UKIO

Privacy Policy

Confidentiality and security are core values of Ukio. This means that we are committed to ensuring the privacy of our customers' personal data at all times, and to collecting only the information we need, and no more.

Below you will find all the necessary information about the personal data we collect, how we process it and your rights.

1. Who is the data controller?

This Privacy Policy applies to the different companies:

UKIO INC, a company existing under the General Corporation Law of the State of Delaware, registered under tax file EIN 84-4554147 and with its office located at 244 5th Avenue, Suite 1259, New York 10001 (United States of America);

UKIO PORTUGAL, UNIPESSOAL LDA, a Portuguese company with VAT number NIPC: PT516560336 with registered office for these purposes at Avenida 24 de Julho, nº 126, 3º Esqº, 1350-346 Lisbon;

UKIO SPAIN, S.L., a Spanish company, incorporated under number B67627232, with registered office at Calle Balmes, Nº76, 3.º piso, Puerta 1, 08007, Barcelona (SPAIN);

UKIO Germany GmbH, a German company incorporated under the number DE351854741, having its registered office at Hauptsrße 151, 10827 Berlin (GERMANY);

UKIO FRANCE, SAS, a French company registered in the Paris trade register under number 920 663 572, whose registered office is located at 22 boulevard de Sébastopol, Paris, CP: 75008 (hereinafter jointly referred to as 'UKIO').

For the interpretation of this policy, the exchange of data between group companies is considered legitimate, to the extent that controllers are part of a corporate group and may have a legitimate interest in transmitting personal data within the corporate group for internal administrative purposes, including the processing of personal data of customers or employees.

2. Definitions

Website: means http://www.stayukio.com and www.ukio.com and their subdomains.

  • Customer: is the natural or legal person who contracts UKIO's services.

  • Personal data means any information relating to an identified or identifiable natural person; an identifiable natural person is any person who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.

  • Services: means the hospitality services provided by UKIO and described on the Website.

  • User(s): means the visitor to the website and/or the visitor who contacts us through our website.

3. What are the purposes of data processing?

The user is informed that the personal data obtained from our Clients and Users are collected for the following purposes:

  • Technical management of the website to raise awareness of and engage UKIO's services and to develop and test new products and features, monitor performance indicators such as total number of visitors, traffic and demographic data patterns:

    • Data collected: IP address, date and time of access, request content, access status/HTTP status code/volume of data transferred, clickstream, navigation and browsing patterns, browser, language settings, operating system version of the browser software and surface, device type, application version, numeric user ID of the mobile device, as well as the actions you have performed.

    • Legal basis: The basis for processing your personal data derives from the fact that such processing is necessary to provide you with the website functionalities you request (art. 6, 1, b) of the GDPR). If your data were not processed, you would not be able to access these functionalities.

With regard to product development and performance monitoring, the basis for processing is legitimate interest (Art. 6(1)(f) GDPR).

  • Cookies: You can find additional information about why we use cookies and how you can manage them in our cookie policy.

  • Detect, prevent and combat fraud and other illegal activities:

  • Data collected: Strictly necessary data.

  • Legal basis: The basis for processing your personal data is legitimate interest (Art. 6, 1, f GDPR) or legal obligation, if applicable (Art. 6, 1, c) GDPR).

  • Contact forms: If you contact UKIO via the contact form on the website, we will receive your name and email address, as well as any other information you have included in the message. This data is only transmitted by email and is not stored on the website. UKIO will use this data only for the purpose for which you have entrusted it to us:

    • Data collected: Name and surname, e-mail address and any other information you wish to provide.

    • Legal basis: The basis for processing your personal data derives from your consent (Art. 6, 1, a) GDPR).

    • If you do not provide this information, you will not be able to submit this form.

  • Give you access to the reservation system:

    • Data collected: Name and surname, identity card (or passport number, if applicable), expiry date of identity card (or passport), nationality, address of main residence, telephone number, e-mail, reason for travel: Study/Work/Leisure.

