Overview
This page describes the planned procedure if the security of personal data on the freestays platform is breached. The platform has not yet launched. The procedure is a plan. It has not been tested in operation, and so far there has been no incident to handle. The time limits stated are currently assumed values and will be reviewed legally.
The operator, SnapNext GmbH & Co. KG, is responsible. The legal bases are Art. 33 and Art. 34 of the General Data Protection Regulation.
Planned procedure
| Step | Content |
|---|---|
| Detection | Reports from hotels, creators and service providers to support@freestays.app. The platform currently has no automatic alert for data protection breaches. |
| Initial assessment | A responsible person at the operator, or their deputy, assesses the type, scope and risk. This is planned within 24 hours of becoming aware. |
| Notification to the authority | Notification to the competent supervisory authority within 72 hours of becoming aware (Art. 33 GDPR), unless the breach is unlikely to result in a risk to the data subjects. |
| Notification of data subjects | Where a high risk is likely, the data subjects are informed without undue delay in clear language: nature of the breach, possible consequences, measures taken and a contact point (Art. 34 GDPR). |
| Notification of hotels | If the breach affects data that the operator processes on behalf of a hotel, the hotel is informed without undue delay, planned at the latest within 48 hours of becoming aware, by email to the contact point named by the hotel. |
| Documentation | Every breach is recorded in a breach register with the facts, consequences, measures and the decision on notification, even if no notification is made. |
Roles
- Responsible person at the operator: assesses, decides on notifications and keeps the register. The name and deputy will be added before launch.
- Hotels: report anomalies and, where their data is affected, receive the operator's notice. A hotel is independently responsible, from receipt of an application, for the data received with it. Whether and when it must report itself, it checks for itself. The classification will be reviewed legally.
- Service providers: are expected to report breaches they notice to the operator without undue delay. The time limits for this will be set in the contracts with active service providers.
- Supervisory authority: The competent authority depends on the operator's seat and will be added before launch.
How to report an incident
If you suspect an incident, write to support@freestays.app. State what you observed, when, and which data might be affected. Please do not send passwords or access credentials. The address is read by the team. There is no round-the-clock service.
What is still pending
- A technical alert for incidents and error monitoring are planned and not yet in use.
- The procedure has not been tested in an exercise. This is planned before launch.
- The appointment of the responsible person and their deputy is pending.
- The time limits and the distribution of duties between the operator and hotels will be reviewed legally.