← Back to home

 

Privacy Policy — Lodgy.co

Effective Date: 2026-10-05
Data Controller:
BOP, obrt za izradu web stranica, vl. Kornelia Šokota
KREŠIMIROVA 20, RIJEKA
OIB: 78058083953
This policy describes how Lodgy.co (“Lodgy”, “we”, “us”) collects, uses, and protects personal data in accordance with the General Data Protection Regulation (GDPR, EU 2016/679) and the Croatian Act on the Implementation of the General Data Protection Regulation (NN 42/2018).
 
 
1. Who We Are
 
Lodgy.co is a Property Management System (PMS) intended for apartment, hotel, and campsite owners to manage bookings, rates, OTA channels, and guest communication.
Data Protection Contact: [email protected]
 
 
2. What Data We Collect
 
2.1 Operator Data (Property Owners)
 
During registration and use of the service: first name, last name, email, phone number, company OIB (Tax ID), details about accommodation units, banking details for billing, Channex / Resend / Twilio API keys (encrypted).
Legal Basis: Contractual relationship (Art. 6(1)(b) GDPR).
2.2 Guest Data (via Operators)
 
Lodgy processes personal data of guests that the operator (property owner) collects through their OTA (Booking.com, Airbnb, Expedia), direct bookings, or eVisitor registration:
    • First and last name, date of birth, nationality
    • Document number and type (ID card, passport)
    • Address, email, phone number
    • Arrival/departure dates, number of guests
    • Communication through OTA inbox / email
    • IP address and user-agent when accessing the booking engine

Legal Basis: The operator is the data CONTROLLER; Lodgy is the data PROCESSOR (Art. 28 GDPR). The Data Processing Agreement (DPA) is available upon request.
 
2.3 Technical Data
    • IP address, access timestamp (log files, 30 days)
    • Session cookie (JWT) — exclusively for authentication
    • Error tracking (anonymized stack traces)

We do not use third-party analytical cookies (Google Analytics, Facebook Pixel) or marketing cookies.
 
 
3. Purposes of Processing
    1. Providing the PMS Service — bookings, prices, synchronization with OTA channels
    2. Legal Obligation — eVisitor registrations to the Ministry of the Interior (MUP)
    3. Guest Communication — automated messages (check-in instructions, thank-you notes, reviews)
    4. Invoicing — issuing invoices to guests on behalf of the operator
    5. System Security — abuse detection, brute-force protection

 
4. Data Retention
 
CategoryRetention PeriodBasis
Booking data10 years after invoice issuanceAccounting Act NN 78/15
Booking data (without invoice)2 years after departureLegitimate interest
OTA inbox messages2 yearsLegitimate interest
Log files30 daysSystem security
Operator accountsFor the duration of the contract + 1 yearContractual relationship

 
5. Sharing with Third Parties
 
Data is shared only with necessary data processors:
    • Channex (channex.io, Latvia) — OTA channel manager (bookings, rates, inbox)
    • Resend (resend.com, USA) — transactional email delivery (Standard Contractual Clauses)
    • Twilio (twilio.com, USA) — SMS notifications (SCC)
    • MongoDB Atlas / self-hosted (EU region) — database
    • Google Gemini (Google LLC, USA) — translation of OTA messages (SCC, no content storage)
    • eVisitor (MUP RH) — legal obligation for guest registration
    • Backblaze B2 (Amsterdam, EU) — encrypted off-site backup

We never sell or share data with third parties for marketing purposes.
 
 
6. User Rights (Guests and Operators)
 
According to GDPR Articles 15–22, you have the right to:
    • Access your data
    • Rectification of inaccurate data
    • Erasure (“the right to be forgotten”) — unless a legal obligation to retain it exists
    • Restriction of processing
    • Data portability (JSON export)
    • Object to processing based on legitimate interest
    • Lodge a complaint with the Croatian Personal Data Protection Agency (AZOP, azop.hr)

Please send requests to: [email protected] — we respond within 30 days.
 
 
7. Security Measures
 
    • SSL/TLS 1.3 for all traffic (Cloudflare)
    • Encryption of API keys in the database (AES-256-GCM)
    • Passwords hashed with bcrypt
    • Two-factor authentication (optional) for operators
    • Nightly encrypted off-site backup (Restic → Backblaze B2)
    • Mongo access only via Docker internal network, not publicly
    • Fail2ban + Cloudflare WAF for protection against brute-force attacks
    • Regular security patch updates

 
8. Cookies
 
We only use strictly necessary cookies:
    • access_token (JWT) — authentication, HttpOnly, SameSite=Lax
    • remember_me — optional, 30 days duration

We do not display a cookie-consent banner because we do not use third-party tracking / analytics / marketing cookies.
 
 
9. Changes to the Policy
 
Lodgy may update this policy. Significant changes will be communicated via email to operators at least 30 days in advance.
Last modified: 2026-10-05