Privacy Policy
Last updated: February 26, 2026
1. Who we are
hejGuide is a product of Sirrom Solutions, a company registered in the Netherlands.
- Chamber of Commerce (KvK): 98483226
- VAT number: NL005333682B04
- Email: privacy@hejguide.com
- Website: hejguide.com
When we refer to "hejGuide", "we", "us", or "our" in this policy, we mean Sirrom Solutions as the data controller for personal data processed through our platform.
2. What data do we collect?
We collect different categories of personal data depending on how you interact with our service:
2.1 Account holders (hosts)
- Identity data: First name, last name
- Contact data: Email address, phone number
- Account data: Password (hashed), account preferences, language settings
- Billing data: Company name, VAT number, billing address, payment history (via Mollie)
- Technical data: IP address, browser type, device information, login timestamps
- Usage data: Features used, pages visited, actions taken within the dashboard
2.2 Guests (of account holders)
When hosts use hejGuide to manage their properties, we process guest data on behalf of the host. In this case, the host is the data controller and hejGuide acts as a data processor. This data may include:
- Identity data: Guest name, nationality
- Contact data: Email address, phone number
- Booking data: Check-in/out dates, number of guests, special requests
- Check-in data: ID document details (if required by local law), arrival time
- Communication data: Messages exchanged with the host
2.3 Website visitors
- Technical data: IP address, browser type, pages visited
- Contact form data: Name, email, message content (if you contact us)
3. How do we collect your data?
We collect data through the following methods:
- Directly from you: When you register, fill out your profile, create content, or contact us
- Automatically: Through cookies and server logs when you use our website and dashboard
- From third parties: Booking platforms (Airbnb, Booking.com) via calendar sync or channel manager integration, and payment data from our payment provider Mollie
4. Legal basis for processing
We process your personal data based on the following legal grounds under Article 6 of the GDPR:
| Purpose | Legal basis |
|---|---|
| Providing and maintaining the service | Performance of contract (Art. 6(1)(b)) |
| Account creation and authentication | Performance of contract (Art. 6(1)(b)) |
| Processing payments and invoicing | Performance of contract (Art. 6(1)(b)) |
| Sending service notifications (password resets, security alerts) | Performance of contract (Art. 6(1)(b)) |
| Sending product updates and tips | Legitimate interest (Art. 6(1)(f)) |
| Improving the service (analytics) | Legitimate interest (Art. 6(1)(f)) |
| Preventing fraud and abuse | Legitimate interest (Art. 6(1)(f)) |
| Complying with legal obligations (tax, accounting) | Legal obligation (Art. 6(1)(c)) |
| Processing guest data on behalf of hosts | Performance of contract with host (Art. 6(1)(b)) + Data Processing Agreement (Art. 28) |
5. How do we use your data?
We use the data we collect for the following purposes:
- To provide and operate the hejGuide platform
- To create and manage your account
- To process subscriptions and payments
- To generate invoices
- To send transactional emails (booking confirmations, check-in instructions, etc.)
- To provide customer support
- To detect and prevent security incidents
- To improve our service based on usage patterns
- To comply with legal and regulatory obligations
We do not sell your personal data to third parties. We do not use your data for automated decision-making or profiling.
6. Who do we share your data with?
We share personal data only with the following categories of recipients, and only to the extent necessary:
| Sub-processor | Purpose | Location |
|---|---|---|
| Mollie B.V. | Payment processing | Netherlands (EU) |
| Channex.io | Channel manager (booking platform sync) | EU |
| Sentry (Functional Software, Inc.) | Error monitoring and crash reporting | EU (Frankfurt) |
| Plesk / Hetzner | Server hosting and infrastructure | Netherlands (EU) |
All sub-processors are bound by data processing agreements and are required to process data in compliance with the GDPR.
7. International data transfers
Your data is stored and processed on servers located in the Netherlands, within the European Union. We do not transfer personal data outside the EEA. If this changes in the future, we will ensure appropriate safeguards are in place (such as Standard Contractual Clauses or an adequacy decision).