    • Legal basis: The basis for processing your personal data derives from the fact that such processing is necessary to provide you with the website functionalities you request (art. 6, 1, b) GDPR).

    • If you do not provide such data, you will not have access to the functionality.

  • Manage the newsletter

    • Data collected: Name and surname, e-mail address.

    • Legal basis: The basis for processing your personal data derives from the fact that such processing is necessary to provide you with the website functionalities you request, i.e. from consent (art. 6, 1, b) GDPR).

    • If you do not provide such data, you will not have access to the functionality.

  • Manage your booking through UKIO:

    • Data collected: Name and surname, ID card number (or passport number, if applicable), expiry date of ID card (or passport), nationality, address of main residence, telephone number, e-mail, reason for travel: Study/Work/Leisure, Credit card details, Annual income received.

    • Legal basis: The basis for the processing of your personal data derives from the fact that such processing is necessary to conclude your rental contract (Art. 6, 1, b) GDPR).

    • If you do not provide this information, the reservation cannot be processed.

  • Monitoring of the rental contract and provision of additional services by UKIO:

    • Data collected: Name and surname, ID card (or passport number, if applicable), expiry date of ID card (or passport), nationality, address of main residence, telephone number, e-mail address, reason for travel: Study/Work/Leisure, Credit card details, Annual income received

    • Legal basis: The basis for the processing of your personal data derives from the fact that such processing is necessary to conclude your rental contract (Art. 6, 1, b) GDPR).

If you do not provide this information, the additional services cannot be provided.

  • UKIO marketing activities:

    • Data collected: Name and surname, E-mail, Reason for travel: Study/Work/Leisure.

    • Legal basis: The basis for processing your personal data is your consent (art. 6, 1, a) of the GDPR).

You may opt out of receiving communications from us at any time by contacting us at privacy@ukio.com.

Personal data obtained through any of the channels of the Website will form part of the Register of Processing Activities (RAT) owned by UKIO. This will be updated periodically in accordance with the provisions of the GDPR. Users are informed of the possibility of withdrawing their consent in the event that it has been granted for a specific purpose, without affecting the lawfulness of the previous processing based on consent prior to its withdrawal.

4. How long will my personal data be kept?

In general, the data are kept for the time necessary to fulfil the purpose for which they were collected and to determine any possible liabilities that may arise from this purpose and from the processing of the data.

Among others, it implies that UKIO retains the personal data of the interested parties for the duration of their relationship with us and, where appropriate, for the period necessary for the formulation, exercise or defence of possible claims, or for compliance with the legal obligations determined by the applicable legislation.

In the case of the data of candidates who send us their applications for selection processes, the data remains at UKIO's disposal for a maximum period of one (1) year. However, the company may keep your name and surname and contact email address for future collaborations without prejudice to the rights of deletion, opposition and limitation of processing that the interested party has. Once this period has elapsed, UKIO undertakes to cease processing the personal data, destroy them or block them as far as possible for the purpose for which they were kept.

If you would like more information about our Data Retention Policy, please contact us at the email address indicated at the top of this Privacy Policy.

5. To home is personal data shared?

Your personal data will not be disclosed to third parties, unless this is necessary to respond to your request, we are required to do so by law or the data subject has given us his or her consent.

We may also disclose data to companies that provide us with services necessary for the ordinary and administrative activities of the company as processors in the context of the provision of services such as, but not limited to, email service providers, web hosting, server hosting, SaaS application services, cloud file archiving and others.

Likewise, UKIO will be able to transfer or communicate personal data in order to comply with its obligations with the Public Administrations in the cases required according to the legislation in force at any time and, if necessary, when required by other public bodies in compliance with national security requirements, public order or security forces and corps, as long as such requests are endorsed by the judicial bodies of the jurisdiction in which UKIO carries out its activity.

