Data Policy Framework Privacy Policy

---

Hospitality Holdings LLC (doing business as H2OTA Revenue Recovery) respects your privacy. This Privacy Policy explains how we collect, use, and protect information in compliance with the EU-U.S. Data Privacy Framework (DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.

1. Participation and Compliance

Hospitality Holdings LLC complies with the EU-U.S. DPF, the UK Extension, and the Swiss-U.S. DPF as set forth by the U.S. Department of Commerce. We have certified that we adhere to the DPF Principles regarding personal data received from the European Union, United Kingdom (and Gibraltar), and Switzerland.

To view our certification, please visit the Data Privacy Framework website.

2. Data We Collect

We collect only the following data elements strictly for operational purposes:

• Guest name (as received through third-party booking platforms)
  Check-in and check-out dates
  Virtual Credit Card (VCC) information used for payment processing
   

Note: VCC data is not linked to any identifiable individual and cannot be used to trace or profile a person.
We do not collect sensitive personal data or directly identifiable consumer information.

3. Purpose of Use

This data is used exclusively for:

Revenue recovery and reconciliation on behalf of hotel clients
Identifying and resolving payment discrepancies with online travel agencies (OTAs)
We do not use this data for marketing, profiling, or resale.

4. No Disclosure to Third Parties

Hospitality Holdings LLC does not sell, rent, trade, or share any personal or transactional information with third parties.
All data is handled internally by authorized personnel for the sole purpose of delivering contracted services to our hotel clients.

We may only disclose information if required to do so by law or in response to valid requests by public authorities, including to meet national security or law enforcement obligations.

5. Individual Rights

Although we do not have a direct relationship with individual guests, we respect applicable privacy rights. To access or correct your data (as permitted by law), please contact the hotel or booking platform that processed your reservation. For general inquiries:

Email: privacy@hospitalityholdings.org
Mailing Address: 108 Village Del Lago Lane, St. Augustine, FL 32080, USA

6. Use of Google Workspace

Hospitality Holdings LLC uses Google Workspace for secure business operations, including document management, and data storage. Google Workspace is fully compliant with:

The EU-U.S. DPF
The UK Extension to the DPF
The Swiss-U.S. DPF
 

Google has certified its compliance with the Data Privacy Framework and provides enterprise-grade security controls including data encryption, access control, and audit logging. You can read more about Google’s compliance at:

https://privacy.google.com/businesses/compliance/

Data processed through Google Workspace is protected in accordance with the DPF Principles and is not accessed or shared by Google unless required by law or explicitly authorized.

7. Accountability for Onward Transfers

Because we do not disclose personal data to third parties beyond Google Workspace (which is certified under the DPF), the accountability for onward transfer provision is limited and fully compliant with applicable frameworks. Should this ever change, we will update this policy accordingly.

8. Recourse, Enforcement, and Liability

We are committed to resolving complaints related to our handling of personal data under the DPF Principles. EU, UK, or Swiss individuals with inquiries or complaints should first contact us at:

Email: privacy@hospitalityholdings.org
Mailing Address: 108 Village Del Lago Lane, St. Augustine, FL 32080, USA

In compliance with the DPF Principles, Hospitality Holdings LLC commits to refer unresolved privacy complaints to BBB National Programs, an alternative dispute resolution provider based in the United States.
If you do not receive timely acknowledgment of your complaint from us, or if we have not addressed your complaint to your satisfaction, please visit the BBB Data Privacy Framework Dispute Resolution website for more information or to file a complaint:

 https://bbbprograms.org/dpf-complaints

If your concern still cannot be resolved through the above mechanisms, you may be able to invoke binding arbitration under certain conditions.

We also agree to cooperate with:

The EU Data Protection Authorities (DPAs)
The UK Information Commissioner’s Office (ICO)
The Swiss Federal Data Protection and Information Commissioner (FDPIC)
 

9. Oversight and Enforcement

Hospitality Holdings LLC is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC).

10. Updates to This Policy

We may revise this policy as needed to reflect legal, operational, or regulatory changes. Any updates will be posted on this page with a new effective date. Last Updated 03-28-2025