Privacy Policy

1. Data controller

The operator of Brekko is the data controller. Brekko is currently a free, independently operated platform and is not presented as an incorporated company or VAT-registered business. For any personal-data matter, contact [email protected].

2. What data we collect

We process the data you provide when you send a booking request:

• Contact details: first name, last name, email and (if provided) phone number.
• If you join the waitlist: market, city or property of interest, any date and time slot searched, source page and proof of consent.
• Request details: property, date, time slot, number of guests and any children’s ages.
• The consent you give at the time of submission.
• Minimal technical browsing data (see the Cookie Policy), including the page without parameters, device category and aggregate performance metrics.

3. Purposes and legal bases

• To manage and forward your booking request to the property and to send you related communications — performance of pre-contractual measures and of the contract (Art. 6.1.b GDPR) and consent (Art. 6.1.a GDPR).
• To register you on the waitlist and notify you when Brekko launches in the requested market — consent (Art. 6.1.a GDPR), which you may withdraw at any time.
• To provide support and respond to your requests — legitimate interest in managing the relationship (Art. 6.1.f GDPR).
• To measure site usage and performance in aggregate in order to identify technical issues and improve the service — legitimate interest (Art. 6.1.f GDPR).
• To comply with legal obligations — Art. 6.1.c GDPR.

4. How we use booking data

The initial request is sent to the selected property and, if you authorised the search for alternatives, to compatible nearby properties. Properties receive the stay details needed to respond, but not your email address or phone number. Only after you accept an offer does the confirmed property receive the guest name needed for check-in.

5. Data recipients

• The accommodation property receiving the request, as an independent controller for managing the stay.
• Providers processing data on our behalf as processors (Art. 28 GDPR): the email delivery service, hosting and infrastructure, and technical service-monitoring tools.
• We do not sell your data and do not share it for third-party marketing purposes.

6. Transfers outside the EU

Some providers may process data outside the European Economic Area. In that case the transfer takes place subject to appropriate safeguards, such as the Standard Contractual Clauses approved by the European Commission.

7. Retention

We keep request data for as long as necessary for the purposes above and in any case no longer than 12 months, after which it is irreversibly anonymised. You may request earlier deletion at any time.

Waitlist data is deleted within 24 months of the latest registration, or earlier if you withdraw consent or request erasure.

8. Your rights

As a data subject you may exercise the rights under Arts. 15-22 GDPR:

• access, rectification, erasure and restriction of processing;
• data portability and objection to processing;
• withdrawal of consent at any time, without affecting processing already carried out;
• lodging a complaint with the competent supervisory authority. In the United Kingdom this is the Information Commissioner’s Office (ICO), ico.org.uk; in Italy, the Garante, garanteprivacy.it.

9. How to exercise your rights

To exercise your rights or for any question write to [email protected]. We will respond within the time limits set by law.

10. Changes

This policy may be updated. The current version is always published on this page, with the last-updated date.