1. Introduction

This Privacy Policy explains how PT Hano Solusi Digital (“Hotely”, “we”, “us”) collects, uses, stores, and protects personal data through the Hotely services.

Hotely is a cloud-based Property Management System (PMS) from Indonesia for hotels, resorts, apartments, and hostels. Our services include the Back Office, Front Office, Point of Sales (POS), Accounting, House Keeping, and Sales & Marketing modules, as well as integration with channel managers and Online Travel Agents (OTAs).

This policy applies to:

• Clients — property owners or operators who subscribe to Hotely.
• Users — client staff who hold a Hotely account (for example front desk agents, cashiers, accountants, and managers).
• Guests — guests of our clients’ properties whose data is recorded in Hotely.
• Visitors — visitors to www.hotely.id and to the websites and booking engines we develop.

By using the Hotely services, you confirm that you have read and understood this Privacy Policy.

2. Personal Data We Collect

We only collect the data needed to run Hotely’s features.

2.1 Client and User Account Data. When a client registers and adds users through the Setting Role & User feature, we collect name, email address, phone number, job title, role, username, and a password stored in encrypted form.

2.2 Property and Business Data. Through the Setting Property & Shop, Room Setup, and Inventory features, we store the client’s property name and address, room data, rates, inventory, and POS outlet data.

2.3 Guest Data. Through the Guest Data, Reservation, and Front Office modules, clients may record guest names, contact details, identity documents (ID card or passport) where required by the property, stay history, and guest preferences.

2.4 Transaction and Financial Data. Through the Front Office, Point of Sales, Accounting, and General Cashier modules, we process guest bills and folios, payment data, POS transactions, shift reports, and the client’s accounting data.

2.5 Reservation Data from Third Parties. Through integration with channel managers and Online Travel Agents (OTAs), we receive the details of bookings made by guests on those platforms.

2.6 Technical and Usage Data. When you use our system or websites, we may record your IP address, device and browser type, activity logs, and access times.

2.7 Communication Data. When you contact us via WhatsApp, phone, or email at support@hotely.id, we keep the content of your messages, support tickets, and training records.

2.8 Website Visitor and Marketing Data. Through www.hotely.id, client websites, booking engines, and our Google Ads and landing page services, we may collect form data, booking data, cookies, and advertising campaign data.

We do not knowingly collect personal data of children under 18 without the consent of a parent or guardian.

3. How and Why We Use Data

We use personal data to:

1. Provide and operate the PMS service, including reservations, room availability, check-in/check-out, guest billing, house keeping, and night audit.
2. Synchronize bookings in real time with channel managers and OTAs to prevent double or incorrect bookings.
3. Process POS transactions, cashiering, and accounting records (Chart of Accounts, receivables, payables, general ledger, assets, and budgets).
4. Produce reports, statistics, and analytics dashboards that give clients insight for business growth.
5. Manage user accounts, roles, and access rights.
6. Provide 24/7 technical support, installation, and training.
7. Keep the system secure, prevent fraud, and detect unauthorized access.
8. Develop and improve Hotely features using anonymized or aggregated usage data.
9. Deliver additional services chosen by the client, such as website development, booking engines, Google Ads, and landing pages.
10. Send service information, updates, and offers, with the option to unsubscribe at any time.
11. Comply with legal and tax obligations and lawful requests from authorities.

For guest data, the client (the property) acts as the Personal Data Controller, while Hotely acts as the Personal Data Processor, processing data on the client’s instructions. For client account, user, and website visitor data, Hotely acts as the Personal Data Controller.

4. Legal Basis for Processing

We process personal data in accordance with Indonesian Law No. 27 of 2022 on Personal Data Protection (the “PDP Law”) and its implementing regulations, on the following bases:

• Performance of a contract — to provide the services the client subscribes to.
• Consent — for marketing, non-essential cookies, and other processing that requires explicit consent.
• Legal obligation — for example financial and tax record-keeping.
• Legitimate interest — for example system security, fraud prevention, and service improvement.

Clients are responsible for ensuring they have a valid legal basis, including guest consent where required, before entering guest data into Hotely.

5. Sharing Data with Third Parties

We do not sell personal data. Data is shared only as needed with:

• Channel managers and OTAs enabled by the client, to synchronize room availability, rates, and reservations.
• Cloud infrastructure and hosting providers that store and run the Hotely system.
• Payment and POS device providers integrated at the client’s request.
• Advertising and analytics platforms (such as Google Ads) for marketing services chosen by the client.
• Communication providers (such as email and WhatsApp) for support and notifications.
• Professional advisers such as auditors and legal counsel, under confidentiality obligations.
• Government or law enforcement authorities where required by law.
• Business successors in the event of a merger, acquisition, or asset transfer, with notice to you.

Every third party must keep the data confidential and secure under its agreement with us. If data is transferred outside Indonesia, we ensure the recipient country or party provides an equal or higher level of protection, as required by the PDP Law.

6. Data Security and Retention

Data and transaction security is one of Hotely’s core commitments. Our measures include:

• Encryption of data in transit (HTTPS/TLS) and storage of passwords in encrypted form.
• Role-based access control, so each user sees only the modules relevant to their duties.
• Activity logging, close-shift procedures, and running audits to trace changes to data.
• Regular data backups on cloud infrastructure.
• System monitoring and internal access limited to authorized staff.

Personal data is kept for as long as the client’s account is active and as long as needed for the purposes in this policy or required by law (for example, financial records are kept in line with tax regulations). When a subscription ends, the client may request a data export, after which the data will be deleted or anonymized within a reasonable period.

In the event of a personal data protection failure, we will notify the client, affected data subjects, and the competent authority within 3 x 24 hours, as required by the PDP Law.

7. Your Rights as a Data Subject

Under the PDP Law, you have the right to:

• Obtain information about the processing of your personal data.
• Access and obtain a copy of your personal data.
• Correct or update inaccurate data.
• Request the deletion or destruction of your personal data.
• Withdraw consent you have given.
• Restrict or suspend processing of your data.
• Object to decisions based solely on automated processing.
• Obtain and transfer your data to another party in a commonly used format.

Requests can be sent to support@hotely.id and will be answered within 3 x 24 hours of receipt. We may ask you to verify your identity before processing a request.

Hotel guests should first submit requests to the property where they stayed, since that property is the Data Controller. Hotely will assist the client in fulfilling such requests.

8. Cookies

www.hotely.id and our booking engines may use cookies to keep you signed in, remember your preferences, and measure website and advertising campaign performance. You can refuse or delete cookies through your browser settings, although some features may not work properly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced through the Hotely system, by email, or on our website before they take effect. The date of the latest update appears at the top of this document.

10. Contact Us

Questions, complaints, or requests about personal data can be sent to:

PT Hano Solusi Digital (Hotely)

• Email: support@hotely.id
• Phone/WhatsApp: +62 856 4151 1519 / +62 5757 009 009
• Website: www.hotely.id