Privacy policy

Who is responsible

When you book a room or stay at a property that uses Innlark, that property decides what it records about you and why. In data protection terms the property is the controller and Innlark is the processor: we store and handle the data on the property’s behalf and only on its instructions. Questions about your stay, or requests about your data, are best sent to the property first; its contact details are on its booking page and in your booking confirmation.

For the people who log in to Innlark (hotel owners and staff) and for visitors to our own website, Innlark itself is the controller.

What is collected about guests

Details of a booking: your name, phone number, email address, the dates, the room, the number of guests, your expected arrival time and any requests you write.

At check-in, where the property or the law requires it: the type and number of an identity document, the country that issued it, your nationality and your address.

Bills, payments, refunds and invoices for the stay. Card payments made online are handled by the property’s payment provider; Innlark does not store full card numbers.

Messages the property sends you about your booking, such as confirmations and reminders, and whether they were delivered.

Why it is used

To take and manage your booking, keep the room for you, check you in and out, prepare your bill and send you messages about your stay.

To meet the legal duties the property has, such as keeping accounts and, in many countries, registering guests with the authorities.

Innlark does not sell personal data, does not use it for advertising and does not build profiles of guests across properties. Each property sees only its own guests.

Who receives it

Staff of the property, each with their own login and a role that limits what they can see and change.

Service providers that help run Innlark: the hosting company that runs our servers, the email service that delivers messages and, if the property uses one, its online payment provider. They act on our instructions and are bound to protect the data.

Authorities, when the property is required by law to report its guests.

Booking sites linked by calendar receive only the dates a room is taken, never your name or contact details.

How long it is kept

The property chooses how long guest details are kept after the last stay. It can set Innlark to erase them automatically after one to ten years, or erase them when you ask. Erasing removes your name, contact details, identity document, address and notes; the booking dates and the amounts paid stay in the accounts because tax law requires that.

Staff activity records and backups are kept for a limited time and then overwritten.

Your rights

You can ask the property for a copy of the personal data it holds about you, to correct it, or to erase it. The property can download or print a copy of your data from Innlark and can erase it in a few steps.

The property cannot erase your details while you are staying or while you have a booking still to come; it will do so after the stay.

If you are not satisfied with the answer, you can contact us at hello@innlark.com or the data protection authority in your country.

Cookies

Innlark uses only functional cookies: one keeps staff signed in, one remembers the language you chose and one remembers which property a staff member is working on. There are no advertising, tracking or analytics cookies, and nothing is shared with advertising networks. Because these cookies are needed for the pages to work, we do not ask for consent to them.

Security

Connections use HTTPS. Passwords are stored as one-way hashes and secret keys are encrypted. Every change made by staff is logged with who made it and when, and the database is backed up every night.

Changes

If we change this policy we will update the date at the top. Significant changes will also be shown to properties when their staff log in.