Privacy Policy

Article 1. Introduction

1.1 This Privacy Policy explains how PANTECH SINGLE MEMBER P.C., trading as "stayi" ("stayi", "we", "us" or "our"), collects, uses, discloses and otherwise processes personal data in connection with our websites, the stayi platform and our related products and services (together, the "Services").

1.2 We process personal data in accordance with Regulation (EU) 2016/679 (the "GDPR"), Greek Law 4624/2019, Greek Law 3471/2006 and all other applicable data protection and privacy legislation (together, "Data Protection Law"). The terms "personal data", "processing", "controller", "processor" and "data subject" have the meanings given to them in the GDPR.

1.3 This Privacy Policy should be read together with any other notice we provide on specific occasions, including the Usage and Privacy Terms displayed within the stayi platform.

Article 2. Who we are

2.1 The Services are provided by PANTECH SINGLE MEMBER P.C., a single-member private company incorporated under the laws of Greece, registered with the General Commercial Registry (G.E.MI.) under number 158136603000, with VAT number EL801505303 and its registered office at Erysichthonos 17, 118 51 Athens, Greece.

2.2 Any enquiry regarding this Privacy Policy or the processing of your personal data may be addressed to info@stayi.app or in writing to our registered office.

Article 3. Our role

3.1 We act as controller in respect of personal data that we process for our own purposes, including the administration of customer relationships and accounts, the onboarding of customers and the setup of the Services for them, contracting and invoicing, the security and integrity of the Services, business development and communications with prospective customers, the operation of our websites, and the analysis, development and improvement of the Services.

3.2 Where a hotel or other accommodation provider (a "Hotel") makes the stayi platform available to its guests, the Hotel acts as controller of the personal data processed in order to provide the service to those guests, and stayi processes such data on the Hotel's behalf and on its documented instructions, pursuant to a data processing agreement. Such processing is governed by the Hotel's own privacy notice.

3.3 Guests may address enquiries concerning the provision of the service to the relevant Hotel or to us. Where we receive a request in our capacity as processor, we will refer it to the Hotel and provide such assistance as Data Protection Law requires.

Article 4. Personal data we process

4.1 Depending on your relationship with us, we may process the categories of personal data described in this Article.

4.2 Customer and account data, namely identification and contact details of the representatives and authorised users of our customers, such as name, business email address, telephone number and role, together with login credentials, account settings, and contractual, billing and payment information.

4.3 Technical and usage data, namely information generated through the use of the Services, such as log records, device and connection information, IP address, authentication and session data, and records of activity within the Services.

4.4 Guest interaction data, namely the content of messages entered into, and voice interactions with, the AI concierge, including transcripts, requests forwarded to Hotel staff, responses to Hotel questionnaires, and related usage information. Guests are not required to provide their name or other identifying details in order to use the Services, and such data is associated with a room rather than with a named individual.

4.5 Business contact data, namely contact details of representatives of hotels and other businesses with which we seek to establish or maintain a commercial relationship, obtained directly from them or from publicly available sources such as business directories, public registries and the businesses' own websites, together with records of our communications with them.

4.6 Communications data, namely the content of correspondence, support requests and other communications exchanged with us, including, where applicable, recordings of telephone calls in accordance with Article 7.

4.7 Device data, namely identifiers, configuration and status information of the devices on which the Services are provided.

4.8 Onboarding data, namely information about a Hotel provided by its representatives and authorised users when the Services are set up for the Hotel, including through conversations with our AI onboarding assistant by text or voice, such as the transcripts of those conversations, the answers given and the names, roles and contact details of Hotel staff included in them, together with information about the Hotel that we obtain from its own website and other publicly available sources in order to suggest answers, which may include the names of staff published there.

4.9 We do not intend to collect special categories of personal data within the meaning of Article 9 GDPR. Users are asked not to disclose such information when using the Services.

Article 5. Purposes and legal bases

5.1 We process personal data to provide, operate and maintain the Services and to perform our contracts with our customers, including to set up the Services for a Hotel from the onboarding data described in Article 4.8, on the basis of the performance of a contract (Article 6(1)(b) GDPR) and, with respect to the representatives and staff of our customers, our legitimate interests (Article 6(1)(f) GDPR).

5.2 We process personal data to administer accounts, authenticate users and provide customer support, on the basis of the performance of a contract and our legitimate interests.

5.3 We process personal data to secure the Services, to prevent, detect and investigate fraud, misuse and security incidents, and to troubleshoot, on the basis of our legitimate interests.

