Privacy Policy

At Revenda Hospitality ("Revenda", "we", "us", "our"), privacy is not a compliance checkbox — it is the foundation of the trust travellers, property owners, and management companies place in us every day. We operate two tightly integrated platforms:

This Privacy Policy applies to every interaction with the Revenda ecosystem, including but not limited to:

• Guests and travellers who browse, book, or complete a stay through Revenda.
• Property owners who list and manage their properties on Revenda.
• Management companies operating multiple properties through the Revenda PMS.
• Hotel staff and agents using the PMS to serve guests.
• Partners and vendors who integrate with our APIs, channels, or payment rails.
• Website visitors who interact with revenda.com and all its subdomains.

It covers our websites, web applications, mobile applications, APIs, and PMS tools. Third-party services we integrate with (for example, a hotel's own booking page or a payment provider's checkout) are governed by their own privacy notices, which we encourage you to review.

We collect data across four broad categories, always with a specific purpose and always proportionate to it.

A. Data you give us directly

B. Data collected automatically

• Device & network: IP address, browser type, OS, device identifiers, preferred language.
• Usage: pages viewed, searches performed, links clicked, time on page, referring URL.
• Approximate location: derived from IP address, to localise currency, language, and legal notices.
• Precise location: only if you explicitly grant permission in your browser or mobile app — for example, to show nearby stays.

C. Data from third parties

• Payment processors (Stripe, PayPal, Coinbase Commerce, crypto networks) provide confirmation of a completed transaction — never your full card data.
• Identity verification providers may confirm a document you submit matches your identity.
• Channel partners (for example, another OTA or GDS) may forward booking information when a stay is booked elsewhere and synced to Revenda.
• Map and location data from OpenStreetMap and similar sources, used to geolocate and describe properties.

D. Data you create inside Revenda

• Reviews, ratings, photos, and messages exchanged with properties or support.
• Wishlists, saved searches, trip plans, and preferences.
• PMS notes, tasks, and operational records created by property staff.

Every use of your personal data falls under one of the following purposes. We do not use personal data for anything outside these purposes without your explicit consent.

Where the EU/UK GDPR applies, we rely on the following legal bases:

Revenda supports every commonly available payment method — traditional and digital — so guests can pay in whichever way suits them, and property owners can receive funds on their terms.

Payment methods we support

Who charges the guest

Depending on the arrangement configured by the property, Revenda may operate in either of two modes:

Instant payouts to property owners

Property owners and management companies on Revenda can request immediate payout of a settled reservation where the payment mode and jurisdictional rules allow it. When an owner does so:

• Payout goes to the bank account or crypto wallet the owner has verified in their PMS profile.
• We store the destination details (masked), the payout amount, the timestamp, and the payout reference for reconciliation and tax purposes.
• Instant payouts are subject to fraud, AML, and chargeback-risk checks, and may be delayed or declined where those checks fail.

Refunds & chargebacks

Refunds are returned to the original payment method wherever possible. Where the original method is unavailable (for example, an expired card or a discontinued wallet), we work with the guest to arrange an alternative, in line with the property's cancellation policy and applicable consumer law.

Revenda is crypto-native. We accept major cryptocurrencies and stablecoins for both guest bookings and property subscriptions. Because blockchain transactions are public by nature, we are transparent about what we do and do not store.

What we collect

• Public wallet address you use to send payment (or the refund address you provide).
• Transaction hash — the on-chain reference.
• Amount, asset, and timestamp of the transaction.
• Network confirmations — to verify the payment has settled.

What we do NOT collect

• We do not ask for, store, or transmit private keys, seed phrases, or wallet passwords.
• We do not link your wallet address to your real-world identity beyond what is necessary for AML, tax, and refund processing.
• We do not sell or share wallet addresses with marketing partners.

Blockchain visibility

Blockchain transactions are, by design, public and permanent. Anyone who knows your wallet address can see your on-chain history. Revenda has no ability to delete or alter on-chain records. Where a payment was made with a privacy-focused asset or via a privacy-preserving gateway, that is between you and the asset's ecosystem — we neither encourage nor forbid it.

We share personal data only when necessary, and always under contract that binds the recipient to confidentiality and data-protection standards at least as strong as ours.

We use a small, curated set of cookies and similar technologies. Our guiding rule: if it isn't needed to run the platform or to serve you better, we don't set it.

You can control cookies through your browser settings and, where offered, through the Revenda cookie banner. Disabling essential cookies may break the platform.

Revenda uses artificial intelligence and algorithmic ranking to power search, recommendations, dynamic pricing signals, and the AI Trip Planner. We are transparent about how this works.

