Privacy Policy

This Privacy Policy explains how Core-Link Technologies Ltd ("Core-Link", "we", "us", or "our") handles personal information in connection with CoreStay, our hotel management platform.

CoreStay helps hospitality businesses manage reservations, front desk operations, guest records, point of sale (POS), inventory, expenses, and business reporting.

This Policy describes our intended privacy practices. The final published version should reflect the actual data collected, integrations enabled, systems used, and legal obligations applicable to Core-Link and its customers.

Depending on how CoreStay is configured and used, the platform may process the following categories of information:

• Account information: administrator and staff names, email addresses, telephone numbers, login identifiers, roles, and account preferences.
• Hotel and business information: property name, room details, reservations, room rates, operational settings, company records, and business contact information.
• Guest information: names, contact details, reservation history, check-in and check-out records, and other details entered by an authorized hotel user.
• Transaction information: POS orders, invoices, payments, refunds, receipts, expenses, and related transaction references.
• Inventory and operational information: stock levels, products, supplier records, stock movements, and operational reports.
• Technical information: device, browser, access, diagnostic, security, and usage information where collected by the platform or its service providers.
• Support communications: information you provide when contacting us for assistance or reporting an issue.

Information may be provided directly by hotel administrators, staff, guests, or business contacts, depending on the features being used.

Information may also be generated when users make reservations, process transactions, update inventory, manage accounts, or interact with the platform.

Where enabled, integrations with payment providers, messaging services, access-control systems, or other third parties may exchange information with CoreStay. The information exchanged depends on the integration and its configuration.

Subject to applicable law, information may be used for purposes such as:

• Creating and administering CoreStay accounts.
• Providing hotel booking, front desk, POS, inventory, expense, and reporting functionality.
• Processing transactions and communicating with payment or other integrated service providers.
• Providing customer support, responding to inquiries, and resolving technical problems.
• Protecting accounts, detecting suspicious activity, preventing fraud, and maintaining system security.
• Maintaining service performance, diagnosing errors, and improving platform reliability.
• Sending service announcements and account-related notices.
• Meeting legal obligations and establishing, exercising, or defending legal claims.

Where applicable law requires a legal basis for processing personal information, the appropriate basis may include performing a contract, complying with a legal obligation, pursuing legitimate interests, or obtaining consent where consent is required.

The relevant basis depends on the information involved, the purpose of processing, and the relationship between Core-Link, the hotel business, and the individual concerned.

Where processing relies on consent, individuals may withdraw that consent subject to applicable law. Withdrawal does not invalidate processing that was lawful before the withdrawal.

Hotels using CoreStay may enter personal information about their guests, employees, suppliers, and other contacts. The hotel is responsible for determining what information it collects and for ensuring that it has an appropriate legal basis and provides any required privacy notices.

Depending on the processing activity and applicable law, a hotel may act as a data controller while Core-Link acts as a data processor when providing the platform. Core-Link may act in a different capacity for certain account administration, security, billing, or business operations.

The parties should document their respective responsibilities in an appropriate data processing agreement where required.

Hotel administrators should restrict staff access to guest information based on job responsibilities and should not collect unnecessary or excessive personal information.

We do not treat personal information as an unrestricted asset. Information may be disclosed where necessary for the purposes described in this Policy, subject to applicable law and appropriate safeguards.

• Authorized hotel personnel who require access to perform their duties.
• Technology and hosting providers that support platform operation, storage, maintenance, and security.
• Payment processors and financial service providers involved in authorized transactions.
• Third-party integrations that a hotel administrator enables.
• Professional advisers, auditors, or insurers where reasonably necessary.
• Public authorities, regulators, courts, or other parties where disclosure is legally required or permitted.
• A successor or transaction partner in connection with a proposed or completed business reorganization, subject to applicable privacy requirements.

CoreStay may store or display transaction records, payment amounts, payment status, receipts, and references needed for hotel operations and reconciliation.

Where payments are processed through an external payment provider, that provider may independently collect and process information under its own terms and privacy policy.

The exact payment information CoreStay handles depends on the integration. Do not assume that card details are stored by CoreStay unless the applicable implementation expressly confirms this.

Hotels should not enter payment card security codes, passwords, or other sensitive authentication credentials into general notes or fields that are not specifically designed to collect them.

CoreStay may use cookies or similar technologies where needed for authentication, session management, security, user preferences, and reliable operation.

If analytics or optional tracking technologies are introduced, the final Policy should identify the relevant technologies, purposes, third-party providers, and available user choices.

You can manage cookies through your browser settings. Blocking essential cookies may prevent some features, including sign-in, from working correctly.

We intend to apply appropriate technical and organizational measures to protect information against unauthorized access, loss, alteration, disclosure, and misuse.

Depending on the deployed service, safeguards may include access controls, password hashing, permission management, secure connections, monitoring, backups, and controlled access to production systems.

No method of transmission or storage can be guaranteed to be completely secure. Users should use strong passwords, protect their devices, limit staff permissions, and report suspected account compromise promptly.

Where a personal data breach occurs, notifications will be handled in accordance with applicable legal requirements and relevant contractual commitments.

Personal information should be retained only for as long as reasonably necessary for the purposes for which it was collected, subject to legal, accounting, security, contractual, and dispute-resolution requirements.

Retention periods may vary by data category. Booking, transaction, and financial records may need to be retained for longer than certain technical logs or support communications.

When an account is closed, deletion, return, export, or continued retention of information will depend on the applicable agreement, technical capabilities, legal obligations, and any legitimate need to preserve records.

The final published Policy should state the actual retention periods or the criteria used to determine them.

Depending on applicable law and your circumstances, you may have rights to request access to personal information, correction of inaccurate information, deletion, restriction of processing, or a copy of information in a portable format.

You may also have the right to object to certain processing or withdraw consent where consent is the applicable legal basis.

Requests involving information controlled by a hotel should generally be directed to that hotel. Requests involving information controlled by Core-Link can be submitted through our official contact channel.

We may need to verify your identity and clarify the scope of a request before responding. Some requests may be limited by legal obligations or other lawful exceptions.

Depending on the hosting infrastructure and third-party services used, information may be processed or stored in locations outside the country where the hotel or individual is based.

Where cross-border transfers are subject to legal requirements, appropriate transfer mechanisms and safeguards must be applied as required by applicable law.

The final Policy should identify relevant processing locations and safeguards based on CoreStay's actual hosting arrangements and service providers.

CoreStay is designed primarily for hospitality businesses and their authorized personnel. Hotel customers are responsible for ensuring that information about children is collected and processed lawfully, only where necessary, and with any required notices, permissions, and safeguards.

Do not enter children's personal information into the platform unless there is an appropriate lawful purpose and the necessary safeguards are in place.

CoreStay may connect to external websites, applications, payment services, messaging providers, or other integrations. These services may have separate privacy practices and terms.

We encourage you to review the relevant third-party policies before enabling an integration. This Policy does not automatically govern information collected directly by an independent third party.

We may update this Privacy Policy as CoreStay evolves, our processing practices change, or legal requirements develop.

Updated versions will be published on this page with a revised date. Where required, we will provide additional notice or seek consent before implementing material changes.

For questions about this Policy or requests concerning personal information handled by Core-Link Technologies Ltd, use the official support or contact channel provided through the CoreStay platform.

Please include enough information for us to understand your request, but never send your password, payment card security code, or other sensitive authentication credentials.

Before publishing this Policy, Core-Link should add its verified privacy contact email, registered business address where appropriate, and any applicable data protection contact details.