Privacy policy

Who is responsible

The controller for personal data on quub.rent is Carvenience Bookings, Cartesiusstraat 90, 2562 SL Den Haag, Netherlands, KVK 74753525, trading as Quub.rent. Questions and requests go to hello@quub.rent.

When you book

A booking stores the following in the Quub database, on a server in Germany:

• your first and last name, email address and phone number;
• any special request you type;
• the booking details: hotel, room, dates, number of guests, price, cancellation terms, the confirmation numbers and the booking status;
• a one-way hash of your IP address in the booking log, used to limit repeated booking attempts.

Card details are never received or stored by Quub. The card is entered in the payment form of Nuitee (LiteAPI), the booking partner and merchant of record, which processes the payment under its own privacy policy.

The legal basis is the performance of the booking contract (GDPR article 6(1)(b)), and for the booking log the legitimate interest in preventing abuse (article 6(1)(f)).

Who receives booking data

• Nuitee (LiteAPI), to make the booking with the property and take the payment. Nuitee receives your name, email address, phone number, special requests and the booking details.
• The property, which receives your name, the booking details and any special request, to provide the stay.
• Fastmail, which carries the email for hello@quub.rent: the booking confirmation and any messages you send or receive. Fastmail keeps mail on servers in the United States.

No booking data is sold or used for advertising.

When you visit

• Page views and a few named events through Umami, self-hosted, cookieless analytics. See the cookie policy for exactly what it records.
• A click log for buttons to other booking sites: time, partner, destination, area, the page clicked from and a hashed user agent. No IP address is stored. It is used to count which guides are useful and to reconcile partner reports.
• What you type in the search box, to suggest places: it is sent to Nuitee (LiteAPI), which looks it up with Google Places. Your IP address is not sent with it. Quub keeps the suggestions for a day to answer the same text again, with no record of who typed it.
• Standard web server logs, which include IP addresses, kept for security and troubleshooting and deleted on rotation.

Bookings made on another site through a button are governed by that site's privacy policy. Quub receives reports from those sites without names or contact details.

How long data is kept

Booking records are kept for seven years after the stay, the period Dutch tax law sets for business records, and are then deleted. Emails about a booking are kept for the same period. A booking that was started but never paid is deleted after 12 months.

Your rights

Under the GDPR you can ask for a copy of the data held about you, and ask for it to be corrected, deleted or restricted, or object to its use. Deletion can be limited by the legal duty to keep booking records. Write to hello@quub.rent; requests are answered within one month. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

Contact