8. How do we store and protect your data?
We take the security of your data seriously and implement appropriate technical and organizational measures:
- All data in transit is encrypted using TLS/SSL (HTTPS)
- Passwords are hashed using bcrypt with individual salts
- Two-factor authentication (2FA) is available for all accounts
- CSRF protection on all forms
- Database backups are created daily and stored securely
- Access to personal data is restricted to authorized personnel only
- Regular security reviews and updates
9. How long do we keep your data?
| Data type | Retention period |
|---|---|
| Account data | Duration of your account + 30 days after deletion |
| Guest data (managed by hosts) | As determined by the host's retention settings. GDPR module allows hosts to anonymize guest data. |
| Invoices and billing records | 7 years (Dutch tax law requirement) |
| Server logs | 90 days |
| Support conversations | 2 years after last interaction |
| Cookie consent records | Duration of consent + 1 year |
When data is no longer needed, it is securely deleted or anonymized.
10. Cookies
We use a limited number of cookies to operate our service:
| Cookie | Purpose | Type | Duration |
|---|---|---|---|
| PHPSESSID | Session management (keeps you logged in) | Essential | Session / 7 days |
| remember_me | "Remember me" login functionality | Essential | 30 days |
| cookie_consent | Stores your cookie preferences | Essential | 1 year |
| hejguide-theme | Dark/light mode preference | Functional | Persistent (localStorage) |
We do not use third-party tracking cookies, advertising cookies, or analytics cookies. You can manage cookies through your browser settings.
11. Your data protection rights
Under the GDPR, you have the following rights regarding your personal data:
- Right of access (Art. 15): You can request a copy of all personal data we hold about you.
- Right to rectification (Art. 16): You can request that we correct any inaccurate or incomplete data.
- Right to erasure (Art. 17): You can request that we delete your personal data under certain conditions.
- Right to restrict processing (Art. 18): You can request that we limit how we use your data.
- Right to object (Art. 21): You can object to our processing of your data based on legitimate interest.
- Right to data portability (Art. 20): You can request your data in a structured, machine-readable format.
- Right to withdraw consent: Where we process data based on consent, you can withdraw it at any time.
To exercise any of these rights, contact us at privacy@hejguide.com. We will respond within one month of receiving your request, as required by the GDPR.
You can also exercise some of these rights directly in the dashboard through the GDPR module (Settings > Privacy & Data).
12. Data Processing Agreement (DPA)
When you use hejGuide to manage guest data, you act as the data controller and we act as the data processor. In accordance with Article 28 of the GDPR, we provide a Data Processing Agreement (DPA) that outlines our obligations.
The DPA is available in your dashboard under Settings > Privacy & Data > Data Processing Agreement. By using hejGuide, you agree to the terms of the DPA.
13. Marketing communications
We may send you product updates, tips, and news about hejGuide. You can opt out of these communications at any time by:
- Clicking the "unsubscribe" link in any marketing email
- Updating your email preferences in your account settings
- Contacting us at privacy@hejguide.com
We will never send marketing emails without a prior relationship or explicit consent. Transactional emails (password resets, security alerts, payment confirmations) are not affected by your marketing preferences.
14. Children's privacy
hejGuide is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.
15. Third-party links
Our website and dashboard may contain links to third-party websites or services (such as Airbnb, Booking.com, Mollie, and others). We are not responsible for the privacy practices of these external sites. We encourage you to read their privacy policies.
16. Changes to this policy
We may update this Privacy Policy from time to time. When we make significant changes, we will:
- Update the "Last updated" date at the top of this page
- Notify registered users by email
- Display a notice in the dashboard
We encourage you to review this policy periodically.
17. Complaints
If you believe we have not handled your personal data correctly, you have the right to lodge a complaint with a supervisory authority. For the Netherlands, this is:
- Autoriteit Persoonsgegevens (Dutch Data Protection Authority)
- Website: autoriteitpersoonsgegevens.nl
- Phone: +31 (0)70 888 85 00
We would appreciate the opportunity to resolve your concern before you contact the supervisory authority. Please reach out to us first at privacy@hejguide.com.
18. Contact us
For any questions about this Privacy Policy or your personal data, contact us:
- Email: privacy@hejguide.com
- General: hello@hejguide.com
- Contact form: hejguide.com/contact