1. Data controller
The operator of Brekko is the data controller. Brekko is currently a free, independently operated platform and is not presented as an incorporated company or VAT-registered business. For any personal-data matter, contact [email protected].
2. What data we collect
We process the data you provide when you send a booking request:
- Contact details: first name, last name, email and (if provided) phone number.
- If you join the waitlist: market, city or property of interest, any date and time slot searched, source page and proof of consent.
- Request details: property, date, time slot, number of guests and any children’s ages.
- The consent you give at the time of submission.
- Minimal technical browsing data (see the Cookie Policy), including the page without parameters, device category and aggregate performance metrics.
3. Purposes and legal bases
- To manage and forward your booking request to the property and to send you related communications — performance of pre-contractual measures and of the contract (Art. 6.1.b GDPR) and consent (Art. 6.1.a GDPR).
- To register you on the waitlist and notify you when Brekko launches in the requested market — consent (Art. 6.1.a GDPR), which you may withdraw at any time.
- To provide support and respond to your requests — legitimate interest in managing the relationship (Art. 6.1.f GDPR).
- To measure site usage and performance in aggregate in order to identify technical issues and improve the service — legitimate interest (Art. 6.1.f GDPR).
- To comply with legal obligations — Art. 6.1.c GDPR.
4. How we use booking data
To check that communications work, we record sending and delivery outcomes. Booking emails may contain a small image that signals the first loading of the message: this does not prove that a person read it. This signal is not used for advertising or profiling and does not determine booking confirmation. For this measurement Brekko stores only the first-load timestamp, without cookies, IP address or user-agent. You can prevent external images from loading in your email application settings without losing the ability to book.
The initial request is sent to the selected property and, if you authorised the search for alternatives, to compatible nearby properties. Properties receive the stay details needed to respond, but not your email address or phone number. Only after you accept an offer does the confirmed property receive the guest name needed for check-in.
5. Data recipients
- Technical diagnostics: we use Sentry to detect errors, software version, browser and request timings. For a sample of sessions with errors on public pages, we also collect a technical reconstruction of the page (Session Replay), lasting at most five minutes. Text and fields are masked; forms, restricted areas, booking pages and request contents are excluded. Replay does not continue across pages and does not use cookies or session storage. This data is used to investigate faults, not for advertising or commercial profiling. For information about processing and to exercise your rights: [email protected].
- The accommodation property receiving the request, as an independent controller for managing the stay.
- Providers processing data on our behalf as processors (Art. 28 GDPR): the email delivery service, hosting and infrastructure, and technical service-monitoring tools.
- We do not sell your data and do not share it for third-party marketing purposes.
6. Transfers outside the EU
Some providers may process data outside the European Economic Area. In that case the transfer takes place subject to appropriate safeguards, such as the Standard Contractual Clauses approved by the European Commission.
7. Retention
Technical email copies needed for retries are stored encrypted for at most 30 days. The first-load signal is deleted within 90 days of the communication being created. Early erasure of booking data also removes this associated data.
We keep request data for as long as necessary for the purposes above and in any case no longer than 12 months, after which it is irreversibly anonymised. You may request earlier deletion at any time.
Waitlist data is deleted within 24 months of the latest registration, or earlier if you withdraw consent or request erasure.
8. Your rights
As a data subject you may exercise the rights under Arts. 15-22 GDPR:
- access, rectification, erasure and restriction of processing;
- data portability and objection to processing;
- withdrawal of consent at any time, without affecting processing already carried out;
- lodging a complaint with the competent supervisory authority. In the United Kingdom this is the Information Commissioner’s Office (ICO), ico.org.uk; in Italy, the Garante, garanteprivacy.it.
9. How to exercise your rights
To exercise your rights or for any question write to [email protected]. We will respond within the time limits set by law.
10. Changes
This policy may be updated. The current version is always published on this page, with the last-updated date.