A complete account of how we handle data.

This Privacy Policy describes how personal data is collected and used in connection with Asfour Stays accommodation, this website, direct availability enquiries, guest support, property safety and related business relationships. “Personal data” means information relating to an identified or reasonably identifiable individual.

The policy is designed to provide information required under applicable privacy laws, including where relevant the EU General Data Protection Regulation (“GDPR”), Qatar’s personal-data privacy framework and Morocco’s data-protection framework. The law that applies depends on the controller, the property, the individual and the processing activity.

A property, booking channel, campaign or new service may supply an additional notice. That specific notice supplements this policy and controls for the activity it describes. This policy does not create a contractual promise to collect data or operate a feature that has not launched.

The proposed central controller is Asfour Hospitality & Technology W.L.L., Level 22, Tornado Tower, West Bay, Doha, State of Qatar, CR No. 208741. These particulars are future-state business-plan details and must be verified before public launch.

The controller decides why and how personal data is processed. For a particular stay, the booking confirmation or local privacy notice must identify the relevant Accommodation Provider and explain whether it acts as a separate controller, joint controller or processor.

No data protection officer, EU representative or UK representative is named in this draft. If law requires one, verified contact details will be published before the relevant processing begins.

An Asfour local company, property owner, management company or licensed accommodation provider may independently need to register Guests, keep statutory records, operate CCTV, respond to authorities or meet tax and tourism duties. That organisation may be a separate controller for those purposes.

Where two organisations jointly determine the purposes and means of processing, they will document their respective responsibilities and make the essence of the arrangement available where required. A service provider that acts only on instructions will be bound by an appropriate processing agreement.

Before the Morocco property accepts live bookings, the confirmation and property notice must identify the actual Moroccan operator and the party responsible for local guest registration, CCTV, access control, incident files and data-subject requests.

This policy applies when you browse the website, contact us, request availability, make or manage a direct booking, stay at a property, communicate with support, join a membership programme, respond to a survey, make a business-travel or property-partnership enquiry, or interact with an official Asfour social-media account.

It also applies to a person whose data is supplied by a Booker, employer, travel manager, co-Guest, referral partner or online travel agency. In that case we will provide or make available the information required for indirect collection where the law requires.

Third-party booking platforms, payment services, map services and social networks process data under their own policies when they determine their own purposes. Their privacy practices are not controlled by this policy.

Controller

The organisation that decides the purposes and essential means of processing personal data.

Processor

A service provider that processes personal data for a controller under instructions.

Processing

Any operation involving personal data, including collection, use, storage, disclosure, correction and deletion.

Special data

Data given heightened protection by law, which may include health, religion, marital relationships, biometrics and alleged offences depending on the jurisdiction.

Guest

A Booker, registered occupant, visitor or prospective Guest whose data is handled for accommodation purposes.

Property data

Access, housekeeping, maintenance, CCTV, incident and other records generated in connection with a physical property.

We may obtain data directly from you when you send an email, complete a future booking flow, communicate with support, check in, use a property service or exercise a privacy right.

We may also receive data from:

• a Booker, family member, co-Guest, employer or travel manager arranging a stay;
• an online travel agency, referral partner, corporate travel service or property partner;
• payment, identity, fraud-prevention or communications providers once selected and disclosed;
• property staff, access systems, maintenance contractors and incident reports;
• public authorities, courts, insurers, advisers and public sources where lawful;
• your browser, device and the website’s hosting and security infrastructure.

If you provide another person’s data, you must be authorised to do so and should direct them to this policy. We will not use indirectly collected data for an incompatible purpose without a lawful basis and any required notice.

