USA, for the purpose of record keeping of conversations
7. Accuracy of personal data
It is important for us to maintain accurate and up-to-date records of your personal data. Please inform us of any changes to or errors in your personal data as soon as possible by contacting us via privacy@oaky.com. We will take reasonable steps to make sure that any inaccurate or outdated personal data is deleted or adjusted accordingly.
8. Your rights in relation to your personal data
You have certain rights in relation to your personal data, in accordance with applicable law.
You have the following rights with regard to your personal data:
The right to request access to your personal data. This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
The right to request or correct your data if it is inaccurate. You may also supplement any incomplete data we have, taking into account the purposes of the processing.
- The right to request deletion of your personal data if:
Your personal data is no longer necessary for the purposes for which we collected or processed it; or
You withdraw your consent if the processing of your personal data is based on consent and no other legal ground exists; or
You object to the processing of your personal data and we do not have an overriding legitimate ground for processing; or
Your personal data is unlawfully processed; or
Your personal data has to be deleted for compliance with a legal obligation.
- The right to restrict the processing of personal data, if:
The accuracy of your personal data is contested by you, for the period in which we have to verify the accuracy of the personal data; or
The processing is unlawful and you oppose the deletion of your personal data and request restriction; or
We no longer need your personal data for the purposes of processing, but your personal data is required by you for legal claims; or
You have objected to the processing, for the period in which we have to verify overriding legitimate grounds.
The right to data portability. You may request us to receive the personal data that concerns you. You may also request us to send this personal data to a third party, where feasible. You only have this right if it regards personal data you have provided to us, the processing is based on consent or necessary for the performance of a contract between you and us, and the processing is done by automated means.
You can exercise your rights by filing a request by e-mail to your Customer Accommodation Provider or to Oaky via privacy@oaky.com. We may need to request specific information from you to help us confirm your identity and ensure your right to exercise any of your rights. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We aim to respond to your request within one month after receiving such a request. However, this one-month term may be extended with two months. In such event, we will inform you within one month after receipt of your request and explain why the extension is necessary.
9. Cookies
We use cookies and similar tracking technologies when providing the services and may collect data about visitors of the Website with the purpose of updating and improving the site to provide Website's visitors with the best experience and most relevant material. A cookie is a small file that we store on your browser or the hard drive of your computer when you visit our Website.
A cookie may contain information which provide for recognition of you as a visitor of the Website, every time you visit the Website. This helps us to provide you with a good experience and better services. It also allows us to improve our Website.
Except for functional and analytical cookies that have a limited impact on your privacy, we need your consent to place cookies. You have the right to choose whether or not to accept cookies. However, they are an important part of how our Website works, so you should be aware that if you choose to refuse or remove cookies, this could affect the availability and functionality of our Website.
Below you will find an overview of the cookies that we use on our Website:
First-party cookies: We use local storage cookies for performance purposes. We also use session cookies for authentication purposes.
- Tracking cookies:
Google Analytics: To analyze and improve the web application experience
Inspectlet: To analyze and improve the web application experience
For more information, we refer to our cookie statement.
However, if you use your browser settings to block all cookies, you may not be able to access all or parts of our Website.
10. How to contact us
If you have any questions about our privacy policy or the processing of your personal data, you can contact us via email at: privacy@oaky.com or at the following address:
Oaky B.V.
Nieuwezijds Voorburgwal 162, 1012 SJ, Amsterdam, the Netherlands
Registration number with the Chamber of Commerce (Kamer van Koophandel): 59032936.
You also have the right to lodge a complaint to the supervisory authority (Autoriteit Persoonsgegevens) about the way we process your personal data. We would, however, appreciate the chance to deal with your concerns before you approach the supervisory authority, so please contact us in the first instance.
11. Changes to this privacy policy
We may amend this privacy policy from time to time. We will note the date on which the last revisions were made at the bottom of this privacy policy. We will notify you of any material changes to this privacy policy. We invite you to check our privacy policy from time to time to review the most current version.
