1. Scope
This policy covers the website htools.gr, communication with the HTools – Hotel tools service and the core features of the web and mobile platform. Simply visiting the presentation website does not trigger location collection or give access to hotel data.
A hotel's live installation may have different settings, integrations and active features. The notice your organisation provides for that installation supplements this policy.
2. Roles in processing and contact
For requests submitted on the website and the handling of its own communications, the service provider HTools determines the purpose of processing. For privacy matters you can contact support@htools.gr, and for service information info@htools.gr or +30 211 333 1871.
For data entered and managed by a hotel, the organisation operating the installation generally determines the purposes and acts as the controller. When HTools processes that data on its behalf, the relationship and obligations are set out in the corresponding data processing agreement. This page does not replace that agreement.
If you use HTools as an employee or partner of a property, ask your organisation for the controller's contact details and the specific notice on how your data is used.
3. What data may be submitted or generated
Website and contact
The request form asks for a contact name, phone number and the business's Greek VAT number (ΑΦΜ). Optionally you can add the hotel name, email, number of rooms and a message. The content is forwarded to our contact team to review the request. If required fields are missing, the form cannot be sent.
When you enter the VAT number, we first verify its check digit and then look it up in the European Commission's VIES system, so that the business name and address are shown and filled in automatically. Only the VAT number is sent to VIES, from the htools.gr server. The result of the check is attached to the request our team receives. If the VAT number is not found in VIES or the service does not respond, you can still send the request.
When you connect, server logs may be generated with IP address, time, page address and technical request details, for operation, security and troubleshooting. Do not include passwords, health data or guests' personal details that are not needed for your request in the form.
Operational platform and app
Depending on the active features, an installation may process:
- Account details, roles, links to properties and shift status.
- Fault reports, assignments, comments, photos, checklists and action history.
- Housekeeping tasks, inspections, ad-hoc requests and related timestamps.
- Team messages, technical app data and identifiers for push notifications.
- Room status and occupancy data from active PMS integrations.
- Location data, only when the corresponding app feature is enabled.
The content also depends on what the organisation enters. Avoid photos of people and unrelated personal data in technical reports.
4. Purposes and legal bases
- Demo or quote request: reviewing the request and related communication. The basis may be pre-contractual measures where it concerns the data subject themselves, or the legitimate interest of responding to business communication from a company representative.
- Providing and supporting the service: performance of the agreement and of the organisation's documented instructions, depending on each party's role.
- Security and technical operation: protecting the service, preventing abuse and investigating errors, based on the relevant legitimate interest where applicable.
- Legal obligations: keeping records required by applicable law.
- Optional marketing communication: requires a separate legal basis and the required opt-out options. Sending the form does not by itself subscribe you to a newsletter.
For processing staff and property data, your organisation determines its own legal basis and provides the required notice. A device permission does not replace that obligation.
5. Location, camera and device permissions
When the location feature is enabled, the mobile app may send geographic coordinates, accuracy and timestamp to coordinate the team during a shift. Depending on version and permissions, the feature may continue in the background when the app is not visible on screen.
The feature is tied to the session and shift status. The app stops sending when the shift ends, on logout and when the installation rejects active access. Revoking location permission in the operating system limits the ability to obtain a new position.
The data is available to users who have the corresponding permissions in the installation. This feature is not intended for advertising targeting. The organisation must define purpose, access and retention and inform staff before using it.
The camera may be used for QR scanning and photo evidence. Notifications require the corresponding permission. Permissions are managed in the device settings; turning them off may limit the related features.
6. Who may have access
Access may be given to authorised members of the support and contact team, the organisation's permitted users and the technical providers needed for hosting, email and service operation. Competent authorities or professional advisers may receive data where there is a relevant obligation or legitimate need.
Active PMS, push or Telegram integrations may transfer the necessary data to the corresponding provider. These integrations are not activated by simply visiting htools.gr. The VAT number you enter in the form is sent to the European Commission's VIES service, solely to check its validity and retrieve the business name and address. The organisation must review the recipients and settings of its own installation.
Where data is transferred outside the European Economic Area, an appropriate mechanism under Chapter V of the GDPR is required, such as an adequacy decision or appropriate safeguards. For details of the specific providers and transfers of your installation, contact your organisation or support.
7. Retention
Contact details are kept based on reviewing and completing the request, the related commercial or contractual relationship and any need for compliance or to support legal claims. Technical logs serve a different purpose from commercial requests. The result of a VIES VAT lookup is cached on the server for up to 24 hours to avoid repeating the same lookup, after which it is replaced or no longer used.
For operational records, photos, messages and shift locations, retention depends on the organisation's documented needs and settings, the contract and any legal obligations. Ask for the specific period or criteria that apply to your installation. Deactivating an account or ending a shift does not mean all earlier records are deleted automatically.
8. Security and access restriction
HTools uses HTTPS on the website and supports checks on identity, roles, property access and permitted actions in the platform. The organisation is responsible for properly managing its users and permissions.
Selected offline actions in the app are stored locally until they sync. Protect the device and do not share it with unauthorised people. Having security measures in place is not a promise that no incident can ever occur.
9. Your rights
Subject to the conditions of the GDPR, you can request access to, rectification, erasure, restriction or portability of your data, object to relevant processing and withdraw consent where it is the legal basis. Not all rights apply in the same way in every case.
Send your request to support@htools.gr or to your organisation's controller if it concerns hotel installation data. Proportionate proof of identity may be needed. A reply is normally given within one month; any lawful extension is communicated together with the reason.
You can also lodge a complaint with the Hellenic Data Protection Authority or the competent supervisory authority.
Contact HTools
For questions or requests about this page, contact support@htools.gr. For service information: info@htools.gr or +30 211 333 1871.