• Identity and registration: name, title, date and place of birth, nationality, passport or national-ID details, visa status, signature and document copies only where legally required.
• Contact: postal address, email, telephone, WhatsApp number, preferred language and communication preferences.
• Booking and stay: property, dates, Unit, occupancy, co-Guests, visitors, purpose category, preferences, requests, arrival and departure information.
• Transaction: price, payment token or reference, authorisation status, deposits, refunds, invoices, tax information, chargebacks and amounts due. Full card data should be handled by the selected payment provider.
• Communications: enquiry emails, service messages, support chats, call notes, complaints, feedback, reviews and consent records.
• Property and safety: access events, housekeeping and maintenance records, damage evidence, lost property, incident reports and lawfully deployed common-area CCTV.
• Technical: IP address, date and time, requested page, HTTP status, referrer, device, browser, operating system, language, cookie identifiers and security events.
• Business relationship: employer, role, company, invoicing details and information supplied for corporate travel or a property partnership.

We seek to collect only data that is adequate, relevant and necessary for a stated purpose.

Some data is necessary to answer an enquiry, create and perform an Accommodation Contract, take payment, provide access, register Guests or comply with law. Required fields should be marked or explained at the point of collection.

If required booking, identity, payment or statutory-registration data is not provided, we may be unable to confirm a booking, complete check-in, provide a requested service or continue the stay. We will not make optional marketing consent a condition of accommodation.

We may ask for information needed to verify a privacy request. Verification will be proportionate and will not require more data than reasonably necessary.

The current pre-launch availability form prepares a message in your own email application. Nothing is transmitted to an Asfour reservations database when you type into the form or select “review and open email”. We receive the contents only if you choose to send the email.

Once sent, your email provider and the recipient email provider process the message content and delivery metadata under their respective arrangements. Do not include passport copies, full payment-card data, health records or other sensitive material in a general enquiry email.

There is currently no Asfour PMS, automated booking engine, payment gateway, customer account, ID-verification platform, newsletter system or non-essential analytics suite represented by this policy as active. Each future service must be assessed and this policy updated with the relevant provider, purpose, location and safeguard before activation.

The applicable lawful basis depends on the activity and jurisdiction. Where the GDPR applies, the principal mapping is:

Our legitimate interests include operating safe accommodation, answering enquiries, preventing fraud, protecting networks and property, managing complaints and improving services. We assess necessity and balance those interests against individual rights. Consent may be withdrawn prospectively at any time.

We use enquiry and booking data to prepare quotations, check availability, communicate rate conditions, create and manage the Accommodation Contract, arrange requested services, handle modifications and maintain an auditable booking record.

Where a Booker supplies co-Guest data, we use it only for appropriate booking, registration, safety and communication purposes. A corporate travel manager may receive booking information they are authorised to manage, but not unrelated private service details.

After a stay, limited booking data may be used for accounting, complaints, fraud prevention, repeat-Guest preferences and legal claims in accordance with the retention schedule.

Properties may be legally required to verify identity and submit or retain specified guest-register information. The exact fields, recipient and retention period depend on the property country and must be described locally.

We should inspect an identity document without retaining a copy unless a copy is legally required or demonstrably necessary and authorised. Document images, national identifiers and passport details require restricted access and heightened security.

Identity processing must not be repurposed for marketing. A future digital-verification provider may be used only after diligence, a processing agreement, transfer review and an updated notice.

A selected payment provider may process card or bank information, tokens, billing details, authorisation results and fraud signals. Asfour should receive only the information needed to confirm payment and administer the account, not full card credentials unless expressly justified and secured.

Transaction data is used to collect the accommodation price, hold or release deposits, issue refunds, reconcile accounts, prevent fraud, answer chargebacks and meet tax and anti-money-laundering duties where applicable.

Automated fraud tools may flag a transaction for review, but no solely automated decision with legal or similarly significant effect is currently used by Asfour. Any future significant automated decision will be separately explained with available safeguards.

During a stay, we may use contact, booking and preference data to provide access instructions, housekeeping, maintenance, support, emergency notices, service recovery and departure information. Operational messages are not marketing.

Support communications may be documented to maintain continuity, train authorised staff, resolve complaints and establish what was agreed. Calls will not be recorded unless lawful notice and any required consent are provided.

Preferences may be retained for a repeat stay only where relevant and lawful. Guests may ask us not to retain optional preferences.

Access events, staff observations, photographs of damage, complaints, witness accounts and authority attendance may be recorded where necessary and proportionate to protect people and property, enforce the Accommodation Contract, make an insurance claim or respond to legal proceedings.

