Privacy Policy

Data controller

HH Hotels Limited, 5th Floor, Edison House, 223-231 Old Marylebone Road, London NW1 5QT — UK. Data controller under UK GDPR for data collected on rezllynx.org and data of our business customers within the scope of our services.

Data collected

• Identification: name, business email, property/group name.
• Billing: billing address, VAT number, payment methods (via Stripe, we don't store card numbers).
• Technical: Rezlynx API token supplied by Customer (encrypted at rest AES-256), API call logs, IP, user-agent.
• Usage: console interactions, dashboards viewed, modules activated.
• Cookies: see Cookie Policy.

Purposes & legal basis

• Contract performance (UK GDPR Art. 6(1)(b)): subscription management, module activation, billing, support.
• Legitimate interest (Art. 6(1)(f)): service improvement, security, fraud detection.
• Consent (Art. 6(1)(a)): marketing newsletters, non-essential cookies.
• Legal obligation (Art. 6(1)(c)): invoice retention, response to judicial requests.

Recipients & sub-processors

Your data is accessible to:

• Our internal team (sales, support, tech) under confidentiality agreement.
• AWS (London eu-west-2 + Dublin eu-west-1) — data hosting.
• Stripe — payment processing.
• Postmark — transactional emails.
• Rezlynx Systems Ltd — only via API calls we make on your behalf with the token you supply.

No data transferred outside the UK / EEA without adequate safeguards.

Retention periods

• Account data: subscription duration + 6 years (legal obligation UK).
• Invoices: 6 years (HMRC).
• Rezlynx API cache: rolling 90 days.
• Connection logs: 12 months.
• Non-essential cookies: 13 months maximum.

Your rights

Under UK GDPR:

• Access: obtain a copy of your data.
• Rectification: correct inaccurate data.
• Erasure: request deletion of your data.
• Objection: object to legitimate-interest processing.
• Restriction: restrict certain processing.
• Portability: receive your data in a structured readable format.
• Withdrawal of consent any time for consent-based processing.

Exercise your rights by email to dpo@rezllynx.org or Tel +44 7960 258210. Response within 30 days maximum.

ICO complaint

If you believe our processing does not comply with UK GDPR, file a complaint with the Information Commissioner's Office: Wycliffe House, Water Lane, Wilmslow, SK9 5AF — ico.org.uk.

Data security

TLS 1.3 encryption for all communications. API tokens encrypted at rest AES-256 in our vault. Full audit log of each API call. ISO 27001 certification in progress (Q4 2026).

Policy changes

Any material change will be notified by email to active customers 30 days before application, and published on this page with updated date.