This policy explains how the Xenos Hotels mobile app for Android and iOS ("the app") handles your personal data. It complements the Xenos Group Privacy and Cookies Policy (GDPR-P-02), which covers our hotels and websites.
Last updated: [date of publication]
The app is provided by Xenos Group Hotels for guests of our hotels in Zakynthos, Greece. The data controller is the Xenos Group company that operates the hotel you stay at.
Data controller | Hotels |
|---|---|
Xenos Luxury Hotels S.A. | Olea All Suite Hotel, Aqua, Zante Maris Suites, Aqua Bay, Zante Maris |
Christos Xenos S.A. | SuneoClub Tsilivi Admiral, Planos Bay, Admiral, Commodore, Captains |
Ioniki A.T.A.X.E. | TUI Sensimar Caravel Resort & Spa |
Ioannis Xenos A.X.T.E. | Aqua Bay Suites |
Filip A.X.T.E.E. | Planos Apartments |
The app is built and operated for us by Hotel Toolbox [legal name]. Hotel Toolbox processes data only on our behalf and under our instructions.
The app is a digital guide for your stay. With it you can:
browse information about our hotels, their facilities and services;
sign in with the personal code your hotel gives you, to see your stay;
send requests, orders and reservations (for example restaurant, spa or activities) to the hotel;
fill in online check-in forms and questionnaires;
receive notifications from the hotel.
The app does not take payments, does not show advertising, and we do not sell your data.
Your stay. When you sign in with your code, the app shows details the hotel already holds about your booking, such as your name, room and dates.
Requests, orders and reservations you make in the app, with any notes you add.
Forms and questionnaires, such as online check-in or feedback surveys. Depending on the hotel's form, these may include your name, contact details, date of birth, nationality and passport or ID details. Surveys are optional.
Photos you choose to attach, taken with the camera or picked from your gallery. They are sent only when you attach them.
Device and app information: device model, operating system and version, language, and app version.
Usage statistics, through Google Firebase Analytics: which screens and features are used, an app-instance identifier, and your approximate country or region, derived from your IP address. We use this, strictly internally, to improve the app. It is not used to identify you or for advertising.
Crash and error reports, through Sentry: technical details of the problem, with your device and app version. They do not include your name or contact details.
Notifications: if you allow notifications, a push token from Google Firebase Cloud Messaging and a random installation identifier created by the app. Older versions of the app used OneSignal for the same purpose.
App updates: when the app checks for new content, it sends its version and platform, with a random identifier, to our update service (Capgo).
Install link (Android only): if you installed the app from a QR code or link, Google Play tells the app which page to open first.
The app asks for a permission only when you use a feature that needs it. You can refuse it, or change it later in your device settings.
Location: shows where you are on the hotel and area maps, and finds nearby activities when you use that feature. [Confirm: your location is used on your device and not stored by us.]
Camera: scans QR codes (for example to sign in) and takes photos you choose to attach.
Photos and storage: lets you pick an image to attach.
Notifications: messages from the hotel and reminders you set up (for example for an activity).
Purpose | Legal basis (GDPR) |
|---|---|
Providing what you ask for in the app: your stay information, requests, orders, reservations, check-in | Performance of our contract with you (Art. 6(1)(b)) |
Notifications about your stay | Your consent, given in your device settings; you can withdraw it at any time |
Keeping the app working and improving it (usage statistics, crash reports), strictly for internal use | [Legitimate interest (Art. 6(1)(f)) / consent (Art. 6(1)(a)), as confirmed by the DPO] |
Meeting our legal obligations, for example guest registration | Legal obligation (Art. 6(1)(c)) |
We do not collect sensitive data about your race, health, religion or similar through the app.
We keep personal data only as long as necessary, following data minimisation, storage limitation and applicable law (for example accounting legislation). We do not keep your personal data after your stay, unless the law requires us to keep some of it for a specific period, or you have given your consent.
Usage statistics: [e.g. up to 14 months].
Crash reports: [e.g. up to 90 days].
Push tokens: until you sign out, uninstall the app, or the token expires.
Under the GDPR you have the right to:
access your data and know how it is processed;
correct inaccurate data;
erase your data, where there is no longer a legitimate basis to process it;
receive your data in a portable format;
restrict or object to processing, where the law provides;
withdraw your consent at any time, where we rely on it.
To exercise any of these rights, or to ask us to delete the data the app holds about you, contact us (section 9) with the subject "Xenos Hotels app – data request" and your booking reference. You can also complain to the Hellenic Data Protection Authority (www.dpa.gr).
You can stop notifications or location access at any time in your device settings. Uninstalling the app stops all collection from your device.
We share personal data only with the providers below, with partners whose services you book, and where the law requires it. Our providers work under agreements that require them to keep data confidential and secure.
Recipient | What for |
|---|---|
Hotel Toolbox | App platform and hosting |
Google (Firebase Analytics, Firebase Cloud Messaging) | Usage statistics and notifications |
Sentry | Crash and error reports |
Capgo | App content updates |
Cloudflare | Secure network delivery; protects sign-in against automated abuse |
OpenFreeMap | Map images, requested directly by your device (shares its IP address) |
[Activity partner, e.g. Unlimited Adrenaline] | Only if you book an activity in the app: the details that booking needs |
Authorities | When the law requires it, or to protect the rights, property or safety of Xenos Group Hotels, our guests or others |
Some providers (for example Google, Sentry and Cloudflare) may process data outside the European Economic Area. Such transfers are protected by the European Commission's Standard Contractual Clauses or an adequacy decision. [confirm]
Data sent by the app travels encrypted (HTTPS) and is stored on the secure servers of our providers. We take appropriate technical and organisational measures, but no transmission over the internet can be guaranteed completely secure.
The app is intended for hotel guests aged 16 and over. We do not knowingly collect personal data from children through the app. [adjust if needed]
To exercise your rights, or for any question or complaint about how your personal data is processed, contact:
Xenos Group central e-mail: [email protected]
Xenos Group Data Protection Officer (all hotels): [email protected]
We may update this policy when we add features to the app or when the law changes. Any change is published on this page, and the date at the top is updated.