Incident records should describe objective facts—such as noise, damage, alcohol found on the property, access misuse or police attendance—and should not rely on assumptions about religion, ethnicity or private relationships.

Access to incident and alleged-offence information is restricted. It will be retained only for the investigation, claim, safety measure or limitation period that lawfully justifies it. An allegation is not recorded as a proven fact without appropriate context.

We do not ask Guests to declare their religion and do not create profiles about religious belief. We do not request relationship-status or marriage documentation unless a specific applicable law or competent authority legally requires it for the stay and the necessary permissions and safeguards are in place.

Health or accessibility information should be limited to what is needed to arrange requested support. Where GDPR applies, processing requires an Article 9 condition, such as explicit consent or another legally verified basis. Consent is not relied on where it is not freely given or where another condition is required.

Qatar and Morocco may require permission, notification or prior authorisation for categories such as religious belief, marital relationships, national identifiers and alleged offences. No such higher-risk processing may launch until local requirements are documented and satisfied.

A booking must be made by an adult. We may process a child’s name, age or date of birth, nationality and legally required registration details when the child accompanies a family or group.

We use children’s data only for accommodation, safety, age-appropriate services and legal duties. We do not knowingly direct behavioural advertising to children or ask a child to submit a booking enquiry independently.

A parent or lawful guardian may exercise rights on a child’s behalf, subject to appropriate verification and the child’s own rights under applicable law.

For business travel, we may process employer, role, cost centre, travel policy, invoice and booking-management information. The employer or travel manager and Asfour may each be separate controllers for their own purposes.

For group bookings, a coordinator may receive attendance and booking-status information necessary to manage the group, but should not receive private complaint, accessibility or incident information without authority and necessity.

Property owners and partnership contacts may provide business contact details, ownership information, due-diligence records and communications. Those records are used to evaluate, negotiate and manage a possible business relationship and comply with legal checks.

Promotional email, SMS or WhatsApp will be sent only with consent or another verified lawful basis. Every electronic marketing message will provide an appropriate way to opt out. Withdrawing marketing does not stop essential booking or safety communications.

If Asfour Circle membership is activated, its sign-up notice will explain the profile, benefits, communications and retention involved. Merely viewing the membership page does not create an account.

We may invite Guests to complete a survey or review. Participation is voluntary. A review will be published with the name or profile information explained at submission. Incentives, moderation and sharing with a review platform will be disclosed.

At present, Asfour does not intentionally operate non-essential advertising or behavioural-analytics cookies on this pre-launch site. The hosting, access-control and security layer may use strictly necessary cookies or similar storage to deliver and protect the site.

Before optional analytics, advertising, personalisation or embedded-media cookies are enabled, we will publish a cookie register identifying the name, provider, purpose, category and duration, and will provide a consent control where required. Refusal of optional cookies will not prevent a basic enquiry.

A property may use clearly signposted cameras at entrances and shared areas where lawful, necessary and authorised. Cameras must never be placed inside accommodation Units, bedrooms, bathrooms or other spaces where a Guest reasonably expects privacy.

A property-specific CCTV notice must identify the operator, purpose, coverage, retention, recipients and contact. Footage may be preserved longer when required for a documented incident, legal request or claim.

Access-control logs may show when a credential is issued or used. Smart locks, noise sensors or other connected devices will not be introduced without a privacy and security assessment and clear disclosure. Noise monitoring, if ever used, should measure levels rather than record conversations.

We disclose only the data reasonably necessary for the recipient’s role. Potential recipients include the Accommodation Provider, authorised property staff, owners with a legitimate operational need, and selected providers of hosting, email, payments, PMS, CRM, identity checks, communications, cleaning, maintenance, security and professional advice.

Data may also be shared with an authorised corporate Booker, insurer, auditor, bank, lawyer, court, police, tourism, immigration, tax or other authority where required or lawfully necessary.

We do not sell personal data for money and do not currently share it for cross-context behavioural advertising. Major processors must be named here or in an accessible provider register before they go live. Contracts, confidentiality and access controls will be used according to the recipient’s role.

