Privacy is not an appendix. It is a condition.

hosp. builds AI systems for hotels, restaurants and resorts. Those systems process guest data: names, stays, preferences, correspondence. We treat that data as the property of the house that entrusts it to us, never as raw material for anything else.

In practice that means: your data does not leave the agreed environment, is not reused anywhere and can be retrieved or deleted at any moment. Every agreement below can be verified and is on paper before we build.

Hosting within the EU is possible. For houses that ask for it, we set up the entire processing on servers within the European Union. That applies to the AI models themselves as well: they then run in a European cloud region, for example through AWS in Frankfurt or Paris. Your data is processed there, does not train the model and is not kept by the model provider after processing. Exactly which models and which regions a system uses is set out in the documentation for that system. Where we work with subcontractors, they are listed in the data processing agreement by name and country of establishment.

No model training on guest data. Your guests' data is not used to train or improve AI models. Not by us, and under our agreements with model providers not by them either.

A data processing agreement as standard. Every system comes with a data processing agreement under article 28 of the GDPR. It governs purpose limitation, security, subprocessors, the duty to report incidents and deletion afterwards.

Data minimisation. Every system is given access only to the data it needs for its task. A system that writes daily reports has no need to read guest profiles, and with us it cannot do so either.

The data remains the property of the house. When a collaboration ends, we hand over all data in a readable, transferable format and delete our copies, with proof of that deletion.

Transparency towards the guest. Where the law requires it, it is clear to the guest that an AI system is helping to write or to think things through. We decide with the house how that notice reads, in keeping with the tone of the brand.

Always human oversight of outgoing communication. Messages to guests are seen by a member of staff before they go out: human in the loop. That changes only once a house decides for itself to let a category of messages go, and the law allows it.

No prohibited or high-risk applications. We build no systems that fall under the prohibited practices of the EU AI Act and no applications in the high-risk categories of Annex III. Our systems support administration and communication; they take no decisions about people.

Documentation for every system. Every system we deliver comes with a dossier: purpose, data flows, models used, human checkpoints and logging. That way your house can show for itself, at an audit or when a guest asks, exactly how guest data is handled.

This website places no cookies that require consent. We measure visits with Vercel Analytics, without cookies and without data that can be traced back to a person. No advertising tracking is running.

If you send us an email, we use your details only to reply. They are not shared and not added to any list.

We answer questions about privacy, the GDPR or the EU AI Act by email at martin.veltman@hospautomations.com. We reply within one working day.

Last updated: 7 July 2026