Privacy

1. What data do we process?

We process only the data we need to operate the XoXo website, handle bookings, provide accommodation and support our guests. This may include:

• name, contact details and booking number
• booking and stay details, such as dates, overnight guests, selected rate and payment status
• information required for online check-in and identity verification
• customer-service messages and information you voluntarily provide to us
• payment transaction identifiers and payment status; payment service providers process card details and we do not store full card details on this website
• technical and security server logs
• with your consent, website and booking-journey analytics such as pages, events, browser/device type, referrer and campaign identifiers.

2. Purposes & legal bases

3. XoXo & sensitive information

XoXo is a sex-positive adults-only accommodation brand. An ordinary booking does not require information about sexual orientation, sex life or other special-category personal data. We do not use your booking to infer such characteristics or for personalised advertising. Please avoid including unnecessary sensitive information in free-text messages.

If you need a health- or accessibility-related arrangement, please share only the information genuinely needed to arrange the requested service with customer service.

4. Where does the data come from?

Most data comes directly from you when you book, complete online check-in, contact us or use the website. If a booking is made through a booking channel or partner, we receive the information required to manage that reservation from the relevant service.

5. Service providers & recipients

We use trusted providers to deliver the service. In particular:

• Mews – booking engine, PMS and payment technology; for hotel guest data Mews generally processes the data on behalf of the accommodation provider
• DigitalGuest – digital guest guide and guest-journey communications
• Google Workspace – business email and communications
• Google Analytics / Google Tag Manager – only if you consent to analytics
• Webbikettu and technical hosting providers – website hosting
• accounting, IT, customer-service and other providers to the extent data is needed to perform their task.

We may disclose data to public authorities where required by law.

6. Transfers outside the EU/EEA

Some providers operate internationally and personal data may in some situations be processed outside the EU/EEA. Where this occurs, transfers are protected as required by applicable data-protection law, for example through an adequacy decision or Standard Contractual Clauses.

7. Retention

We keep personal data only as long as needed for the purpose for which it was collected, and for periods required by accounting, accommodation, tax and other legal obligations or the establishment, exercise or defence of legal claims. Customer-service correspondence is kept for the time needed to resolve the matter and any necessary follow-up.

For consent-based Google Analytics, user- and event-level data is retained for no more than 14 months depending on the property setting; aggregated reports may remain available longer. Your cookie-consent choice is stored for 180 days.

8. Your rights

Depending on the circumstances, you have the right to access and rectify your data, request erasure, restrict processing, object to processing based on legitimate interests, and receive data based on consent or contract in a portable format. You can withdraw analytics consent at any time through Cookie settings.

Send requests to xoxo@stayxoxo.com. We may need to verify your identity before fulfilling a request.

9. Complaints to the supervisory authority

If you believe your personal data is being processed unlawfully, you can lodge a complaint with the Office of the Data Protection Ombudsman in Finland.

10. Automated decision-making

The website does not make decisions about you based solely on automated processing of personal data that produce legal or similarly significant effects.