5.4 We process personal data to analyse, develop and improve the Services, including through the retrospective analysis of guest interaction data, on the basis of our legitimate interests in understanding how the Services are used and in improving their quality, subject to appropriate safeguards, including the association of such data with rooms rather than named individuals, restricted access and data minimisation.

5.5 We process personal data to develop our business and to communicate with prospective customers, including by email and telephone, on the basis of our legitimate interests and in accordance with Greek Law 3471/2006.

5.6 We process personal data to comply with our legal obligations, including accounting and tax obligations and requests from competent authorities, on the basis of compliance with a legal obligation (Article 6(1)(c) GDPR).

5.7 We process personal data to establish, exercise or defend legal claims, on the basis of our legitimate interests.

5.8 Where we rely on legitimate interests, we have balanced those interests against your interests, rights and freedoms. Where we rely on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before its withdrawal.

Article 6. Artificial intelligence

6.1 The Services incorporate artificial intelligence technologies, including speech recognition, language models and speech synthesis, which are used, among other things, to interpret and respond to user requests, to translate communications, to generate summaries and reports for our customers, and to analyse and improve the Services.

6.2 Individuals interacting with an artificial intelligence system through the Services are informed that they are doing so. Content generated by artificial intelligence may be inaccurate or incomplete and should not be relied upon without appropriate verification.

6.3 We do not engage in decision-making based solely on automated processing which produces legal effects concerning individuals or similarly significantly affects them within the meaning of Article 22 GDPR.

6.4 When the Services are set up for a Hotel, its representatives may provide information about the Hotel by writing or talking to an AI onboarding assistant. At the start of each conversation we inform them that they are interacting with an AI assistant and that the conversation is transcribed and saved so that we can set up the Services and our staff can check them. The assistant may suggest answers based on the Hotel's public website or on information we already hold for the Hotel, which the representative is asked to confirm or correct, and representatives are asked to enter passwords and similar details in a form rather than in the conversation. We do not keep audio recordings of onboarding conversations; the audio is processed only to transcribe it and to respond. Where a Hotel signs up for the Services online, the information is used in the Services provided to the Hotel's guests automatically once the Hotel's payment card has been verified; our staff are notified of each such set-up and may check it afterwards, and the Hotel's representatives may change the information at any time. To protect Hotels against someone signing up in their name, we compare the domain of the representative's verified sign-in email address with the Hotel's website; a mismatch, or a free email address, does not stop the set-up but asks our staff to check it. In all other cases, our staff review the information before it is used in the Services provided to the Hotel's guests.

Article 7. Telephone communications

7.1 Telephone calls made by or on behalf of stayi for business development purposes may be conducted by an artificial intelligence voice assistant and may be recorded and transcribed for the purposes of quality assurance, record-keeping and the improvement of our communications.

7.2 The persons concerned are informed at the beginning of the call and may object to the recording or to further contact at any time.

Article 8. Recipients of personal data

8.1 We disclose personal data only to the extent necessary for the purposes described in this Privacy Policy.

8.2 Personal data may be disclosed to service providers engaged by us as processors which are necessary for the operation of the Services, including providers of cloud hosting and infrastructure, network and content delivery, authentication, artificial intelligence and speech technologies, electronic communications such as email, messaging and telephony, device management and payment processing services.

8.3 Guest interaction data relating to a Hotel's establishment is made available to that Hotel. Onboarding data relating to a Hotel, including the transcripts of its onboarding conversations, is made available to that Hotel's administrators.

8.4 Personal data may be disclosed to our professional advisers, auditors and insurers, subject to duties of confidentiality; to courts, public authorities and other third parties, where disclosure is required by law or necessary for the establishment, exercise or defence of legal claims; and to a prospective or actual acquirer or successor in the context of a merger, acquisition, reorganisation or transfer of all or part of our business, subject to appropriate confidentiality undertakings.

8.5 Our service providers are bound by written agreements requiring them to process personal data only on our instructions and to implement appropriate security measures. We do not sell personal data.

Article 9. International transfers

9.1 The Services are primarily hosted within the European Economic Area. Certain of our service providers may process personal data in countries outside the European Economic Area, including the United States.

9.2 Any such transfer is carried out in accordance with Chapter V GDPR, on the basis of an adequacy decision of the European Commission, including, where applicable, the EU-US Data Privacy Framework, standard contractual clauses adopted by the European Commission, or another appropriate safeguard or derogation provided for by Data Protection Law. Further information on the safeguards applied may be obtained by contacting us.

