1. Two different roles
- For your account, your workspace and your subscription, the publisher of Orkalo is the data controller.
- For the data you manage in Orkalo (guests, service providers, owners), your business (the concierge company, the manager or the host) is the data controller; Orkalo acts as a processor, under the data processing agreement.
Are you a guest, a service provider or an owner? To exercise your rights, first contact the person or company that manages the property; we help them answer you.
2. Data processed
- Accounts: name, e-mail, phone, language, encrypted password, Apple or Google identifier if you use them, login dates.
- Workspace and subscription: company name, activity, number of properties, plan, invoices (the card number stays with the payment provider).
- Properties: address, map position, photos, descriptions, amenities, prices, calendars, access codes.
- Bookings and guests: name, contact details, dates, number of people, amounts, notes, exchanges with the original platform.
- Identity documents and guest forms: only if the host asks for them on the guest page.
- Messages: conversations with guests and the team, attachments.
- Jobs: assigned people, times, photos, comments, and check-in (see below).
- Service providers without an account: name, contact details, personal access link.
- Signed documents: contracts and quotes accepted online, with the name entered, date, time, IP address and document fingerprint.
- Booking payments: amounts and statuses received from the payment provider (never a card number).
- Technical data: IP address, device type, error and security logs; when an account is created, the country of sign-up (country code derived from the IP address with a local database, without keeping the IP address for that purpose).
- Demo requests (website form): first name, email, phone, company, number of properties, message and language.
3. Why, and on what basis
- Providing the service, managing your account and subscription: performance of the contract.
- Invoicing and bookkeeping: legal obligation.
- Securing the service (attempt limits, logs, abuse detection): legitimate interest.
- Telling you about something new or a change in the service: legitimate interest; you can object at any time.
- Processing the data of guests, service providers and owners: on behalf of and on the instructions of your business, which chooses its own legal basis (rental contract, legal obligation for police forms, legitimate interest for check-in…).
4. Location check-in for jobs
When a service provider taps “I’m starting” or “All done”, their position is read once, at that moment, to confirm they are at the property. There is no continuous tracking and nothing in the background.
- Data: position, accuracy, distance to the property, time, IP address.
- Purpose: proof that the job was carried out, for the business that assigned it.
- Legal basis: legitimate interest of that business; it must inform its service providers, whether employees or freelancers.
- Refusal: the service provider can refuse location access on their phone; the action is then recorded without a position, unless the business has made the position mandatory.
- Retention: 12 months, then automatic deletion.
Service providers without an account see this information on their personal link, next to the check-in buttons.
5. How long
- Account: as long as it is open. On deletion, it is anonymised immediately and its access closed; bookings remain in the business's workspace (accounting obligations) with no link to you.
- Workspace data after the subscription ends: export possible for 30 days after the subscription ends, then deletion within 90 days.
- Identity documents: deleted 7 days after departure or cancellation.
- Guest forms (declarations): 6 months after departure.
- Check-ins: 12 months.
- Invoices and signed documents: 10 years for accounting records and bookings.
- Technical logs: 12 months.
- Backups: 30 days, then replaced.
- Demo requests: kept while the request is being handled, 90 days at most, then erased automatically.
6. Who receives the data
Only the people in your workspace, according to the rights you give them, and our support (on request or in case of an incident). We sell no data. We use these providers (processors):
- Server and file hosting: UpCloud Ltd (Finland, servers in the European Union)
- E-mail sending and domain names: o2switch (France)
- Channex: technical connection to Airbnb, Booking.com and other platforms
- Beds24: backup technical connection to the platforms, only if it is enabled for your workspace
- Localoge and Stripe: online booking payments and subscription payment
- Base Adresse Nationale and IGN (France): address search and property positions
- Google (Geocoding): position of properties outside France or not found otherwise
- Apple and Google: sign-in with “Continue with Apple / Google”, if you choose it
The platforms you connect (Airbnb, Booking.com…) receive the data needed for your listings and bookings, under their own rules.
7. Transfers outside the European Union
Some providers may process data outside the European Union (for example in the United Kingdom or the United States). These transfers are covered by an adequacy decision of the European Commission or by standard contractual clauses. Our servers are in the European Union. Other providers are covered by these safeguards. On request, we tell you which safeguard applies to each provider and give you a copy.
8. Security
Encrypted connections, encrypted passwords, session tokens kept in the phone's keychain, app protected by Face ID or fingerprint, identity documents stored separately with restricted access, role-based rights in each workspace, encrypted backups. In case of a data breach, we notify the businesses concerned and, where necessary, the supervisory authority.
9. Your rights
You can ask for access to your data, correction, deletion, portability, restriction of processing, and object to processing based on legitimate interest. Part of this is done directly in the app (My account, account deletion, exports). For the rest, write to informations@orkalo.com; we reply within one month.
If you believe your rights are not respected, you can lodge a complaint with the CNIL (www.cnil.fr) or your local data protection authority.
10. Cookies and storage on your device
Orkalo uses no advertising cookies and no audience measurement tool. The website keeps in your browser (local storage) only what it needs to work: your session, your language, the selected workspace and a few display preferences. The apps keep your session in the phone's secure keychain. These items are essential to the service and do not require consent; they disappear when you log out or clear the site's data.
11. Contact and changes
Data controller: Keddy Girel Andamba Gnegne, sole trader, 5 Rue Sarret de Coussergues, Résidence Jules Verne, 34300 Agde, France (see legal notice). Data protection officer: not appointed (not mandatory); requests are handled directly by the controller at informations@orkalo.com.
This policy may change; the version date is shown at the top of the page and you are notified of any significant change.