the site's ai answers you
resources · security & gdpr
guest data,
taken seriously.
Your guests entrust you with their identity, their preferences, their payments. Here is, without jargon, how that data is protected.
request a demohosted in Europe, encrypted everywhere
Your guests' data is hosted in the European Union, encrypted in transit and at rest. Access is logged, backups are daily and tested. The ID document scanned at check-in is kept encrypted for the legal retention period, not a day longer.
- hosting and backups in the EU
- encryption in transit and at rest
- logged access, reviewed regularly
gdpr, applied to the stay
Bowo acts as a data processor under the GDPR: a data processing agreement (DPA) covers every client, purposes are limited to the stay and your property's guest relationship, and retention periods are configurable. Access, rectification, erasure: every guest request is handled from the back office, and erasure propagates to the connected systems that support it.
- DPA signed with every client
- guest rights handled from the back office
- configurable retention periods
your data stays yours
Guest data belongs to your property, not to Bowo and not to the OTAs: exports and syncing to your tools at any time, full reversibility if you leave. Payments go through PCI-DSS-certified providers (Stripe, Adyen): Bowo never sees a card number.
- exports and webhooks at any time
- full reversibility at the end of the contract
- PCI-DSS payments via Stripe and Adyen
to go further
DPA, list of subprocessors, technical and organizational measures: these documents are available on request at privacy@hello-bowo.com. Your DPO or security provider can write to us directly, we answer fast and without jargon.
the questions we get asked
where is our guests' data hosted?
In the European Union, backups included. The detail of our hosting providers is in the list of subprocessors, available on request.
who owns the guest data?
Your property. Bowo processes it on your behalf, as a GDPR data processor. It can be exported at any time and is handed back in full if you leave.
what happens to the ID document scanned at check-in?
It is read by OCR to fill in the registration form, stored encrypted for the period required by regulation, then deleted automatically.
do you sign a data processing agreement (DPA)?
Yes, with every client, before go-live. Your DPO can write to privacy@hello-bowo.com to receive it along with the list of subprocessors.
your guests deserve better.
600+ hotels, 28 countries, 13.5 million guests. A personalised 30-minute demo, focused on your property and your priorities.
No commitment.