Privacy policy

Site operator

bookotil.com is operated by:

Data controller

The company named above determines the purposes and means of processing the personal data collected on bookotil.com and in the bookotil app. For any question about your data, write to us at the contact address above.

Data collected

To book: first name, last name, e-mail address, telephone number, country of residence and language.

To pay: card details are entered directly with our payment provider and never pass through our servers. We keep only the card brand and its last four digits, so that a payment or a refund can be identified.

In use: dates and destinations searched, pages viewed, past bookings, messages exchanged with our customer service or with the property, reviews left, and technical data (IP address, device type, browser language).

We collect no sensitive data, and we never ask for a passport number or an identity document: the documents required on arrival are shown to the hotel, not to us.

Purposes and legal bases

To perform the contract: process the booking, the payment, the change, the cancellation and the refund, pass the property the information it needs for the stay, and provide customer service.

To meet our legal obligations: accounting, tax, fraud prevention.

Legitimate interest: keeping the service secure, preventing abuse, measuring and improving how the site works.

Consent: measurement cookies, and sending commercial offers. You can withdraw it at any time, with no effect on your bookings.

Recipients

The property booked, which receives the information it needs to welcome you: name, dates, room type, number of guests and any special requests. It receives neither your card details nor your travel history.

Our payment provider, for taking payment and issuing refunds. Our technical providers for hosting, e-mail and notifications, acting on our instructions and on our account alone.

The authorities, where the law requires it. Your data is never sold or rented.

Hosting and transfers

Data is hosted on infrastructure located in the European Union.

A booking in an Algerian hotel necessarily involves passing the stay details to that property, located in Algeria — a country not covered by an adequacy decision. That transfer is the strictly necessary one required to perform the contract you entered into.

Retention

Booking and payment data is kept for as long as our accounting and tax obligations require. Inactive traveller accounts and browsing data are deleted after three years. The choice you express on measurement cookies is kept for six months, after which you are asked again.

Your rights

You have the right to access, correct, erase, restrict, object to and port your data, and to withdraw your consent at any time.

Write to the contact address above: we reply within 30 days. If our answer does not satisfy you, you may lodge a complaint with the data protection authority competent for the company named above, or with the one in the country where you live.

Your account, and deleting it

You can delete your traveller account at any time from the "My account" page, without going through us. Deletion is immediate and final.

Two consequences to know before asking for it. The reward-points balance attached to the account is deleted with it and cannot be restored. Bookings already made, on the other hand, do not disappear: they are accounting records, for us and for the hotels, and are kept for the period stated above. They remain accessible using the booking reference and the e-mail address used.

Security and cookies

The whole site is served over HTTPS. Payments are processed by a PCI-DSS certified provider and card details never touch our servers. Access to your account is by a single-use code sent to your e-mail address: there is no password to remember, and none to lose.

How cookies and trackers are used is described in our cookie policy.