Privacy Policy

1. Scope and responsibility

Deleopol Hotel operates this portal for authorized hotel staff and administrators. The portal is a private workplace communication service, not a public social network or guest-booking service. Deleopol Hotel determines why and how staff information is used within the portal.

2. Information we handle

• Staff account information: name, company email, personal invitation email, job title, department, role, phone number, account status, and sign-in records.
• Workplace communications: department chat messages, company email metadata and content, attachments, cases, assignments, handover notes, and related activity.
• Connected-service identifiers: Telegram user and group identifiers, Google account authorization details, Business Profile location identifiers, and review-platform identifiers.
• Operational and security information: IP address, device and browser details supplied through normal web requests, timestamps, audit events, job status, delivery results, and error logs.
• Guest and external-contact information: information contained in business emails, public reviews, and staff-created operational records.

Staff should only enter information required for legitimate hotel work and should avoid unnecessary sensitive personal information.

3. How information is used

Information is used to authenticate staff, route departmental communication, synchronize approved company mailboxes, support Telegram-based staff communication, manage guest reviews, assign and follow up work, send security and service notifications, maintain audit trails, diagnose failures, protect the portal, and meet the hotel’s legitimate operational and legal obligations.

4. Connected services

The portal may exchange necessary information with services selected and configured by hotel administrators:

• Google: optional staff sign-in and Google Business Profile authorization, location selection, review synchronization, and approved review replies.
• Telegram: staff identity linking, department-group messages, attachments, Mini App access, and bot-assisted actions.
• Company email providers: secure IMAP and SMTP connections for receiving, displaying, sending, and synchronizing authorized mailboxes.
• Review data providers: retrieval and internal management of public review information where an approved integration is configured.

Each external service processes information under its own terms and privacy policy. The hotel limits access tokens and credentials to the functions required for the configured integration.

5. Google user data

When Google sign-in is enabled, the portal requests basic identity information needed to identify the user and create or match a staff access request. When Google Business Profile is connected, the portal uses authorization granted by an administrator to list managed accounts and locations, retrieve reviews, and publish an approved response. Google credentials and access tokens are not sold or used for advertising.

The portal’s use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

6. Access and sharing

Access is limited by staff role, department, mailbox assignment, and administrative permission. Authorized managers and administrators may monitor communications and audit activity when required for hotel operations, security, service quality, investigation, or compliance. Information may also be disclosed to service providers acting for the hotel, when required by law, or to protect people, property, accounts, and systems. The hotel does not sell portal information.

7. Retention and deletion

Information is retained for as long as needed for active hotel operations, security, audit, dispute handling, backup, and legal requirements. Retention may vary by information type. Administrators can disable staff access, disconnect integrations, remove stored credentials, and apply approved retention settings. Some records may remain in protected backups or audit trails until their normal retention period expires.

8. Security

The portal uses authenticated access, role and department permissions, encrypted integration credentials, HTTPS, request validation, restricted files, expiring connection links, audit logging, and operational monitoring. No system can guarantee absolute security. Staff must protect passwords and devices, avoid forwarding private access links, and report suspected unauthorized access promptly.

9. Staff choices and requests

Staff may ask hotel administration to review or correct their account information, explain applicable monitoring, revoke optional connected access, or evaluate a lawful deletion or restriction request. Some workplace and audit records may need to be preserved for legitimate operational or legal reasons.

10. Changes to this policy

Deleopol Hotel may update this policy when portal features, connected services, operational practices, or legal requirements change. The effective date shown above identifies the current version.

11. Contact

For privacy questions or requests, contact Deleopol Hotel administration through the hotel’s official contact channel and identify that your request concerns the Internal Staff Portal.