1. About this policy
This Privacy Policy explains how Ovilo (“Ovilo”, “we”, “us”) processes personal data when you visit the websites ovilo.lt and ovilo.io, request a demo or otherwise contact us, and when you use the Ovilo property management service, including the web application, the mobile app and related features (the “Service”) as a user of one of our customers.
This policy is the information notice required by Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”). Terms such as “personal data”, “processing”, “controller” and “processor” have the meaning given to them in the GDPR.
2. Controller and contact
Ovilo is the controller of the personal data described in this policy. For any question about this policy or to exercise your rights, contact us at hello@ovilo.io. Requests may be written in English or Lithuanian.
3. Our role: controller and processor
We act as a controller for personal data we process for our own purposes: data about website visitors, people who request a demo or contact us, users of customer accounts, billing contacts and support correspondence. This policy covers that processing.
Our customers are accommodation providers such as hotels, guesthouses, holiday homes and campsites. When a customer uses the Service to manage reservations, guests, messages, payments, invoices or guest registration, the customer is the controller of that data and Ovilo processes it only on the customer’s behalf and on its instructions, as a processor. That processing is governed by our Data Processing Agreement, which forms part of our Terms of Service.
If you are a guest of a property that uses Ovilo, the property’s own privacy notice applies to your data, and you should direct requests about it to the property. If you contact us about such data, we will forward your request to the relevant customer and assist the customer in responding.
4. Website visits
When you visit our websites, the servers that deliver them receive technical data that your browser sends with every request: IP address, browser type and version (user agent), requested page, date and time of the request, and the referring page. We use this data to deliver the websites, keep them secure and diagnose faults.
Legal basis: Article 6(1)(f) GDPR, our legitimate interest in operating a secure and working website.
Our marketing websites do not use analytics, advertising or social media tracking tools, and do not set cookies for such purposes. Fonts are served from our own domain, so no third-party font service receives your data.
5. Demo requests and enquiries
When you submit the demo form, we receive the email address you enter. Together with it we record the language and website you used (ovilo.lt or ovilo.io), your IP address, your browser’s user agent, the referring page and the time of submission. If you then correspond with us, we also process the content of that correspondence and any details you choose to give us, such as your name, phone number, the name and type of your property, the number of rooms and the system you currently use.
We use this data to reply to you, arrange and hold a demo, answer questions and prepare an offer. We use the technical data to detect spam and abuse of the form.
Legal bases: Article 6(1)(b) GDPR, taking steps at your request before entering into a contract; and Article 6(1)(f) GDPR, our legitimate interest in communicating with businesses interested in Ovilo and in protecting the form against abuse. Providing your email address is voluntary, but without it we cannot respond to your request.
6. Accounts and use of the Service
When you are given access to the Service by your organisation, or create an account yourself, we process the following data:
- Account data: name, email address, password (stored only as a salted hash), profile picture if provided, email verification status, role and membership in an organisation, and invitations.
- Onboarding data you submit when requesting access: property name, type and location, number of rooms, website, contact name, email and phone, the system you currently use and the chosen plan.
- Sign-in and session data: session identifiers, IP address, user agent and session timestamps.
- Activity and audit records: which user performed which significant action in the Service, when, and from which IP address and browser.
- Notification settings and, if you enable notifications, the push subscription or device token of your browser or mobile device.
- Support data: the content of your requests to us and our replies.
We use this data to create and administer accounts, authenticate users, provide the functions of the Service, apply the roles and permissions set by your organisation, keep a record of actions for security and accountability, send service messages (for example email verification, invitations, security notices and notifications you have enabled) and provide support.
Legal bases: Article 6(1)(b) GDPR where you are yourself party to the contract with us; otherwise Article 6(1)(f) GDPR, the legitimate interest of Ovilo and of the customer you work for in providing, securing and supporting the Service your organisation uses.
