Privacy policy

1. Who we are

Tampu is a service of NEKATEKLABS S.A.S. («Nekatek Labs»), tax ID (RUC) 1999320380001, located at calle Padre Juan González y González Suárez S/N, Zamora, Zamora Chinchipe province, Ecuador. Contact: hola@nekateklabs.com.

Tampu is a management platform for inns (hosterías): bookings, front desk, rooms and housekeeping, the guest bill with SRI electronic invoicing, and the inn’s spaces (restaurant, pool, parking, event halls and nightclub). It is used by inns and similar businesses («client businesses»). We process data under Ecuador’s Organic Law on Personal Data Protection.

2. Our role

The data of a business’s guests, visitors and customers (bookings, guest register, bills, orders, pool or nightclub entries, vehicle plates) is the responsibility of that business. Nekatek Labs acts as processor: it handles that data only to provide the service and on the business’s instructions.

For staff accounts and the contact details of client businesses, Nekatek Labs is the controller.

3. What data we process

• Staff accounts: name, email, role and the business they belong to. Sign-in is with email and password or with your Google account.
• Bookings: name of the person booking, mobile number, email (optional), dates, number of guests, rate, deposit, notes and booking channel.
• Guest register at check-in: name, document type and number (national ID, passport or other), nationality and whether the person is a minor.
• Bill and invoicing: charges, payments and the invoice buyer’s details (name or company name, ID, RUC or passport, and email). The electronic invoice is signed and sent to the SRI with the business’s own electronic signature (.p12), which we store encrypted.
• The inn’s spaces: whatever the business records in each module, for example pool entries, parking vehicle plates, event hall bookings and nightclub guest lists.
• QR orders: to confirm a remote order, the customer verifies their mobile number with an SMS code.
• Technical data: service security logs and, to limit abuse of public forms, an encrypted fingerprint (not the plain address) of the IP address.

4. What we use it for

We do not sell personal data or use it for advertising.

• Managing the business’s bookings, rooms, housekeeping, bills, payments and orders.
• Issuing and sending electronic invoices to the SRI, and sending confirmation and invitation emails.
• Showing the information to the business’s authorized staff according to their role.
• Keeping the service secure, preventing abuse and measuring how it performs.
• Billing the client business for the service.

5. Legal basis

We process data to perform the contract with the client business, to comply with legal obligations (such as the guest register and electronic invoicing) and for the legitimate interest of keeping the service secure. Where the law requires it, we will ask for your consent.

6. Who it is shared with

• The business the data belongs to and its authorized staff.
• The SRI, when an electronic invoice is issued.
• Providers that host and process data on our behalf: Google Cloud and Firebase (database, authentication, storage and running the service, on servers in the United States) and Google (sending emails).
• Authorities, when a rule or a valid order requires it.

7. How long we keep it

• Identity data in the guest register: deleted automatically 7 months after check-out. The client business must confirm that this period meets the tourism rules that apply to it.
• Bookings, bills and invoices: for the length of the contract and as long as tax and accounting rules require.
• Staff accounts: while the business keeps them active.

8. Security

Connections are encrypted (HTTPS). Each business sees only its own data and each person sees only what their role allows. The electronic signature key is stored encrypted and is not shown after it is uploaded. No system is infallible; if we detect an incident affecting your data, we will tell the responsible business and the authorities where required.

9. Your rights

You can request access, correction, deletion, objection and portability of your personal data. If you are a guest or customer of an inn, write to the inn first, since it is responsible for your data. You can also write to hola@nekateklabs.com and we will help you pass your request on, or handle it if the data is ours. We will reply within the time limits set by law.

10. Minors

The guest register may include minors, because the rules require registering every person who stays. The business records that data and it is deleted on the same schedule as other identity data.

11. Changes and contact

We may update this policy; the date above shows the latest version. For privacy questions write to hola@nekateklabs.com.