HotelGEX
LEGAL · PRIVACY

Privacy Policy

How HotelGEX processes personal data when you visit our website, request information, a demo or a trial, and when you engage in a business relationship with us.

Last updated: September 23, 2026
Privacy by design.

This policy primarily applies to the public website and business relationships with HotelGEX. The processing of guest data carried out by each hotel through the platform is also governed by the agreement and, where applicable, the data processing agreement with that hotel.

1. Data controller

The controller of the processing activities described is HotelGEX, owner and provider of the HotelGEX service (hotelgex.es) and the HotelGEX application. Privacy contact: Albert Barra, albert@hotelgex.es. You may also write to hello@hotelgex.es or use Contact.

2. Data we may process

Depending on your interaction, we may process your first name, last name, company, job title, email address, telephone number, information provided in forms or communications, data relating to demos, trials and contracting, commercial preferences, interaction history, and technical data necessary for security, operation and abuse prevention.

When a business contact comes from sources other than the individual concerned, they will be informed in accordance with applicable regulations, and the source and corresponding legal basis will be documented.

3. Purposes and legal bases

PurposeLegal basis
Inquiries, demos and information.Requested pre-contractual measures and/or legitimate interest in handling the inquiry.
Trial, contracting, support and customers.Performance of the contract/pre-contractual measures and legal obligations.
Our own commercial communications.Consent where required and, in legally permitted cases, legitimate interest or a prior contractual relationship, always with a simple and free means of objection.
Security, fraud prevention and logs.Legitimate interest and legal compliance where applicable.
Analytics that are not strictly necessary.Prior consent where required.

When processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out beforehand.

4. Artificial Intelligence

HotelGEX incorporates AI to assist with analysis, content, recommendations and automation. Data entered in forms or conversations may be processed by technology providers necessary for the requested functionality, with the applicable contractual and security safeguards.

Visitors will not be subject to decisions based solely on automated processing that produce legal effects or similarly significantly affect them without the required legal basis and safeguards. When a specific functionality involves profiling or relevant automated decisions, additional information will be provided.

5. Recipients and processors

Providers necessary to operate HotelGEX —hosting, infrastructure, email, support, security, consent-based analytics or AI— may process data as processors or sub-processors where applicable. HotelGEX does not sell personal data. Data may be disclosed due to a legal obligation, a request from an authority, or to establish, exercise or defend claims.

6. International transfers

If a provider processes information outside the European Economic Area, the applicable valid mechanism will be used, such as an adequacy decision or standard contractual clauses, together with any necessary additional safeguards.

7. Retention

Data will be retained for as long as necessary for the purpose and subsequently for the periods required to comply with legal obligations or address liabilities. Business contacts will be reviewed periodically; minimal information may be retained to honor an objection or opt-out.

8. Rights

You may request access, rectification, erasure, objection, restriction and portability where applicable, as well as withdraw your consent, by writing to hello@hotelgex.es. If you believe that the processing does not comply with applicable regulations, you may lodge a complaint with the Spanish Data Protection Agency.

9. Security

We apply technical and organizational measures appropriate to the risk, including access controls, tenant segregation, credential management, event logging and continuity measures.

10. Minors

The HotelGEX website and commercial services are aimed at professionals and businesses and are not designed for direct contracting by minors.

11. Google Data (Google Business Profile reviews)

HotelGEX allows a customer hotel to connect its own Google Business Profile listing to manage its reviews from the platform. This section explains what Google data the application HotelGEXobtains, what it uses it for and how it protects it. The connection is made only when a person with permissions for the listing expressly authorizes it on Google’s consent screen.

Data we access

  • Permission requested: https://www.googleapis.com/auth/business.manage (Business Profile API).
  • Google Business Profile accounts and locations belonging to the person providing authorization, solely so that they can select the hotel listing.
  • Reviews from the selected listing: identifier, rating, text, date, reviewer’s public name and published response, if any.
  • Publication of responses to reviews, only when a hotel user drafts or approves the response and clicks publish.

How we use it

  • Display reviews in the hotel’s reputation dashboard, together with reviews from other sources, and calculate indicators and trends for that same hotel.
  • Allow the hotel to respond from HotelGEX. If the user requests it, an artificial intelligence provider may suggest a draft response or summarize the reviews; the user always reviews the text before publishing it.
  • We do not use Google data for advertising, profiling or creating contact lists, we do not sell it, and we do not disclose it to third parties, except for processors necessary to provide the service (hosting and AI provider) under contract and security measures. Data received from Google’s APIs is not used to develop, improve or train general-purpose or non-personalized AI or machine-learning models.
  • Hotel review data is not shown to other hotels: each hotel is an isolated space within the platform.

Storage, security, and retention

The refreshable access token granted by Google is stored in encrypted form and associated with a single hotel. Communications are encrypted in transit (HTTPS), and access to reviews is limited to authorized users of that hotel and based on their roles. Reviews imported from Google are retained for as long as the hotel maintains an active connection and its contract with HotelGEX. Disconnecting Google immediately deletes the token. If the hotel requests deletion of the imported reviews, we will delete them within a maximum of 30 days; upon termination of the contract, within a maximum of 90 days. HotelGEX personnel access this data only if the hotel requests it for support, if necessary for security or abuse-related reasons, or if required by law.

How to disconnect or request deletion

The hotel can disconnect Google from HotelGEX (Post-stay → Reputation), which deletes the token, and revoke access at any time from myaccount.google.com/permissions. To request deletion of the imported reviews, write to albert@hotelgex.es.

HotelGEX’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

HotelGEX’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

12. Changes

We may update this policy due to regulatory, technological changes, or changes in processing activities. The page will indicate the date of the current version.