1. Who we are
Smart Hospitality d.o.o. ("Smart Hospitality", "we", "us") is a technology company based in Croatia, with offices in Zagreb and Rovinj. We build AI, data and communication software, including a guest communication platform that businesses use to exchange messages with their customers over channels such as WhatsApp, SMS, e-mail and web chat.
We act as a technology provider on the Meta WhatsApp Business Platform. This policy explains what personal data we process, why, and what rights you have. It is written to meet the requirements of the EU General Data Protection Regulation (GDPR) and the Meta Platform Terms.
Contact for all privacy matters:
2. Our role: controller and processor
We are the data controller for personal data we collect for our own purposes — for example when you contact us, visit this website, or when a business signs up as our client.
We are a data processor when we handle messages and customer data on behalf of the businesses that use our platform (our clients, such as hotels and other hospitality operators). In that case the business is the controller, decides why the data is processed, and is your first point of contact. We only process that data on the client's documented instructions and under a data processing agreement.
3. Data we collect
Website visitors
- This website does not use analytics, advertising or tracking cookies.
- Your language choice (EN / HR) is stored only in your own browser's local storage and is never sent to us.
- Our hosting provider may keep standard server logs (such as IP address, browser type and time of request) for security and reliability.
- If you contact us, we receive the details you choose to send — typically your name, organisation, e-mail address and message.
Business clients
- Contact and account details of client staff: name, business e-mail, phone number, role and login credentials.
- Business details needed for contracts, invoicing and support.
Data received through Meta and WhatsApp
When a business connects its WhatsApp Business Account to our platform (for example through Meta Embedded Signup), we receive and store:
- WhatsApp Business Account ID, phone number ID, display phone number, verified business name and related account settings.
- Access tokens and permissions granted by the business, used solely to operate the connected account on its behalf.
- Message templates and their approval status.
When people message a business that uses our platform, we process on that business's behalf:
- Phone number and WhatsApp profile name.
- Message content, including text, images, documents, audio and location that the person chooses to send.
- Message metadata such as timestamps and delivery and read status.
- Details the business adds to the conversation, such as booking dates, room or reservation number, language preference and service requests.
4. How we use data
- To deliver, receive and display messages between businesses and their customers.
- To provide AI-assisted replies, summaries, translation and task routing that the business has enabled.
- To connect and manage WhatsApp Business Accounts, phone numbers and message templates on a client's behalf.
- To provide support, keep the service secure, prevent abuse and fix errors.
- To respond to enquiries and manage our business relationships.
- To comply with legal, accounting and tax obligations.
We do not sell personal data. We do not use data received from Meta or WhatsApp for advertising, to build profiles of individuals, or for any purpose other than providing the service the business has requested. We do not share it with data brokers.
5. Legal basis
- Performance of a contract — to provide our services to clients and to handle requests you make.
- Legitimate interests — to secure and improve our services and respond to business enquiries, balanced against your rights.
- Legal obligation — to meet accounting, tax and regulatory requirements.
- Consent — where required, for example for marketing messages; you can withdraw consent at any time.
When we act as a processor, the business using our platform is responsible for having a valid legal basis, including any opt-in required by WhatsApp's Business Messaging Policy.
6. AI processing
Some features use large language models to draft or send replies based on the business's own knowledge base. Message content is sent to our AI provider only to generate a response. Under our provider's API terms, this data is not used to train their models. Businesses decide whether AI replies are enabled, and staff can take over any conversation.
8. International transfers
Some of our providers process data outside the European Economic Area, including in the United States. Where this happens, we rely on an adequacy decision (such as the EU–US Data Privacy Framework) or the European Commission's Standard Contractual Clauses, together with appropriate safeguards.
9. How long we keep data
- Conversation data is kept for as long as the business uses our platform, or shorter if the business sets a shorter period, and is deleted or returned within 90 days after the contract ends.
- Meta access tokens are deleted as soon as a business disconnects its account or ends its contract.
- Enquiries and business correspondence are kept for up to 3 years after our last contact.
- Invoicing and accounting records are kept for the period required by Croatian law (generally 11 years).
10. Security
We use encryption in transit (HTTPS/TLS), encrypted storage for credentials and access tokens, role-based access controls, authentication for all platform users, and logging of administrative access. Access to personal data is limited to staff who need it to provide the service. If a personal data breach occurs, we will notify affected clients and, where required, the supervisory authority without undue delay.
11. Your rights
Under the GDPR you have the right to access, correct, delete, restrict or object to the processing of your personal data, the right to data portability, and the right to withdraw consent at any time. To exercise these rights, contact us by e-mail. We will respond within one month.
If your request concerns messages you exchanged with a business that uses our platform, we will forward it to that business and assist them in responding.
You also have the right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP, azop.hr) or the supervisory authority in your country.
12. Data deletion instructions
You can ask us to delete your personal data at any time, including data we received through Meta or WhatsApp.
- Send an e-mail with the subject "Data deletion request" to the address below.
- Include the phone number or e-mail address linked to your data and, if you know it, the name of the business you were in contact with.
- We will confirm your request and complete the deletion within 30 days, unless we are legally required to keep certain records. We will tell you if that is the case.
- Businesses can disconnect their WhatsApp Business Account from our platform at any time, or remove our app in Meta Business Settings. Associated access tokens are then deleted, and remaining account data is deleted on request.
- To stop receiving WhatsApp messages from a business, reply STOP or block the business in WhatsApp.
13. Children
Our services are intended for businesses and adults. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.
14. Changes to this policy
We may update this policy when our services or legal requirements change. The date at the top of this page shows when it was last revised. Material changes will be communicated to our clients directly.
15. Contact
Smart Hospitality d.o.o.
Zagreb and Rovinj, Croatia