GDPR Data Processing & Compliance Policy

01Purpose

MetaHotels Technologies LLC (“MetaHotels”, “we”, “us” or “our”) provides technology and digital services to hotels, including booking-engine solutions, website services, hosting, integrations, digital marketing, conversion tools and related hospitality technology services.

In providing these services, MetaHotels may process personal data relating to hotel guests, prospective guests, hotel employees, representatives and other individuals.

This policy explains how MetaHotels handles such personal data and the measures we follow to support compliance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) when the GDPR applies.

Our approach is based on the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality and accountability.

02Our Role

For guest reservation and booking information processed through services supplied to a hotel:

Where MetaHotels processes information for its own business purposes—for example, information relating to its hotel clients, contracts, invoicing, enquiries or business contacts—MetaHotels may act as an independent Data Controller for that processing.

The actual roles of the parties will always depend on the particular processing activity and contractual arrangement.

03Personal Data We May Process

Depending on the services selected by the Hotel, MetaHotels may process information such as:

• Guest name
• Email address
• Telephone number
• Country or nationality information where requested by the Hotel
• Arrival and departure dates
• Number of guests
• Room type and booking details
• Special requests entered by the guest
• Reservation reference numbers
• Booking amendments and cancellation information
• Pricing, promotional and transaction information
• Payment-related information required by the configured booking or payment process
• IP address and technical information connected with use of the booking service
• Language and currency preferences
• Marketing preferences and consent information where applicable
• Communications relating to a reservation
• Hotel employee or authorised-user names, contact details and account information

MetaHotels will only process personal data reasonably necessary to provide the contracted services or comply with applicable legal requirements.

04Why Personal Data Is Processed

Personal data processed on behalf of a Hotel may be used to:

• Complete and manage direct hotel reservations
• Send booking confirmations and reservation-related communications
• Process modifications and cancellations
• Communicate reservation information to the Hotel and its authorised systems
• Connect the booking engine with authorised hotel systems and technology providers
• Support payment and transaction processing
• Provide customer and technical support
• Maintain booking records
• Detect and prevent misuse, fraud and security incidents
• Produce authorised operational and booking reports
• Provide analytics where instructed by the Hotel
• Support marketing activities where the required consent or other lawful basis exists
• Maintain, secure and improve the contracted technology services

MetaHotels will not use guest personal data for unrelated independent purposes unless there is a separate lawful basis and the individual has been appropriately informed.

05Documented Instructions From the Hotel

When acting as a Data Processor, MetaHotels will process personal data only:

1. as necessary to provide the contracted services;
2. according to documented instructions from the Hotel; or
3. where processing is required by applicable law.

If MetaHotels is legally required to process personal data beyond the Hotel’s instructions, the Hotel will be informed where permitted by law.

06Lawful Collection of Guest Data

The Hotel, as Data Controller, is responsible for establishing an appropriate lawful basis for collecting and processing guest personal data through its website and booking services.

MetaHotels will provide reasonable assistance to the Hotel in implementing the technology required to support its privacy obligations.

Where consent is required—for example for certain marketing communications, advertising technologies or non-essential cookies—the Hotel is responsible for determining the appropriate consent requirements, while MetaHotels will implement agreed technical controls within the services it manages.

07Data Minimisation

MetaHotels follows the principle of data minimisation.

Only personal data required for the agreed service, reservation process, technical operation or applicable legal requirement should be collected and processed.

Hotels should avoid requesting unnecessary sensitive or excessive personal information through booking forms or free-text fields.

08Access to Personal Data

Access to personal data processed through MetaHotels services is limited to authorised personnel and authorised service providers who require access for legitimate operational, technical or support purposes.

Access permissions should follow the principle of least privilege.

Personnel with access to personal data are required to maintain confidentiality and handle the information only for authorised purposes.

09Security of Personal Data

MetaHotels applies appropriate technical and organisational measures according to the nature and risk of the processing.

