We take privacy and security very seriously.
Short and factual. If you need something here that is missing, ask and we will publish it rather than email it to you privately.
EU-hosted infrastructure. Guest personal data is never transferred outside the EU for processing. Read more in the Data Processing Agreement.
You can find the standard Data Processing Agreement (DPA) here; it includes a list of sub-processors. The list is numbered and dated. Request a DPA for signature here. If you wish to be notified when we make changes to the DPA, please join this mailing list. We notify everyone on the list of DPA changes at least two weeks in advance. Join the list here.
Guests can request their data or its deletion through the host; the request is handled in-product rather than by email archaeology.
The guest-facing booking sites and portal are built to WCAG 2.1 AA, in line with the European Accessibility Act. The statement is published and kept current.