What we hold, and what we publish.

The data controller is Miguel Signes Perelló. Contact for any privacy matter: legal@hoteltech.lol.

Collected: company name, website, primary category, a business contact email, the pre-tax amount paid, payment status and timestamps, the terms version accepted, and payment identifiers returned by Stripe. Billing name, address and tax ID are collected and held by Stripe as the payment processor and, where an invoice is issued, by us for accounting purposes.

Published: company name, website, category, Current Round Score, Season Spend and position.

Never published: business email, billing details, tax ID, payment identifiers.

Legal basis: performance of the paid placement contract, and legal obligation for invoicing and tax records.

Collected: hotel name, website, country, property and room counts, a contact name, a work email address, the challenge text, the rules version accepted, the submitting IP address and verification timestamps.

Published (only after work-email verification): hotel name, website, country, size band, challenge title and text, and the verified support count.

Never published: work email address, contact name, IP address, verification tokens, internal risk flags.

Legal basis: steps taken at the submitter's request, and legitimate interest in verifying that a submission is genuine.

Collected: a work email address, a normalised form of it used to prevent duplicate support, the challenge supported, the rules version accepted, and verification timestamps.

Published: nothing identifying. Only an aggregate verified count per challenge is shown.

Legal basis: steps taken at the participant's request, and legitimate interest in the integrity of the verified support count.

Administrator accounts are restricted to an explicit allowlist. Every operator action that changes state is written to an append-only audit log with the operator's email, the action and the before/after values. This log is internal and never published.

Emails sent by this site are operational: address verification, payment confirmation and rank-change notifications tied to a transaction you initiated. They are not marketing and are not sent on the basis of marketing consent. There is no newsletter, no promotional mailing list and no sale or sharing of email addresses.

Stripe (payment processing), our managed database and application hosting provider, and our transactional email provider. Processors act on documented instructions only. Some processors may process data outside the EEA under standard contractual clauses.

Payment and invoicing records are kept for the statutory accounting period. Verification tokens are single-use and expire within 30 minutes. Unverified challenge submissions and unverified supports are deleted or anonymised once they can no longer be verified. Published ranking history is retained as a permanent public record of the season.

You may request access, rectification, erasure, restriction, portability or object to processing, and you may lodge a complaint with the Spanish supervisory authority (AEPD). Write to legal@hoteltech.lol. Note that erasure of published ranking amounts may be refused where retention is required for accounting or for the integrity of a public paid-placement record; identifying contact data can always be removed.

Access to private tables is restricted at the database level; public pages read only from views that exclude contact data. See the cookie and technical storage notice.