Asfour is proposed to be based in Qatar and intends to operate across countries, so data may be accessed or stored outside the country in which it was collected. The actual processing locations must be mapped before launch.

Where EEA, UK or other protected data is transferred internationally, we will use an adequacy decision, approved standard contractual clauses, binding legal exemption or another valid mechanism, with a transfer-risk assessment and supplementary safeguards where needed.

Moroccan foreign-transfer requirements and any required CNDP authorisation must be completed before transferring protected data. You may request information about the applicable safeguard by emailing the privacy contact, subject to lawful confidentiality redactions.

We keep data only for the shortest period reasonably required for its purpose, legal retention, security and claims. The following are proposed maximum defaults; the implemented schedule must be verified against each operating country and system:

Deletion from live systems may be followed by expiry from encrypted backups on a documented rolling cycle. When data must be kept for law or a claim, use for unrelated purposes is restricted.

We use or require proportionate technical and organisational measures appropriate to the risk. These may include role-based access, least privilege, multi-factor authentication, encryption in transit, secure configuration, logging, backups, processor review, staff confidentiality and incident procedures.

No internet or storage system is completely secure, so we do not promise absolute security. Guests should use approved channels, protect access codes and notify us of suspected compromise.

A suspected personal-data breach will be contained, investigated, documented and assessed. The competent authority and affected individuals will be notified when applicable law requires, within the required period and with the information then available.

Asfour does not currently use solely automated decision-making that produces legal or similarly significant effects on a Guest. The current enquiry is reviewed through ordinary email communication.

Technical security or future payment tools may generate risk indicators for human review. If a future system makes a significant decision solely by automated means, we will explain the logic in meaningful terms, the expected consequences and the right to human review or challenge where required.

We do not create profiles that infer religion or intimate relationships for property-rule enforcement.

Depending on applicable law, you may have rights to information, access, correction, deletion, restriction, objection, portability and withdrawal of consent. Under the GDPR, you may object at any time to direct marketing and may object to legitimate-interest processing on grounds relating to your situation.

Send a request to privacy@asfourstays.com and describe the data or relationship concerned. We may verify identity, ask for clarification or use an authorised-agent process. We ordinarily do not charge a fee, except where law permits a reasonable fee for manifestly unfounded or excessive requests.

Under the GDPR, a response is generally due within one month, subject to a lawful extension. Other jurisdictions may set different periods. A request may be limited where necessary to protect another person, comply with retention law, preserve legal privilege, secure systems or establish and defend claims. We will explain a refusal where required.

You may complain first to the privacy contact so we can investigate. You also have the right to complain to the competent privacy or data-protection authority in the jurisdiction available to you.

For Moroccan processing, the relevant regulator is the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP). Qatar processing is subject to the competent authority under its personal-data privacy framework. EEA residents may contact the supervisory authority of their habitual residence, workplace or the place of the alleged infringement.

Verified postal, web and representative details will be inserted before launch. Contacting us does not remove a right to approach an authority or court directly.

Links may lead to external maps, messaging, payment, travel or social-media services. Those organisations determine their own processing and should be reviewed through their privacy notices.

When you interact with an Asfour social profile, the platform may process account, device and engagement information and may act as an independent or, for limited analytics, joint controller. We receive only the data the platform makes available under your settings.

A booking made through an online travel agency is also governed by that agency’s policy. We receive the booking information needed to provide the stay and return status or service information through the authorised channel.

If an Asfour business or property operation is financed, reorganised, sold or transferred, relevant personal data may be disclosed under confidentiality for due diligence and transferred to a successor where lawful.

The recipient may use the data only for compatible purposes unless it provides a new notice and lawful basis. We will give notice of a material controller change where required.

We may update this policy when services, providers, properties or laws change. Material changes will be highlighted or otherwise notified where required. The update date identifies the current online version; the policy accepted or supplied for a historical processing event may be archived for evidence.

Before the first public booking, this draft must be replaced by a counsel-approved version naming the verified entities, vendors, countries, retention periods, registrations and complaint routes. A cosmetic removal of the draft label is not a substitute for that work.