Privacy and cookie policy

1. Who is responsible for your data

Lodging Engine is operated by Eric Adriaan Zwanenburg, an individual (persona física) registered in Mexico with tax ID (RFC) ZAER7212272Q3, domiciled in Querétaro, Querétaro, México. He is the data controller (responsable) for the processing described here.

Contact for all privacy matters, including requests to exercise your rights: info@lodgingengine.com.

2. What this policy covers

This policy covers our website, the travel discovery features, the Academy and free website tools, enquiries and proposals, and the accounts and services we provide to hotels.

It does not cover: (a) websites we build and run for hotels, or guest conversations handled through Guest Engine, where we process data on the hotel's behalf and the hotel's own privacy notice applies; and (b) booking partners' websites, which you reach when you leave our site and which have their own policies.

3. The personal data we collect

We do not ask for sensitive personal data (such as health, religion, or political opinions). Please don't include it in searches or messages.

4. Why we use your data, and on what legal basis

Primary purposes, needed to provide what you ask for:

Secondary purposes, which are not needed for the service and which you can refuse:

You can refuse or withdraw consent for secondary purposes at any time through Cookie settings, the unsubscribe link in our emails, or by writing to us. Refusing does not affect the services you asked for.

5. AI features

When you use the travel search or AI features in the Academy, the text you enter is sent to our AI provider (OpenAI) to interpret your request and generate a response. Under OpenAI's API terms, data sent through the API is not used to train its models by default.

AI-generated recommendations are suggestions only. We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you.

6. Who we share data with

We use service providers who process data on our behalf, under contracts that require them to protect it and use it only for our instructions:

Booking partners. When you click through to a booking partner, you leave our site. The partner receives the information your browser normally sends and, where applicable, an identifier showing that you came from us. We do not send them your contact details.

We may also disclose data when required by law or by a competent authority, to protect our rights or others' safety, or as part of a transfer of the business, in which case this policy continues to apply.

We do not sell personal data for money. Using the Meta Pixel for advertising may count as “sharing” or “targeted advertising” under some US state laws; you can opt out at any time (section 9).

Under the LFPDPPP, disclosures to our providers are remisiones and don't require your consent. We do not make transfers that require your consent.

7. International transfers

We are based in Mexico, and our providers process data in the United States and other countries. When personal data from the European Economic Area, the United Kingdom, or Switzerland is transferred, we rely on the safeguards our providers offer, such as the European Commission's Standard Contractual Clauses or certification under the EU-U.S. Data Privacy Framework. You can ask us for more information about these safeguards.

8. How long we keep data

• Travel search sessions: deleted automatically after 30 days.
• Enquiries and proposals that don't lead to a contract: up to 24 months after our last contact.
• Client and account data: for as long as the service or account is active, then up to 5 years where required for tax and accounting obligations.
• Analytics data: up to 14 months in Google Analytics.
• Your cookie choice: 12 months, after which we ask again.

When data is no longer needed, we delete or anonymise it.

9. Your rights and how to exercise them

To exercise any right, email info@lodgingengine.com with the subject “Privacy request”. Tell us which right you want to exercise and how we can contact you with the answer. We may ask you to confirm your identity. Exercising your rights is free.

Everyone. You can ask us to access, correct, or delete your data, object to its use, and withdraw consent at any time (without affecting processing that took place before).

European Economic Area, United Kingdom, and Switzerland. You also have the rights to restrict processing, to data portability, and to object to direct marketing at any time. We reply within one month, which can be extended by two months for complex requests. You can lodge a complaint with the data protection authority in the country where you live or work, or where an alleged infringement occurred.

Mexico (ARCO rights). You can request Access, Rectification, Cancellation, or Opposition, revoke your consent, and limit the use or disclosure of your data. Your request must include your name and a way to send you the answer; a copy of an official ID (or, if you act through a representative, proof of representation); a clear description of the data and the right you want to exercise; and anything else that helps us locate your data. We tell you our decision within 20 business days and, if your request is granted, carry it out within 15 business days after that. If you are not satisfied, you can go to the Mexican data protection authority (Secretaría Anticorrupción y Buen Gobierno).

United States (California and other states with privacy laws). Depending on where you live, you can request to know what personal information we have collected about you and how we use it, to delete or correct it, and to opt out of the sale or sharing of personal information and of targeted advertising. We don't use sensitive personal information to infer characteristics about you. We will not discriminate against you for exercising your rights. You can use an authorised agent; we may ask for proof of their authority. We reply within 45 days. If we decline your request, you can appeal by replying to our answer; if you remain unsatisfied, you can contact your state's attorney general.

Do Not Sell or Share My Personal Information. Turn off marketing cookies in Cookie settings, or use a browser that sends the Global Privacy Control (GPC) signal: we treat it as an opt-out and keep marketing cookies off.

Open Cookie settings

10. Cookies and similar technologies

Cookies and similar technologies (such as localStorage) store small pieces of information in your browser. We use strictly necessary storage to run the site. Analytics and marketing cookies are only set after you accept them, and you can change your choice at any time. We host our fonts ourselves, so loading the site doesn't send your data to a font provider.

You can also block or delete cookies in your browser settings. Blocking strictly necessary storage may stop parts of the site, such as signing in, from working.

Open Cookie settings

11. Children

Our services are not directed to children. We do not knowingly collect personal data from anyone under 16 (or under 13 in the United States). If you believe a child has given us personal data, contact us and we will delete it.

12. Security

We protect personal data with encryption in transit, access controls, database-level access rules, and by storing IP addresses only as hashes. No system is completely secure; if a breach affects your data, we will notify you and the authorities as required by law.

13. Changes to this policy

We may update this policy when our services or the law change. We publish the new version here with its date and, for significant changes, inform you through the website or by email.

14. Contact

Eric Adriaan Zwanenburg (Lodging Engine), Querétaro, Querétaro, México. Email: info@lodgingengine.com.