1. Who this policy covers
This policy explains how Innovate Solution, registered in Singapore (UEN 202617746C), handles personal data in two situations:
- The website bedskey.com and its translations, where we decide how and why personal data is used (we are the "controller").
- The bedsKey application, the hotel property management system our customers use. There the hotel or hotel group decides what guest and staff data to record and why (the hotel is the controller) and we process that data on its behalf (we are the "processor"). Section 9 explains this in more detail.
2. What we collect on the website
- Details you send us. When you request a demo or a proposal: your name, email address, phone number, property name and type, number of rooms, country, message and the language of the page you used.
- Technical data. Your IP address, browser user agent and the time of the request are stored with each form submission so that we can block abuse (each address may send five requests per hour). Our servers and our network provider also keep standard access logs (IP address, time, page requested, browser) for security and troubleshooting.
- Approximate country. Our network provider tells our server which country a request comes from, so that a first visit can be shown in a matching language. We use it only for that page request and do not store it.
- One cookie. If you choose a language in the menu, we set a cookie named
bk_langthat stores only that choice, for one year. It is needed to remember your choice. We use no advertising, tracking, social media or analytics cookies, so we do not show a cookie banner.
3. How and why we use it
- To reply to your enquiry, arrange a demonstration and prepare a proposal. This is a step you asked for before a possible contract and is in our legitimate interest in answering business enquiries.
- To keep the website secure, prevent spam and abuse, and fix faults. This is in our legitimate interest in running a safe website.
- To meet legal, tax and accounting obligations once you become a customer.
We do not sell personal data, we do not use it for automated decisions that have legal effects on you, and we do not send marketing emails unless you have asked for them. You can object to any use based on legitimate interest by emailing us.
4. Who we share it with
We share personal data only with service providers that help us run bedsKey, under contracts that require them to protect it and use it only for our instructions:
- Cloudflare: content delivery, security and the approximate country of each request.
- Amazon Web Services: sending the emails generated by our forms (Amazon SES).
- Our hosting and cloud infrastructure providers: running the website, the bedsKey application and its managed database and backups.
- Innovate Solution group staff in Bangladesh, Singapore and the United Arab Emirates who need the data to answer you or support your account.
We may also disclose data when the law requires it, to protect our rights or the safety of others, or to a buyer if the business is reorganised or sold, in which case this policy continues to apply.
5. International transfers
Our team and providers work in several countries, including Singapore, Bangladesh, the United Arab Emirates, the United States and the countries where Cloudflare operates. When personal data leaves the country where it was collected, we protect it with contractual commitments such as standard contractual clauses and with the security measures described below, so that it receives a standard of protection comparable to the one required where it was collected.
6. How long we keep it
- Enquiries and demo requests: up to 24 months after our last contact with you, unless you become a customer, in which case we keep them for the length of the contract.
- Customer account and billing records: for the contract and then as long as tax and accounting laws require, normally up to seven years.
- Server and security logs: for a short period needed for security, then deleted.
- The
bk_langcookie: one year, or until you delete it in your browser.
7. How we protect it
All traffic uses HTTPS. In the bedsKey application each hotel group's data is isolated at the database level with row-level security, staff access is controlled by granular permissions, every change is recorded in an append-only audit trail, passwords are hashed with Argon2id, identity documents are encrypted with AES-256-GCM, and the managed database has automated backups. Card payments are taken on the payment gateway's own page, so card numbers never reach bedsKey. No system is perfectly secure; if a breach affects your personal data we will notify you and the relevant authorities as the law requires.
8. Your rights
Depending on where you live (for example under Singapore's Personal Data Protection Act, the EU and UK GDPR, the UAE Personal Data Protection Law or Bangladesh law), you may have the right to:
- ask for a copy of your personal data and how we use it;
- have inaccurate data corrected;
- have your data deleted or its use restricted;
- object to processing based on legitimate interest;
- receive your data in a portable format;
- withdraw consent where we rely on it;
- complain to a data protection authority, such as Singapore's Personal Data Protection Commission or the authority in your country.
Email sales@bedskey.com with the subject "Privacy". We may ask you to confirm your identity and will answer within 30 days. If your data is held in a hotel's bedsKey account (for example as a guest), please contact that hotel first; we will help it answer you.
9. Data in the bedsKey application
When a hotel uses bedsKey, it records guest, booking, billing and staff data. For that data:
- the hotel is the controller and is responsible for having a lawful basis, informing its guests and answering their requests;
- we process the data only to provide, secure and support the service, and only on the hotel's documented instructions;
- our staff who can access it are bound by confidentiality and access is limited and logged;
- we use the service providers listed in section 4 as sub-processors and remain responsible for them;
- we help the hotel respond to data subject requests and security incidents;
- identity documents are deleted automatically after the retention period the hotel sets;
- when the contract ends, the hotel can export its data for 30 days, after which we delete it from the live system (backups expire on their normal cycle).
Customers that need a signed data processing agreement can request one at sales@bedskey.com.
10. Children
The website and the bedsKey service are for businesses and are not directed at children under 16. We do not knowingly collect their personal data through the website.
11. Changes to this policy
We will update this policy when our practices change and change the date below. If a change is significant, we will tell customers by email or in the application before it takes effect.
12. Contact
Innovate Solution (bedsKey), registered in Singapore, UEN 202617746C. Email: sales@bedskey.com. See also our terms of service and refund policy. If a translation of this policy differs from the English version, the English version prevails.