Privacy Policy

This policy explains how your personal data is collected and used when you use the WhatsApp guest service offered by the hotel where you are staying or have a reservation ("the hotel"). The service is powered by Alfon AI.

Your personal data is processed in accordance with the data protection laws that apply to the hotel, which may include the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, India's Digital Personal Data Protection Act 2023 and the rules made under it, the EU General Data Protection Regulation, the UK General Data Protection Regulation and Data Protection Act 2018, and Turkey's Law No. 6698 on the Protection of Personal Data.

In short: the hotel uses your WhatsApp number, reservation details and the messages you send to respond to your requests during your stay. Your data is not sold. You can stop using the service at any time by replying STOP or by contacting the hotel directly. All hotel services remain available through reception, the room telephone and the concierge.

The Controller of your data (the Data Fiduciary under Indian law) is the hotel identified on your booking confirmation, room key or check-in materials. The hotel decides how and why your data is used.

The service is provided to the hotel by Alfon AI FZ-LLC ("Alfon"), a company registered in the Ras Al Khaimah Economic Zone (RAKEZ), United Arab Emirates, Licence No. 47036511, with its registered address at Compass Building, Al Shohada Road, Al Hamra Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates. Alfon acts as a Processor (Data Processor) on the hotel's behalf. It processes your data only on the hotel's documented instructions and under a written data processing agreement.

If you have questions about how your data is used, please ask hotel reception, who will direct you to the hotel's data protection contact. You may also contact Alfon at info@alfonai.com. As Processor, Alfon will refer requests about your personal data to the hotel and will assist the hotel in responding.

When you use the service, the hotel and Alfon may process:

• Your WhatsApp phone number and WhatsApp profile name.
• Reservation details held by the hotel in its property management system, such as your name, room number, arrival and departure dates, and preferences or requests already recorded by the hotel.
• The content of messages you send and receive through the service, including any photos, documents or voice notes you choose to share.
• The service requests you make, the tasks created for hotel staff and their status.
• A summary of your requests and stated preferences during your stay, used by hotel staff to provide continuity of service and anticipate your needs.
• Operational metadata such as timestamps, message delivery and read status, language and request type.
• Your messaging preferences, including whether you have opted in to marketing messages or opted out of the service.

The service does not require your passport, identity document or payment card details, and you should not send them through WhatsApp. If you choose to share information such as a dietary requirement, allergy or accessibility need, it will be used only to fulfil your request.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect processing carried out before it.

To deliver the service, Alfon uses the following sub-processors, each acting under a written contract and on Alfon's instructions:

Under their commercial terms, the AI service providers listed above do not use data submitted through their business services to train their models. Your data is not sold and is not shared with anyone other than as set out above, unless required by law or with your explicit consent.

Some sub-processors process data outside the country in which it was collected, including in the United States. Where your data is transferred internationally, the hotel and Alfon rely on safeguards recognised by applicable law, which may include:

• Standard Contractual Clauses approved by the European Commission and the UK International Data Transfer Addendum;
• the EU-US Data Privacy Framework, where the recipient is certified;
• adequacy decisions issued by the UK or the EU;
• the cross-border transfer conditions of the UAE Personal Data Protection Law;
• transfers from India in compliance with the Digital Personal Data Protection Act 2023, other than to any country restricted by the Government of India;
• standard contracts under Turkish Law No. 6698, or your explicit consent where permitted.

You can request a copy of the safeguards in place by contacting the hotel.

Specific retention periods are set by the hotel based on its operational and legal requirements. At the end of the retention period, your personal data is securely deleted or irreversibly anonymised.

Depending on applicable law, you have the right to:

• access the data held about you;
• correct inaccurate or incomplete data;
• have your data erased;
• restrict or object to certain processing;
• receive a copy of your data in a portable, machine-readable format;
• withdraw your consent at any time, including your consent to marketing;
• object to direct marketing at any time;
• nominate another person to exercise your rights in the event of your death or incapacity;
• have your grievance addressed by the hotel; and
• lodge a complaint with a data protection supervisory authority.

To exercise these rights, you can:

• reply STOP to any WhatsApp message to stop further messages from the service;
• ask hotel reception, who will direct you to the hotel's data protection contact; or
• contact Alfon at info@alfonai.com, who will refer your request to the hotel as Controller.

The hotel will respond within the period required by applicable law.

Requests to delete your data: the hotel is the owner of your data and Alfon acts only as its Processor. If you would like your data to be deleted, please contact the hotel first. If you contact Alfon instead, Alfon will forward your request to the hotel and carry out the deletion on the hotel's instructions.

Supervisory authorities include the UAE Data Office, the Data Protection Board of India, the UK Information Commissioner's Office, the data protection authority of your EU member state, and Turkey's Personal Data Protection Authority. In India, you should first raise your grievance with the hotel before approaching the Data Protection Board.