These measures may include, where applicable:

• Secure HTTPS/TLS connections
• Encryption and appropriate protection of stored information
• User authentication and access controls
• Restricted administrative access
• Role-based permissions
• Password-security controls
• System and activity logging
• Server and application security controls
• Backup and recovery procedures
• Security updates and vulnerability management
• Malware and unauthorised-access protection
• Secure integration with authorised third-party services
• Staff confidentiality requirements
• Procedures for responding to security incidents

Security controls are reviewed and updated as services, technologies and identified risks change.

10Payment Information

Where a booking process involves online payment, payment information may be transmitted to authorised payment gateways, acquiring banks or booking-technology providers required to complete the transaction.

MetaHotels will limit access to payment information to what is necessary for providing and supporting the contracted service.

Payment information must be handled in accordance with applicable payment-security requirements and the security requirements of the relevant payment service provider.

The specific payment-data flow may differ depending on the booking engine and payment gateway selected by the Hotel.

11Sub-processors and Technology Providers

MetaHotels may use third-party technology providers where necessary to deliver its services. These may include providers of:

• Booking-engine technology
• Cloud hosting and infrastructure
• Email delivery
• Payment processing
• Website hosting
• Analytics
• Security services
• Customer support technology
• Channel, PMS, CRS or other hotel-system integrations

Where a provider processes personal data on behalf of MetaHotels, MetaHotels will require appropriate contractual data-protection obligations from that provider.

Where required under Article 28 GDPR, MetaHotels will obtain the Hotel’s specific or general written authorisation for the use of sub-processors and provide appropriate information regarding material changes to relevant sub-processors.

Sub-processors must be subject to data-protection obligations providing an appropriate level of protection for the personal data they process.

12International Data Transfers

MetaHotels is headquartered in the United Arab Emirates and may work with Hotels, technology providers and infrastructure providers in different countries.

Where personal data protected by the GDPR is transferred outside the European Economic Area, MetaHotels will ensure that an appropriate transfer mechanism is used where required.

Depending on the circumstances, this may include:

• An adequacy decision issued by the European Commission;
• European Commission Standard Contractual Clauses;
• another legally recognised transfer safeguard; or
• another permitted transfer mechanism under applicable data-protection legislation.

Where Standard Contractual Clauses are required, MetaHotels and the relevant party will implement the applicable clauses and associated safeguards.

MetaHotels will also assess relevant international data transfers and implement additional technical, contractual or organisational safeguards where required.

13Data Retention

MetaHotels does not retain personal data indefinitely.

Guest and reservation data will be retained according to:

• the Hotel’s documented instructions;
• the configuration and requirements of the contracted services;
• contractual obligations;
• applicable legal or regulatory requirements; and
• legitimate requirements relating to security, dispute resolution and establishment or defence of legal claims.

Where MetaHotels acts as a Data Processor, the applicable Data Processing Agreement or service agreement should define the retention and deletion requirements.

At the end of the service relationship, MetaHotels will, at the Hotel’s choice and subject to applicable legal requirements, return or delete personal data for which MetaHotels acts solely as processor.

Residual copies contained within secure backup systems may remain until they are deleted through the normal backup-retention cycle, provided they remain protected and are not used for any other purpose.

14Data Subject Rights

Individuals protected by the GDPR may have rights including:

• The right to be informed
• The right of access
• The right to rectification
• The right to erasure
• The right to restriction of processing
• The right to data portability
• The right to object
• Rights relating to certain automated decision-making

Because the Hotel is normally the Data Controller for guest reservation information, requests from guests relating to their personal data should normally be handled by the relevant Hotel.

If MetaHotels receives a request directly from a Hotel’s guest concerning personal data processed on behalf of that Hotel, MetaHotels will forward or refer the request to the relevant Hotel and provide reasonable assistance where required.

MetaHotels will not independently alter, delete or disclose Hotel-controlled guest information unless authorised by the Hotel or required by law.

