Your rights
Under the General Data Protection Regulation, data subjects can exercise the following rights.
| Right | Article | Meaning |
|---|---|---|
| Access | 15 | You learn which data about you is stored and receive a copy. |
| Rectification | 16 | Incorrect data is corrected. |
| Erasure | 17 | Data is deleted, unless a retention obligation or another reason prevents it. |
| Restriction | 18 | Processing is restricted under certain conditions. |
| Notification to recipients | 19 | Rectification, erasure or restriction is communicated to recipients, where possible. |
| Data portability | 20 | You receive your data in a machine-readable format. |
| Objection | 21 | You can object to processing that is based on legitimate interests. |
You can also lodge a complaint with a supervisory authority. You can withdraw a consent you have given at any time, with effect for the future.
Who is responsible
The operator, SnapNext GmbH & Co. KG, is responsible for accounts, profiles and applications. It answers requests about them. A hotel is independently responsible, from receipt of an application, for the data it receives with it. Direct requests about that data to the hotel. This allocation of roles is the currently assumed position and will be reviewed legally. If you are unsure, write to support@freestays.app; the request will then be assigned.
How to make a request
Creators with an account
After signing in, you will find the page "Your data" in the "Settings" area under the item "Data". There you can:
- request a copy of your data (access and portability),
- request deletion of your account. To confirm, you enter the word LÖSCHEN.
Under "Your requests" you see each request with its status. A second request of the same type is possible only once the first is completed.
All other requests
Rectification, restriction, objection and requests from hotel staff go by email to support@freestays.app. There is no separate route for these requests in the account. The team handles them by hand.
Verification of identity
Requests in the account are bound to your signed-in session. We answer emails only at the address stored for your account. If in doubt, we ask for proof via the account. We do not ask for more information than is needed for verification.
Time limit
We answer a request within one month of receipt. The system presets a period of 30 days for this. If the request is so extensive or difficult that this period is not enough, it can be extended by up to two months under Art. 12(3) GDPR. We tell you so within the first month and give the reason. The calculation of the period in special cases will be reviewed legally.
What the copy of the data contains
The copy is a ZIP archive with JSON files and a readme file. According to the current state of the program code, it contains:
- account, profile and channels,
- applications and the history of applications and agreements (each status change with time, role of the acting person and reason),
- the email notifications sent to you, with content and time of sending,
- your roles and access to organizations and properties,
- agreements, including the agreed usage rights,
- submitted evidence,
- consents given and withdrawn,
- your data requests with status and deadlines,
- log entries on actions you carried out yourself,
- details of uploaded files and the files themselves.
The archive is held in non-public storage. It is retrieved through a link that is valid for a short time, 60 seconds; you create a new link on the same page. The archive is removed after seven days. The platform sends no email when the archive is ready. You see the status on the page "Your data".
What is not included
- Information about other persons, for example identifiers of hotel staff who decided on an application.
- Technical fields of the email queue.
- Free-text entries by staff, such as a reason or a review note, are by contrast in the archive; whether this is permissible is being reviewed legally.
- The personal reply address of a person at the property in a sent notification; it stays empty in the archive.
- Counters of the sign-in protection. They are stored as hashes of the e-mail address without a link to an account. In principle they could be linked to an account. This point is subject to legal review.
Whether the archive fully satisfies the right of access is being reviewed legally.
Deletion: limitations
An ongoing agreement or an open application stops deletion. The retention periods for agreements and logs have not yet been set in the platform. Until then, deletion requests remain on hold; an automatic notice with a reason is not evidenced for this case. For questions about the status, write to support@freestays.app. It is planned to keep records that must be retained under commercial and tax law for longer. The duration will be set and reviewed legally.
Complaint
You can lodge a complaint with any supervisory authority. The authority responsible for the operator will be added before launch.