Sep 24, 2026 · @Makis Syn
Last updated: [date of publication]
This policy explains how the Infinity Hotels mobile app for Android and iOS ("the app") handles your personal data.
The app is provided by Infinity Hotels for guests of our hotels, Infinity Blue Boutique Hotel & Spa (Hersonissos, Crete) and Infinity City. The data controller is TRYFON A.E., Dedalou 9 Str., 700 14 Hersonissos, Crete, Greece.
The app is built and operated for us by Hotel Toolbox [legal name]. Hotel Toolbox processes data only on our behalf and under our instructions.
The app is a digital guide for your stay. With it you can:
browse information about our hotels, their facilities and services;
sign in with the personal code the hotel gives you, to see your stay;
send requests, orders and reservations (for example restaurant or spa) to the hotel;
fill in online check-in forms and questionnaires;
receive notifications from the hotel;
open your room door with your phone, using the digital room key.
The app does not take payments, does not show advertising, and we do not sell your data.
Information you give us
Your stay. When you sign in with your code, the app shows details the hotel already holds about your booking, such as your name, room and dates.
Requests, orders and reservations you make in the app, with any notes you add.
Forms and questionnaires, such as online check-in or feedback. Depending on the hotel's form, these may include your name, contact details, date of birth, nationality and passport or ID details. Surveys are optional.
Photos you choose to attach, taken with the camera or picked from your gallery. They are sent only when you attach them.
Information collected automatically
Device and app information: device model, operating system and version, language, and app version.
Usage statistics, through Google Firebase Analytics: which screens and features are used, an app-instance identifier, and your approximate country or region, derived from your IP address. We use this, strictly internally, to improve the app. It is not used to identify you or for advertising.
Crash and error reports, through Sentry: technical details of the problem, with your device and app version. They do not include your name or contact details.
Notifications: if you allow notifications, a push token from Google Firebase Cloud Messaging and a random installation identifier created by the app. Older versions of the app used OneSignal for the same purpose.
App updates: when the app checks for new content, it sends its version and platform, with a random identifier, to our update service (Capgo).
Install link (Android only): if you installed the app from a QR code or link, Google Play tells the app which page to open first.
Permissions – asked only when you use a feature that needs them. You can refuse, or change them later in your device settings.
Location: shows where you are on the hotel and area maps. Your location is used on your device and is not stored by us.
Camera: scans QR codes (for example to sign in) and takes photos you choose to attach.
Photos and storage: lets you pick an image to attach.
Notifications: messages from the hotel and reminders you set up.
Bluetooth: lets your phone talk to your room's door lock when you use the digital room key. The key works only for your room and the dates of your stay.
Purpose | Legal basis (GDPR) |
|---|---|
Providing what you ask for in the app: your stay information, requests, orders, reservations, check-in and your digital room key | Performance of our contract with you (Art. 6(1)(b)) |
Notifications about your stay | Your consent, given in your device settings; you can withdraw it at any time |
Keeping the app working and improving it (usage statistics, crash reports), strictly for internal use | Our legitimate interest in a reliable, useful app (Art. 6(1)(f)) |
Meeting our legal obligations, for example guest registration | Legal obligation (Art. 6(1)(c)) |
We do not collect sensitive data about your race, health, religion or similar through the app.
We keep personal data only as long as needed for these purposes or as the law requires (for example tax and accounting rules):
Stay, request and reservation data: for your stay and up to [12] months after, unless the law requires longer.
Digital room key: only for the dates of your stay.
Usage statistics: up to 14 months.
Crash reports: up to 90 days.
Push tokens: until you sign out, uninstall the app, or the token expires.
Under the GDPR you have the right to access, correct, erase or receive a copy of your data, to restrict or object to its processing, and to withdraw your consent at any time where we rely on it.
To exercise these rights, or to ask us to delete the data the app holds about you, e-mail [email protected] with the subject "Infinity Hotels app – data request" and your booking reference. You can also complain to the Hellenic Data Protection Authority (www.dpa.gr).
You can stop notifications, location or Bluetooth access at any time in your device settings. Uninstalling the app stops all collection from your device.
We share personal data only with the recipients below. Our providers work under agreements that require them to keep it confidential and secure.
Recipient | What for |
|---|---|
Hotel Toolbox | App platform and hosting |
Google (Firebase Analytics, Firebase Cloud Messaging) | Usage statistics and notifications |
Sentry | Crash and error reports |
Capgo | App content updates |
Cloudflare | Secure network delivery; protects sign-in against automated abuse |
OpenFreeMap | Map images, requested directly by your device (shares its IP address) |
TESA (ASSA ABLOY) | Issuing your room's digital key |
Authorities | When the law requires it |
Some providers (for example Google, Sentry and Cloudflare) may process data outside the European Economic Area. Such transfers are protected by the European Commission's Standard Contractual Clauses or an adequacy decision.
Data sent by the app travels encrypted (HTTPS) and is stored on the secure servers of our providers. We take appropriate technical and organisational measures, but no transmission over the internet can be guaranteed completely secure.
The app is intended for hotel guests aged 16 and over. We do not knowingly collect personal data from children through the app.
For any question or request about your personal data:
E-mail: [email protected]
Post: TRYFON A.E., Dedalou 9 Str., 700 14 Hersonissos, Crete, Greece
Phone: +30 28970 29000
We may update this policy when we add features to the app or when the law changes. Any change is published on this page, and the date at the top is updated.