As an exception to the above, they may be recipients of personal data from our website:

  • The organisations behind our third party cookies, as can be found in our cookie policy.

  • Our hosting service provider is Amazon Web Services, and your information is stored on their servers located in Frankfurt, Germany.

In connection with the website services, we may share statistical or aggregated data about metrics, clickstream, decision trees, general characteristics of referral requests and any other aggregated data about user activity on the Platform.

In addition, we inform you that, in certain cases, we may provide access to your data to third party companies in their capacity as processors to help us manage our services properly. In this case, UKIO will enter into a contract in accordance with Article 28 of the GDPR.

5.1 International Transfers

It is important to note that some of our suppliers may be based in the United States, be affiliated with an office in the United States or process data in the United States. For this reason, the information we collect from you may be processed in the United States. Following the judgment in case C-311/18 (Schrems II case), the EU "adequacy" judgment was overturned under Article 41 of the GDPR, meaning that your data may not receive equivalent protection in that country to that which it enjoys under the European General Data Protection Regulation.

In this regard, the UKIO is monitoring the transparency documentation published by the above companies and is assessing the complementary mechanisms proposed by them. Further information will be provided as it is made available by the companies and the relevant supervisory authorities. In the meantime, for the use of these services, we rely on the exceptions for specific situations provided for in Article 49 of the GDPR. In particular, to collect and transfer personal data to the United States we will use: your consent (art. 49.1.a) or the performance of a contract (49.1.b). We and our agents strive to implement appropriate safeguards to protect the privacy and security of your personal data and to use it only in ways that are consistent with your relationship with us and with the practices described in this Privacy Policy.

United States

Specifically, the information we collect from you may be processed in the United States. The United States has not yet received an "adequacy" finding from the European Union under Article 41 of the GDPR, which means that your data may not receive the same protection under the GDPR.

Pending further developments in this area, we rely on the exceptions for specific situations set out in Article 49 of the GDPR. In particular, we collect and transfer to the US personal data only with (i) your consent and/or to (ii) perform a contract with you. We and our suppliers apply appropriate safeguards to protect the privacy and security of your personal data and to use it only in accordance with your relationship with us and the practices described in this Privacy Policy.

Please note that transfers to the US are limited and, in particular, transfers from large cloud companies (Google, Youtube, etc.) could be declared illegal by the courts. Therefore, this paragraph should not be understood as a disclaimer that may protect the company in case of inspection, but rather as a gesture of good faith or transparency that allows users to make a better decision.

6. Exercising rights

Your GDPR rights (European Economic Area - EEA)

Any individual has the right to obtain information about what data UKIO is processing. These are your rights:

Data subjects have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, to request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected.
In certain circumstances, data subjects may request the limitation of the processing of their data, in which case they will only be kept for the exercise or defence of claims.
In certain circumstances and for reasons related to their particular situation, data subjects may object to the processing of their data. UKIO will stop processing the data, except for compelling legitimate reasons, or the exercise or defence of possible claims.

Portability: The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to UKIO, in a structured, commonly used and machine-readable form where (a) the processing is based on consent or a contract, and (b) the processing is carried out by automated means.

We inform you of your right to lodge a complaint with the supervisory authority (AEPD) in the event that the exercise of your rights here indicated has not been satisfied.

To exercise the aforementioned rights, please write to privacy@ukio.com indicating the following details:

  • Name and surname

  • Identification number (if applicable per country)

  • Contact e-mail address

  • Right you wish to exercise

  • Data on which you are making your request

  • We will respond to your request within a maximum period of one month, notifying you by e-mail.

Your rights in the UK

The current UK GDPR and the Data Protection Act 2018 provide our UK visitors with the same rights as European citizens. If you are a UK citizen, please contact us at. privacy@ukio.comto exercise the following rights:

  • Be informed about how your data is being used

  • Accessing personal data

  • Incorrect data to be updated

  • Delete your data

  • Prevent or limit the processing of your data

  • Data portability (allows you to obtain and reuse your data for different services)

  • Object to the processing of your data in certain circumstances.