15Assistance to Hotels

Where MetaHotels acts as a Data Processor, MetaHotels will provide reasonable assistance to the Hotel in meeting applicable GDPR obligations relating to the services supplied by MetaHotels, including:

• Data-subject requests
• Security of processing
• Personal-data breaches
• Data Protection Impact Assessments where applicable
• Information required to demonstrate compliance
• Deletion or return of personal data
• Appropriate audits or compliance reviews as provided under the applicable Data Processing Agreement

16Personal Data Breaches

MetaHotels maintains procedures for identifying, investigating and responding to personal-data breaches affecting services under its control.

Where MetaHotels becomes aware of a personal-data breach involving personal data processed on behalf of a Hotel, MetaHotels will notify the affected Hotel without undue delay.

Where available, the notification will include information reasonably required to help the Hotel assess the incident, including:

• The nature of the incident
• The categories of information involved
• The categories of affected individuals
• The potential consequences
• Measures taken or proposed to contain and address the incident

MetaHotels will cooperate with the Hotel so that the Hotel can meet applicable regulatory and data-subject notification obligations.

17Privacy by Design and by Default

MetaHotels aims to consider privacy and data protection during the design, development, integration and operation of its services.

Where practical, systems will be configured to collect and expose only the personal data necessary for their intended purpose.

New systems, integrations and material changes involving personal data should be reviewed for data-protection and security risks before deployment.

18Marketing and Analytics

Guest personal data received through a Hotel’s booking process will not automatically be treated as permission to send marketing communications.

Where MetaHotels provides email marketing, remarketing, analytics or advertising services on behalf of a Hotel, such processing will be carried out according to the Hotel’s instructions and applicable consent and privacy requirements.

Where cookies or similar technologies require consent, appropriate consent-management mechanisms should be implemented on the relevant website.

19Confidentiality

MetaHotels personnel and contractors authorised to access personal data are required to treat such information as confidential.

Personal data must not be disclosed, copied, exported or used outside authorised business purposes.

Confidentiality obligations continue after an individual’s access to MetaHotels systems or employment/contractual relationship has ended.

20Data Processing Agreement

Where required, MetaHotels will enter into a Data Processing Agreement (“DPA”) with the Hotel covering the processing of personal data.

The DPA should define, among other matters:

• The parties’ roles
• Subject matter of processing
• Duration of processing
• Nature and purpose of processing
• Categories of personal data
• Categories of data subjects
• Hotel instructions
• Confidentiality obligations
• Security requirements
• Sub-processors
• International transfers
• Data-subject requests
• Personal-data breaches
• Data return and deletion
• Audit and compliance requirements

Where necessary, applicable Standard Contractual Clauses or other international-transfer provisions should form part of or accompany the DPA.

21Records and Accountability

MetaHotels will maintain appropriate records relating to personal-data processing activities for which such records are required.

Relevant policies, agreements, security measures, sub-processor arrangements and incident records should be maintained to demonstrate compliance with applicable data-protection requirements.

22Hotel Responsibilities

Hotels using MetaHotels services remain responsible for their own GDPR obligations as Data Controllers, including:

• Providing an appropriate privacy notice to guests
• Determining the lawful basis for processing
• Obtaining consent where required
• Responding to data-subject requests
• Defining appropriate retention periods
• Controlling access by Hotel employees
• Keeping guest information accurate
• Informing MetaHotels of relevant processing instructions
• Ensuring their own systems and integrations are appropriately secured
• Meeting applicable regulatory reporting requirements

MetaHotels’ role as a Data Processor does not replace the Hotel’s responsibilities as Data Controller.

23Compliance Reviews

MetaHotels will periodically review this policy and its relevant technical and organisational measures.

The policy may be updated to reflect:

• Changes to MetaHotels services
• Changes to technology or infrastructure
• New sub-processors
• Changes in applicable data-protection legislation
• Regulatory guidance
• Identified security risks
• Changes in international data-transfer requirements

24Contact

Questions concerning this policy, MetaHotels’ handling of personal data or a Hotel’s Data Processing Agreement may be directed to:

Last Updated: November 2026