1. Controller
The controller within the meaning of the GDPR is H&H Group GmbH, which develops and operates Elovia as a product. Throughout this policy, "Elovia", "we" and "us" refer to H&H Group GmbH acting in this capacity.
2. Data We Collect and Why
2.1 When you visit our website
When you access our website, your browser automatically transmits data to our server. This data is stored temporarily in log files and includes:
- IP address of the requesting device
- Date and time of the request
- Name and URL of the file accessed
- Referring website (referrer URL)
- Browser type, operating system and internet service provider
We process this data to ensure stable and secure website operation. The legal basis is Art. 6(1)(f) GDPR (legitimate interest). Log files are deleted automatically after 30 days.
2.2 Contact enquiries
When you contact us by email, we store the data you provide (name, email address, message content) to handle your enquiry and for follow-up correspondence. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR. We delete this data once the enquiry has been fully resolved, unless statutory retention periods apply.
2.3 Contractual relationship (hotel clients)
When you enter into a contract with us for the Elovia service, we process the following data to fulfil that contract:
- Company name, address, billing information
- Contact persons (name, email, phone)
- User accounts for the Elovia portal (name, email, role)
- Key issuance and access log data
The legal basis is Art. 6(1)(b) GDPR. Retention follows applicable commercial and tax law (typically 10 years for invoicing data, Art. 6(1)(c) GDPR).
2.4 Hotel guest data
To issue a digital room key, we process guest data provided by the hotel (name, email address, room assignment, check-in/check-out dates). We act as a data processor on behalf of the hotel (Art. 28 GDPR). Guest data is automatically deleted 60 days after check-out. Hotel operators are responsible for their own guest data privacy policies.
3. Cookies
Technically necessary cookies
We use only technically necessary cookies to ensure the website and portal function correctly (e.g. session management, authentication tokens). These cannot be disabled without breaking core functionality. Legal basis: Art. 6(1)(f) GDPR.
No tracking or advertising cookies
We do not use analytics, tracking, or advertising cookies. We do not use Google Analytics, Meta Pixel, or similar third-party tracking services on this website.
4. Third Parties and Data Transfers
4.1 Hosting & infrastructure
Our website and platform are hosted on servers located within the European Union (Frankfurt, Germany). Our hosting provider acts as a data processor under a signed Data Processing Agreement (Art. 28 GDPR).
4.2 Email delivery
Digital room keys are delivered to guests via transactional email. We use an EU-based or adequately protected email service provider acting as a data processor under a DPA.
4.3 Fonts
This website uses system fonts rendered locally by your device. No font files are loaded from third-party servers, so no personal data (such as your IP address) is transmitted to external font providers when visiting this website.
4.4 No transfers to third countries
We do not intentionally transfer personal data outside the EU/EEA, unless your use of the service requires it and appropriate safeguards (e.g. Standard Contractual Clauses) are in place.
5. Your Rights
Under the GDPR you have the following rights regarding your personal data:
- Right of access (Art. 15 GDPR) — you may request a copy of the data we hold about you.
- Right to rectification (Art. 16 GDPR) — you may ask us to correct inaccurate data.
- Right to erasure (Art. 17 GDPR) — you may ask us to delete your data where no legal basis for retention exists.
- Right to restriction (Art. 18 GDPR) — you may request that we restrict processing in certain circumstances.
- Right to data portability (Art. 20 GDPR) — you may request your data in a structured, machine-readable format.
- Right to object (Art. 21 GDPR) — you may object to processing based on legitimate interests.
- Right to withdraw consent — where processing is based on consent, you may withdraw it at any time with future effect.
- Right to lodge a complaint (Art. 77 GDPR) — you have the right to complain to a supervisory authority. The competent authority for H&H Group GmbH is the State Data Protection Authority of Baden-Württemberg (www.baden-wuerttemberg.datenschutz.de).
To exercise any of these rights, please contact us at info@elovia.io.
6. Data Security
We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. All data in transit is encrypted using TLS/SSL. Stored data is encrypted at rest.
Despite these measures, no transmission over the internet is completely secure. If you have reason to believe that your data has been compromised, please contact us immediately at info@elovia.io.
7. Retention Periods
We retain personal data only for as long as necessary for the purpose for which it was collected, or as required by applicable law. Specifically:
- Website log files: 30 days
- Contact enquiry data: until resolved, then deleted promptly
- Hotel guest key data: 60 days after check-out
- Contract and invoicing data: 10 years (commercial law, §257 HGB / §147 AO)
8. Updates to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The current version is always available at elovia.io/datenschutz. Material changes will be communicated to active customers by email.
This policy was last updated in June 2025.