UKIO is paying close attention to the forthcoming "Data Protection and Digital Information Bill" ("DPDI Bill") and will endeavor to ensure that your data protection rights are respected in the UK.

Your CCPA (California Privacy) Rights

Under California law, California residents have the right to request a notice from us identifying the categories of customer personal information that we share with certain third parties for marketing purposes, and providing the contact information for those third parties. If you reside in California and would like to receive a copy of this notice, please send us a written request by email to privacy@ukio.com. You must include in your request the statement "Your California Privacy Rights" and your name, address, city, state and postcode. We are not responsible for notices that are not labeled or sent properly, or that do not contain complete information.

California has passed a law called the California Consumer Privacy Act (CCPA). If the CCPA applies to you, you have the right to:

  • know the categories of personal information collected about you in the previous 12 months, as well as its sources and business purpose;

  • whether and to whom your personal information has been sold or disclosed in the previous 12 months;

  • in case of "sale" of information, the right to object to the sale of your personal information

  • access and delete your personal information (subject to exceptions); and

  • equal service and price (non-discrimination) if you exercise your privacy rights.

"Personal information" means information that identifies, relates to, describes or can be associated with a particular consumer or household. This includes (among other types of personal information) IP addresses, geolocation data, biometric information and "unique identifiers" such as device IDs and cookies, Internet activity information such as browsing history, commercial information such as products or services purchased or consumption histories or trends, and characteristics relating to an individual's race, colour, sex (including pregnancy, childbirth and related medical conditions), age (40 years or older), religion, genetic information, sexual orientation, political affiliation, national origin, disability or citizenship status.

Inferences drawn from personal information "to create a profile about a consumer that reflects his or her preferences, characteristics, psychological tendencies, preferences, predispositions, behaviour, attitudes, intelligence, skills and aptitudes" are also considered "personal information".

Please contact us at privacy@ukio.com to exercise your CCPA rights.

Deletion Request. For identity verification purposes, Inbenta requires any person submitting a deletion request to provide the subject's full name, email address and address in connection with the subject's Inbenta account or Inbenta communications. Inbenta will send a verification email to the requester, who will be required to re-authenticate the deletion request. UKIO relies on this information to ensure that information about the correct person is deleted.

Do not sell my information. We take your privacy seriously. We do not sell our members' information. We are not a data broker.

If you are a California resident, you may request information about Inbenta's disclosure, if any, of your personal information to third parties for their direct marketing purposes. To make such a request, please send an email to. privacy@ukio.com, subject line: CCPA Request.

7. What security measures are in place?

UKIO has adopted the legally required levels of security for the protection of personal data and endeavours to install any other additional technical means or measures within its reach to prevent the loss, misuse, alteration, unauthorised access and theft of personal data provided to the organisation.

LINKS TO OTHER SITES OR SERVICES

UKIO is not responsible for the practices of services linked to our app/website or the information or content they provide to you. Please note that where you use a link from our site to another service, our Privacy Policy does not extend to such third party services and your contact with us will be subject to that third party's own rules and policies.

WHAT IS UKIO'S PRESENCE ON SOCIAL MEDIA?

UKIO has the following profiles on the main social networks (LinkedIn, Instagram, Facebook).

Acknowledges that it is responsible for the processing of the data of its users, followers or persons who make comments through the same. Likewise, in accordance with the Law on information society services and electronic commerce, it is exonerated from any type of liability arising from comments made by users and followers on its social networks.

UKIO may use the profiles described above to inform its users of topics that it considers to be of interest to them.

CHANGES TO THE PRIVACY POLICY

UKIO may, at its discretion, modify or update this Privacy Policy, so we encourage you to review this section periodically. If changes are made that materially affect the content of this Privacy Policy, you will be notified.

Date of last modification: 23.05.2023