1. Data Roles & Tenancy Architecture
Grandeur Royal Technologies Inc. (“Grandeur Royal”, “we”, “our”, or “us”) provides an institutional multi-tenant Property Management System (PMS), POS dining hub, and headless direct booking engine to independent boutique hotels and hospitality groups (“Operators” or “Hotels”).
2. Categories of Information Collected
Depending on whether you are an Operator administrator or a guest reserving through a Grandeur Royal direct engine, we process the following categories:
- Operator Credentials: Full name, professional work email, hashed authentication credentials, staff role entitlements, IP addresses, and operational audit logs.
- Guest Reservation Dossiers: Guest full names, contact emails, phone numbers, arrival and departure timestamps, suite categories, VIP preferences, dietary restrictions, and room folio billing line items.
- Hardware & Telemetry: Offline desktop client version, SQLite replica synchronization timestamps, peripheral status (receipt printers, keycard encoders), and transient network latency metrics.
3. Purposes of Processing & Legal Bases
We process personal information under the following legal bases pursuant to GDPR Article 6:
- Contractual Necessity (Art. 6(1)(b)): To execute and deliver hotel reservations, verify operator accounts, and synchronize room matrices.
- Legal Obligation (Art. 6(1)(c)): To maintain mandatory hospitality fiscal ledgers, tax records, and local police registration compliance.
- Legitimate Interests (Art. 6(1)(f)): To maintain platform security, detect distributed denial-of-service (DDoS) anomalies, and prevent fraudulent booking reservations.
4. Multi-Tenant Cryptographic Isolation
Unlike traditional monolithic hospitality databases where multiple hotels share identical database tables, Grandeur Royal enforces strict row-level tenant key partitioning. Every database query executed through our REST API or offline synchronization daemons includes mandatory tenant boundaries (`property_id`), cryptographically preventing cross-hotel data exposure.
5. PCI-DSS Level 1 Payment Tokenization
Grandeur Royal does never store or inspect raw credit card numbers, CVVs, or primary account numbers (PANs). All direct booking checkouts and POS terminal charges use end-to-end tokenization via PCI-DSS Level 1 certified payment processors (e.g. Stripe, Adyen). Only opaque transaction tokens and card brand identifiers are held on file.
6. Sub-processors & International Transfers
We contract exclusively with enterprise cloud vendors adhering to strict SOC 2 and ISO 27001 standards. International data transfers from the European Economic Area (EEA) and Switzerland are executed pursuant to European Commission Standard Contractual Clauses (SCCs).
7. Data Retention & Erasure
Guest folio and transaction data are retained in accordance with the Operator's contractual instructions and governing tax statutes (typically 7 to 10 years for financial ledgers). Upon termination of an Operator account, all cloud database slices are purged within 30 days following an authorized data export archive.
8. Sovereign Rights (GDPR, CCPA & Swiss FADP)
Depending on your jurisdiction, you have sovereign rights to access, rectify, port, or erase your personal data, or object to specific processing. Because Grandeur Royal processes guest data on behalf of Hotels, guests should submit erasure requests directly to the booked hotel property. We provide automated erasure APIs allowing Operators to execute these requests within 48 hours.
9. Data Protection Officer & Inquiries
For privacy inquiries or compliance auditing documentation, please contact our Data Protection Office: