Privacy Policy

Last Updated: May 9, 2026

1. Who we are

This Privacy Policy explains how Localpepper B.V. (trading as "Viqal", "we", "us", or "our") collects, uses, and protects personal data.

Localpepper B.V.

Barbara Strozzilaan 201

1083HN Amsterdam,

The Netherlands

Chamber of Commerce: 77690184

Contact: info@viqal.com

This policy covers two distinct data flows:

Website visitor data, where Viqal is the data controller (covered in Sections 3 to 7).
Guest and end-user data processed through the Viqal platform, where Viqal acts as a data processor on behalf of our hotel customers (covered in Section 8).

2. Our role under GDPR

For website visitors and direct prospects, we are the Data Controller.

For guest communications processed through the Viqal platform on behalf of a hotel customer, we are a Data Processor, and the hotel is the Data Controller. The terms governing that relationship are set out in our Data Processing Agreement at https://www.viqal.com/data-processing-agreement.

3. Personal data we collect from website visitors

When you visit www.viqal.com, request a demo, sign up, or contact us, we may collect:

Identification data: name, job title, company name.
Contact data: email address, phone number.
Communication data: messages you send us, demo requests, support inquiries.
Marketing preferences: consent and opt-in status.
Technical data: IP address, browser type, device type, operating system, referring URL.
Usage data: pages visited, time on site, click patterns, session duration.

4. How we use website visitor data

We process this data on the following legal bases under GDPR Article 6:

Responding to demo requests, sales inquiries, and support, on the basis of performance of a contract or pre-contractual steps.
Sending product updates and marketing communications, on the basis of consent. You can withdraw consent at any time.
Improving our website and product, on the basis of legitimate interests.
Complying with tax, accounting, and legal obligations, on the basis of legal obligation.
Protecting against fraud and abuse, on the basis of legitimate interests.

5. Cookies and tracking

We use cookies and similar technologies on www.viqal.com:

Strictly necessary cookies: required for the site to function. No consent needed.
Analytics cookies: help us understand how visitors use the site. Consent required.
Marketing cookies: used to measure ad performance and remarketing. Consent required.

You can manage cookie preferences through our cookie banner or by adjusting your browser settings. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

6. Sharing your data

We share website visitor data with the following service providers, all bound by appropriate contractual safeguards:

Hosting and infrastructure: Webflow (website hosting), Amazon Web Services (Frankfurt, EU).
Analytics: Google Analytics, Hotjar.
Sales and marketing: HubSpot.
Professional advisors: lawyers, accountants, auditors when legally required.

We do not sell your personal data.

7. International data transfers

Our infrastructure is primarily EU-based. Where we use service providers outside the EEA, including Google Analytics, Hotjar, and HubSpot, we rely on:

European Commission adequacy decisions where available.
Standard Contractual Clauses (SCCs) approved by the European Commission.
Other appropriate safeguards as permitted under GDPR Chapter V.

You can request a copy of the safeguards in place by emailing info@viqal.com.

8. Guest and end-user data processed through the Viqal platform

When a hotel uses Viqal to communicate with its guests, Viqal processes guest personal data on behalf of the hotel. The hotel is the Data Controller. Viqal is the Data Processor.

8.1 Categories of guest data we process

Guest names and contact details (phone numbers, email addresses).
Booking details (reservation numbers, dates of stay, room information).
Communication content (messages exchanged with the hotel, inquiries, feedback).
Language preferences and conversation metadata.

8.2 Subprocessors we use to deliver the service

Amazon Web Services Inc., for database and infrastructure hosting, Frankfurt, Germany.
OpenAI LLC, for AI-generated message content, EU region.
Twilio Ireland Limited, for WhatsApp and SMS message delivery, Ireland.

The current subprocessor list is maintained in our Data Processing Agreement. We notify hotel customers in advance of any subprocessor changes, in accordance with DPA Section 6.

8.3 Retention

Default retention: 12 months from collection, unless the hotel instructs otherwise or longer retention is legally required.

8.4 Guest requests

If you are a hotel guest with questions about how your data is processed, please contact the hotel directly. They are the Data Controller. We can assist them in responding to your request.

8.5 Internal AI tools

Viqal also uses Anthropic for internal company purposes (such as internal productivity, drafting, and analysis). Anthropic is not used to process guest communications or to deliver the Viqal product to hotels.

9. How long we keep your data

Demo requests and sales inquiries where no contract is concluded: 24 months from last contact.
Customer account data: duration of the contract plus 7 years, in line with Dutch tax law.
Marketing email lists: until consent is withdrawn.
Website analytics (aggregated): 26 months.
Guest communication data processed as a Processor: 12 months default, or as instructed by the hotel.
Backups: up to 90 days after primary deletion.

10. Your rights under GDPR

If you are in the EEA, UK, or Switzerland, you have the right to:

Access: request a copy of the personal data we hold about you.
Rectification: correct inaccurate or incomplete data.
Erasure: request deletion of your data ("right to be forgotten").
Restriction: limit how we process your data.
Portability: receive your data in a structured, machine-readable format.
Object: object to processing based on legitimate interests or for direct marketing.
Withdraw consent: where processing is based on consent.
Lodge a complaint: with your local data protection authority. In the Netherlands, this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

To exercise any of these rights, email info@viqal.com. We will respond within 30 days.

If you are a hotel guest exercising rights regarding data processed through the Viqal platform, please contact the hotel directly. We will assist the hotel in responding.

11. Security

We protect personal data through:

Encryption at rest (AES-256) and in transit (TLS).
Strict access controls on a need-to-know basis.
Regular security audits and access log monitoring.
Daily, weekly, and monthly automated backups.
Disaster recovery procedures with defined RTO and RPO.
EU-based hosting (AWS Frankfurt).

Despite these measures, no system is 100% secure. In the event of a personal data breach, we will notify affected parties and the relevant supervisory authority where required by GDPR.

12. Data Protection Officer

Viqal is not required to formally appoint a Data Protection Officer under GDPR Article 37, as our core activities do not consist of large-scale systematic monitoring of data subjects or large-scale processing of special categories of data. The internal contact for privacy matters is the founders, reachable at info@viqal.com.

13. Children's data

Viqal is a B2B service intended for hotel professionals. We do not knowingly collect personal data from individuals under 16. If you believe a minor has provided us with personal data, contact info@viqal.com and we will delete it.

14. Changes to this policy

We may update this Privacy Policy from time to time. The "Last Updated" date at the top reflects the most recent revision. Material changes will be communicated by email or prominent notice on our website.

15. Contact

For privacy-related questions, requests, or complaints:

Email: info@viqal.com

‍Post: Viqal / Localpepper B.V., Barbara Strozzilaan 201, 1083HN Amsterdam, The Netherlands

‍