Article 10. Retention

10.1 We retain personal data only for as long as is necessary for the purposes for which it was collected, including for the purposes of satisfying any legal, accounting or reporting requirements, and for the establishment, exercise or defence of legal claims.

10.2 In determining the applicable retention period, we take into account the nature of the data, the purposes of the processing, the duration of our relationship with the relevant customer, applicable statutory retention obligations and relevant limitation periods.

10.3 Guest interaction data is retained for the duration of the agreement with the relevant Hotel and is deleted or anonymised within a reasonable period following its termination, unless earlier deletion is requested or further retention is required by law.

10.4 Customer and account data is retained for the duration of the contractual relationship and thereafter for the period required by applicable tax and accounting legislation or for the establishment, exercise or defence of legal claims.

10.5 Business contact data is retained for as long as reasonably necessary for business development purposes, save that the data necessary to give effect to an objection or opt-out is retained for as long as is required to respect it.

10.6 Call recordings, technical logs and backups are retained for limited periods and are deleted or overwritten in the ordinary course. Temporary data, such as messages from hotel staff shown on guest devices, is deleted automatically after a short period. Sessions that sign a guest's own device in to a hotel's service end no later than the guest's check-out and are deleted shortly afterwards; a record of each such sign-in is kept for 30 days for security purposes.

10.7 Transcripts of onboarding conversations are retained until the onboarding of the relevant Hotel is completed and for a limited period afterwards, in order to resolve questions about the information provided, and are then deleted. Where onboarding is not completed, they are deleted after a period of inactivity or together with the Hotel's account, whichever is earlier. Other onboarding data forms part of the configuration of the Services for the Hotel and is retained for the duration of the agreement with the Hotel and deleted within a reasonable period following its termination.

10.8 Data that has been anonymised, such that it no longer relates to an identified or identifiable natural person, may be retained and used without restriction.

Article 11. Security

11.1 We implement appropriate technical and organisational measures, in accordance with Article 32 GDPR, designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Such measures include encryption, access controls, the segregation of customer data, and hosting in secure data centres.

11.2 No method of transmission or storage is entirely secure. In the event of a personal data breach, we will take appropriate measures and will make such notifications as are required by Data Protection Law.

Article 12. Your rights

12.1 Subject to the conditions and limitations laid down in Data Protection Law, you have the right to obtain confirmation as to whether we process personal data concerning you and to access such data; to obtain the rectification of inaccurate or incomplete personal data; to obtain the erasure of your personal data; to obtain the restriction of processing; to receive personal data you have provided to us in a structured, commonly used and machine-readable format and to transmit it to another controller; to object, on grounds relating to your particular situation, to processing based on our legitimate interests, and to object at any time to processing for direct marketing purposes; and to withdraw your consent at any time, where processing is based on consent.

12.2 Requests may be submitted to info@stayi.app. We may request information necessary to verify your identity and, in the case of guest interaction data, to locate the relevant data, such as the room and dates of stay. We will respond within the time limits prescribed by Data Protection Law.

12.3 Where we process your personal data as a processor on behalf of a Hotel, we will refer your request to the Hotel and assist it in responding.

12.4 You have the right to lodge a complaint with the Hellenic Data Protection Authority, Kifissias 1-3, 115 23 Athens, Greece (www.dpa.gr), or with the supervisory authority of the EU Member State of your habitual residence, place of work or place of the alleged infringement.

Article 13. Cookies and similar technologies

13.1 Our applications use cookies and similar technologies that are strictly necessary for the provision of the Services, including for authentication, session management and security. Such technologies are exempt from the requirement of consent under Article 4(5) of Greek Law 3471/2006.

13.2 Where we use cookies or similar technologies that are not strictly necessary, including on our websites or in our electronic communications, we will do so in accordance with Greek Law 3471/2006 and, where required, only with your prior consent.

Article 14. Children

14.1 The Services are directed to businesses and are not directed to children. The Services do not require any user, including any child, to provide identifying information. If you believe that a child has provided us with personal data, please contact us.

Article 15. Changes to this Privacy Policy

15.1 We may amend this Privacy Policy from time to time. The amended version will take effect upon its publication, as indicated by the "Last updated" date. Where changes are material, we will take reasonable steps to inform our customers in advance.

Article 16. Contact

16.1 PANTECH SINGLE MEMBER P.C., Erysichthonos 17, 118 51 Athens, Greece. G.E.MI. 158136603000. VAT EL801505303. Email: info@stayi.app.