• What AI does: rank search results, suggest destinations, predict demand, provide smart-pricing insights to property owners, and generate personalised itineraries on request.
• What AI does not do: make automated decisions that produce legal effects or significantly affect you without human review. We do not use AI to discriminate on protected characteristics.
• Data used: your interaction history on Revenda (searches, clicks, bookings), aggregated trends, and — where you opt in — stated travel preferences. We do not feed your identity documents or payment data to AI models.
• Human oversight: you may contact us at any time to request human review of a decision you believe was made solely by automated means.

We take security seriously enough to invest in it continuously. Our program is built on recognised international standards (ISO 27001 principles, NIST CSF, OWASP ASVS).

No system is perfect. If you discover a vulnerability, please report it responsibly to security@revenda.com. We operate a coordinated-disclosure policy and will acknowledge valid reports within 72 hours.

We keep data only as long as needed to serve the purpose for which it was collected, or as long as law requires.

Revenda operates globally. Your data may be processed in countries outside your own, including jurisdictions that may not provide the same level of legal protection.

When we transfer personal data across borders we rely on one or more of:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Adequacy decisions where applicable (for example, EU–UK, EU–Switzerland).
• Transfer Impact Assessments to confirm the receiving jurisdiction offers comparable protection.
• Additional technical measures — including end-to-end encryption of the most sensitive fields.

You may request a copy of the applicable safeguards by contacting our Data Protection Officer.

Depending on where you live, you may have some or all of the following rights. We honour them regardless of jurisdiction as a matter of principle.

To exercise any right, email privacy@revenda.com. We respond within 30 days (or sooner where required). You will never be charged for exercising a right, and you will not receive worse service as a result.

California residents (CCPA/CPRA)

California residents have the right to know what personal information is collected, to request deletion, to correct, to opt out of "sale" or "sharing" (Revenda does neither), and to be free from discrimination for exercising these rights. Authorised agents may submit requests on your behalf.

Revenda is not directed to children under the age of 16 (or under 13 where a jurisdiction's laws permit). We do not knowingly collect personal data from children. Minors may stay at a property when accompanied by a parent or legal guardian; the booking itself must be made by an adult.

If you believe a minor has provided us with personal data, contact privacy@revenda.com and we will delete it promptly.

If you list a property on Revenda or use the PMS, you are also a data controller in your own right for the guest data you receive and process through your property operations. This section summarises your obligations and what Revenda does on your behalf.

What Revenda does on your behalf

• Collects and passes to you the guest data necessary to fulfil a booking.
• Processes payments on your behalf where you have enabled Revenda collection.
• Operates the PMS infrastructure, encryption, and security controls you rely on.
• Logs access, exports, and configuration changes for audit purposes.

What you must do

• Publish a privacy notice to your guests explaining your own use of their data.
• Use guest data only for the purposes of the stay and legitimate post-stay communication (with the guest's consent where required).
• Secure any PMS credentials you hold, enable MFA for your staff, and revoke access when staff leave.
• Report suspected data breaches involving guest data to Revenda within 24 hours so we can support your own regulatory obligations.
• Comply with local hotel laws (guest registration, ID requirements, tax reporting).

Instant payout consent

If you opt in to instant payouts, you agree that Revenda may transfer settled funds to the verified account or wallet on file as soon as the reservation settles. You are responsible for the accuracy of those details and for any tax consequences of receiving funds on an accelerated schedule.

We use a small, carefully selected group of sub-processors. Each is bound by a data-processing agreement and evaluated for security and privacy maturity before we work with them, and reviewed annually.

A current, named list is available on request to dpo@revenda.com.

We maintain a documented incident-response plan that follows NIST SP 800-61 principles. In the event of a personal-data breach:

1. Contain: isolate affected systems immediately.
2. Assess: determine the scope, nature, and risk to individuals.
3. Notify regulators: within 72 hours of awareness, where required (e.g. GDPR Art. 33).
4. Notify individuals: without undue delay where the breach poses a high risk to their rights and freedoms.
5. Notify affected property owners: so they can meet their own obligations.
6. Post-mortem: documented root-cause analysis and remediation, shared with regulators on request.

We may update this Privacy Policy to reflect changes in our services, technology, or the law. When we do:

• We update the Last updated date at the top.
• For material changes we notify you by email and/or by a prominent banner in the platform.
• Where required by law, we obtain fresh consent.
• Prior versions are archived and available on request.

Continued use of Revenda after an update means you accept the revised policy, unless a change specifically requires your active consent.

We want to hear from you — whether you're exercising a right, raising a concern, reporting a bug, or just asking a question.