If you choose “Sign in with Google”, Google shares your name, email address, profile picture and Google account identifier with us. You can use an email address and password instead.
Push notifications are sent only after you allow them in your browser or device. In the browser they are delivered through the push service of your browser vendor; in the mobile app through your device operating system's push service. You can switch notifications off in the Service or in your device settings at any time.
7. Billing and contract administration
For customers we process billing details: the name of the business, company code and VAT number where applicable, billing address, billing email, the selected plan and billing period, invoices, and payment records. We also process the names and contact details of the people who act for the customer.
We use this data to conclude and perform the contract, issue invoices, collect fees and keep accounting records.
Legal bases: Article 6(1)(b) GDPR, performance of the contract; Article 6(1)(c) GDPR, compliance with accounting and tax obligations under Lithuanian law; and, for data about representatives of a business customer, Article 6(1)(f) GDPR, our legitimate interest in administering the contract.
8. Service communications and product news
We send customers and users messages that are necessary for the Service, such as security alerts, billing notices and notices of changes to our terms. These are based on Article 6(1)(b) or 6(1)(f) GDPR and cannot be switched off while you use the Service.
If we send news about Ovilo by email, we do so only to customer contacts in relation to similar services we provide, or with consent. Every such message contains an easy way to unsubscribe, and you may object at any time. Legal basis: Article 6(1)(f) GDPR together with the rules on electronic direct marketing, or Article 6(1)(a) GDPR where we rely on consent.
9. Security, error monitoring and legal claims
We process technical logs and error reports to keep the websites and the Service secure, detect and investigate misuse, and fix faults. Error reports can incidentally contain identifiers of the affected user or request. Legal basis: Article 6(1)(f) GDPR, our legitimate interest in the security and reliability of our systems.
Where necessary, we process the relevant data to establish, exercise or defend legal claims (Article 6(1)(f) GDPR) and to comply with lawful requests of public authorities (Article 6(1)(c) GDPR).
10. Where the data comes from
We collect most data directly from you. Data about users may also come from the customer organisation that invites them (name, email address and role), from Google if you use Google sign-in, and from your browser or device automatically, as described above.
11. Recipients
We do not sell personal data. We share it only with the following recipients, and only to the extent needed for their task:
- Cloud infrastructure providers: hosting of the application, database and files (application and database in the European Union).
- Content delivery and abuse-protection providers: website delivery and protection against automated abuse.
- Email delivery providers: sending transactional emails.
- Messaging providers: SMS and WhatsApp messages, where a customer uses these channels.
- Error-monitoring providers: detecting and fixing application errors.
- Payment service providers: processing payments made through the Service. For certain purposes, such as fraud prevention and their own regulatory obligations, they act as independent controllers under their own privacy notices.
- Google: only if you choose to sign in with Google, under Google's privacy policy.
- Google: “Sign in with Google”, if you use it, under Google’s own privacy policy.
- Push services of browser and mobile operating-system vendors: delivery of push notifications you have enabled.
- Channel connectivity providers and online travel agencies: exchange of availability, rates and reservation data when a customer connects the Service to booking channels, on the customer’s instructions.
- Professional advisers, such as accountants, auditors and lawyers, bound by confidentiality.
- Public authorities, courts and law enforcement, where we are legally required to disclose data.
- A successor or acquirer, if our business or its assets are transferred, subject to this policy.
The service providers above act as our processors under written agreements that meet the requirements of Article 28 GDPR, except where stated that they act as independent controllers. A list of the specific providers is available on request at hello@ovilo.io.
12. International transfers
The Ovilo application and database are hosted in the European Union. Some of our service providers, such as content-delivery, error-monitoring, payment and push-notification providers, are established in or may access data from countries outside the European Economic Area, in particular the United States.
