Privacy Notice

1. Controller

The controller within the meaning of Article 4(7) GDPR is:

2. Purpose and scope of this privacy notice

This privacy notice applies to the public website at https://www.sidrahoc.com. It explains which personal data is processed when you visit this website and when you contact us.

It does not apply to the processing of data through the use of the Sidrahoc software (Web Dashboard and Mobile App) by customers and their employees. That processing is governed separately under the relevant contractual agreement.

3. Provision of the website and server logs

This website is operated with the hosting provider Vercel Inc. When you access the website, Vercel processes technical information that your browser transmits automatically, in order to deliver the website, route requests, ensure security, detect errors and prevent abuse. This can include, among other things, the IP address, date and time of access, the page accessed, the amount of data transferred, and browser and device information.

The operator of this website does not itself read, store or evaluate this log data through its own applications. Processing is carried out by the hosting provider as part of the technical operation of the website.

The legal basis is Article 6(1)(f) GDPR (legitimate interest in the secure and functional operation of the website).

4. Contact by email and telephone

If you contact us by email or telephone, we process the data you provide, such as your name, contact details and the content of your enquiry, in order to answer your enquiry, prepare a possible business relationship, and communicate with you about Sidrahoc or a requested development discussion.

The legal basis is Article 6(1)(b) GDPR where your enquiry is directed at entering into a contract, and otherwise Article 6(1)(f) GDPR (legitimate interest in responding to enquiries and in business communication).

5. Demo and contact form

The form on the "Book a demo" page lets you submit an enquiry.

Required fields: Name, hotel or company, email address, message.

Optional fields: Position, phone number, number of rooms, number of properties.

The form additionally processes technical information: the website language you have set, the time of submission, and a technical identifier used to detect duplicate submissions. This identifier carries no personal data beyond the form fields listed above.

The form also contains a field that is not visible to visitors, used to defend against automated abuse attempts. For security reasons, we do not describe the exact technical workings of this measure in detail here.

Your information is used to process your enquiry and to get in touch with you. Submitting the form does not sign you up for a newsletter.

The legal basis is Article 6(1)(b) GDPR for the pre-contractual enquiry, and Article 6(1)(f) GDPR (legitimate interest in processing enquiries and in protecting the form against abusive use) for the technical and anti-abuse information.

Delivery of the notification about your enquiry is intended to use an email delivery service. See "Recipients and service providers used" below for details.

6. Technically necessary storage in your browser

This website does not use marketing or analytics cookies, and no analytics or tracking tool.

The website language you select is stored in your browser's local storage (localStorage), so the website is shown in the same language on a later visit. This information does not leave your browser.

If a technical error occurs while a page is loading, the website temporarily stores a technical marker in your browser's session storage (sessionStorage), to allow a single automatic reload attempt and avoid a reload loop. This marker ends automatically with the session.

Both functions are technically necessary for the website feature you are using and carry no personal data. The legal basis is Article 6(1)(f) GDPR.

7. External links

This website contains links to external third-party websites. Responsibility for the content of those websites lies solely with their respective providers.

8. Recipients and service providers used

Personal data is only shared where necessary for the purpose described, for contract performance, a legal obligation, or a legitimate interest. Your data is not sold.

• Hosting: Vercel Inc. carries out the technical operation of this website.
• Email delivery: Delivery of the notification email for your enquiry is intended to use the service Resend (Resend, Inc.).
• Advisers: Data is shared with legal or tax advisers only where legally required or necessary to protect legitimate interests.
• Authorities: Data is shared with authorities only where a legal obligation requires it.

9. Transfers outside the European Economic Area

The hosting provider of this website, Vercel Inc., may process data outside the European Economic Area as part of the technical operation of the website. In that case, the provider is contractually obliged to maintain an adequate level of data protection. The exact contractual transfer mechanism will be documented, and supplemented as needed, as part of the ongoing legal review of this privacy notice.

10. Retention

• Enquiry content is retained until your enquiry has been fully processed and no further communication is required.
• Business correspondence is retained for as long as a contractual or pre-contractual relationship requires it.
• Server and security logs are retained only for as long as necessary for the secure operation of the website.
• Statutory retention obligations, and the need to establish, exercise or defend legal claims, remain unaffected and may result in longer retention.

11. Legal bases

Depending on the purpose, processing of your data relies on Article 6(1)(b) GDPR (pre-contractual or contractual measures) and Article 6(1)(f) GDPR (legitimate interest in secure operation, in responding to enquiries, and in business communication). The applicable legal basis is stated in the relevant section above.

12. Rights of data subjects

You have the following rights regarding your personal data:

• Access (Article 15 GDPR)
• Rectification (Article 16 GDPR)
• Erasure (Article 17 GDPR)
• Restriction of processing (Article 18 GDPR)
• Data portability (Article 20 GDPR)
• Objection to processing (Article 21 GDPR)

These rights apply within the statutory requirements and exceptions. To exercise them, please contact info@sidrahoc.com.

13. Objection and withdrawal

Where processing is based on consent, you may withdraw it at any time with effect for the future. Where processing is based on a legitimate interest, you may object at any time for reasons arising from your particular situation.

14. Right to complain to a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

You may also contact another supervisory authority responsible for your place of residence or your country.

15. Data security

Sidrahoc uses appropriate technical and organisational measures to protect personal data, taking into account the nature and scope of the processing, against accidental or unlawful loss, alteration, unauthorised disclosure and unauthorised access.

The website uses encrypted transmission via HTTPS where supported by the visitor's browser.

16. Automated decisions

This public website does not make any solely automated decisions that produce legal effects concerning you or similarly significantly affect you.

17. Changes to this privacy notice

We update this privacy notice when the legal situation, technical circumstances or our services change. The version published at the time of your visit applies.

18. Status and version

Last updated: August 2026. Version 1.0.