We transfer personal data outside the EEA only where the transfer complies with Chapter V GDPR: to a country covered by a European Commission adequacy decision, including recipients certified under the EU–U.S. Data Privacy Framework, or on the basis of the Standard Contractual Clauses adopted by the European Commission (Article 46(2)(c) GDPR), together with supplementary measures where needed. You may request information about the safeguards used by writing to us.
13. How long we keep data
We keep personal data only as long as necessary for the purposes described above:
- Demo requests and enquiries: 24 months after our last contact with you, unless you become a customer.
- Account data: for as long as the account exists and the contract is in force; deleted within 90 days after the account is closed or the contract ends.
- Activity and audit records: for the lifetime of the customer account, and deleted together with it.
- Technical logs and error reports: up to 30 days. Logs relevant to a security incident may be kept longer, for as long as needed to investigate and resolve it.
- Invoices and accounting records: for the periods required by Lithuanian accounting and tax law, generally 10 years.
- Data needed for a legal claim or dispute: until it is finally resolved.
- Backups: deleted data may remain in encrypted backups until they are overwritten, within 35 days.
Customer data processed on behalf of customers, including guest data, is retained and deleted in accordance with the customer’s instructions and the Data Processing Agreement.
14. Cookies and similar technologies
Our marketing websites do not set cookies of their own. Our website delivery and protection provider may set a strictly necessary security cookie to distinguish people from automated traffic when it detects suspicious activity.
The Ovilo web application uses only cookies that are strictly necessary to provide the Service you requested or to remember your interface choices:
- Sign-in session cookies: keep you signed in; valid for up to 7 days and renewed while you use the application.
- Preference cookies: remember your selected organisation and interface language (up to 12 months) and interface layout (up to 7 days).
The application also stores some interface preferences, such as dismissed notices and panel layout, in your browser’s local storage. The mobile app stores its sign-in session in the device’s secure storage. We do not use analytics, advertising or cross-site tracking cookies, so no cookie consent is requested. You can delete cookies in your browser settings; if you delete the session cookie, you will be signed out.
Booking pages and online check-in pages that customers publish to their guests are covered by the relevant customer’s privacy notice.
15. Security
We apply technical and organisational measures appropriate to the risk, including encryption of connections (TLS), encryption of stored data by our database and storage providers, hosting of the application and database in the EU, separation of each customer’s data and role-based permissions within the Service, access to production systems limited to authorised personnel, storage of passwords only as salted hashes, audit logging, error monitoring and regular backups. No system is completely secure, but we work to protect data against unauthorised access, loss and alteration.
16. Your rights
Subject to the conditions of the GDPR, you have the right to:
- access your personal data and receive a copy of it (Article 15);
- have inaccurate data rectified and incomplete data completed (Article 16);
- have your data erased (Article 17);
- restrict processing (Article 18);
- receive data you provided to us in a structured, commonly used and machine-readable format, and have it transmitted to another controller, where processing is based on consent or contract and carried out by automated means (Article 20);
- object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests, and object at any time to direct marketing (Article 21);
- withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before the withdrawal.
To exercise your rights, write to hello@ovilo.io. We will respond within one month of receiving the request. Where necessary, taking into account the complexity and number of requests, this period may be extended by two further months, and we will inform you of the extension. We may ask you to confirm your identity. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive.
17. Complaints
If you believe we process your personal data unlawfully, you may lodge a complaint with the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt) or with the supervisory authority of the EU Member State where you live or work, or where the alleged infringement took place. We would appreciate the chance to address your concern first, so please consider contacting us beforehand.
18. Automated decision-making
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.
19. Children
Our websites and the Service are intended for businesses and are not directed at children. We do not knowingly collect personal data from children for our own purposes. Customers may record data about children who stay at their properties; that data is processed on the customer’s behalf, as described in section 3.
20. Changes to this policy
We may update this policy when our processing or the law changes. The effective date at the top shows the current version. We will notify customers of material changes by email or in the Service before they take effect.
Contact
Questions about this document can be sent to hello@ovilo.io.