Privacy Policy
Last updated: 3 October 2026
PA PMS is a property management system for hotels and resorts, run by Punto Asia Spain ("we", "us"). This page explains what personal data we handle, why, and what rights you have. We keep it short on purpose.
Who is responsible
For the account data of the people who use PA PMS and for our own website, Punto Asia Spain is the data controller. For the guest and reservation data that a hotel enters into PA PMS (or that arrives from its booking channels), the hotel is the controller and we act as its processor, only following the hotel's use of the service.
Contact for anything in this policy: puntoasiaspain@gmail.com.
What we collect
- Account data: first and last name, email address, password (stored hashed by our authentication provider, never in plain text) and the name of your hotel, when you sign up.
- Hotel operating data: rooms, rates, reservations, charges, housekeeping and similar information that the hotel's staff enter, import from a file, or receive from a connected booking channel. This includes guest names and, when available, guest email and phone number.
- Messages you send us through the in-app chat.
- Technical data: server logs with the IP address and request details of calls to our API, kept for security and troubleshooting.
- Visit statistics on this website (see "Cookies and analytics").
Why we use it
- To create and secure your account, and to run the service you asked for (contract).
- To send you service emails, such as the notice that your account has been activated.
- To keep the service secure, fix problems and prevent abuse (legitimate interest).
- To understand which pages of our website are useful, with aggregate statistics (legitimate interest).
We do not sell personal data and we do not use it for advertising profiles.
Who processes it for us
We rely on a few service providers to run PA PMS. Each one only handles data to provide its own service:
- Vercel: hosts this website and the web application.
- Supabase: database and authentication.
- A virtual private server that runs our API.
- Gmail (Google): sends our service emails.
- Zodomus and the booking channels a hotel chooses to connect (for example Booking.com or Expedia): only when the hotel enables channel synchronisation, to exchange availability, rates and reservations.
Some of these providers may process data outside your country. We do not share data with anyone else unless the law requires it.
Cookies and analytics
We do not use advertising or tracking cookies. The web application uses only what is needed to keep you signed in. For visit statistics we use a self-hosted analytics tool (Umami) that does not use cookies and does not store your IP address, so we do not need a cookie banner for it.
Contacting hotels about PA PMS
We may email hotels and resorts to tell them about PA PMS, using business contact details that the hotel itself has published. Every such message can be answered with a request to stop, and we will not contact that address again.
How long we keep data
Account and hotel data are kept while the account is active. When a hotel is deleted from PA PMS, its data is deleted with it. Server logs are kept only for as long as needed for security and troubleshooting. We may keep a limited record where the law requires it.
Your rights
You can ask us to access, correct, delete or export your personal data, to restrict or object to its use, and to withdraw consent where we rely on it. If you are a hotel guest, please contact the hotel first, since it controls your reservation data; we will help the hotel respond. Write to puntoasiaspain@gmail.com. If you believe we have mishandled your data you can also complain to your local data protection authority.
Security
Traffic is encrypted over HTTPS, hotels can only access their own data, and access to the service requires an approved account. No system is perfectly secure, so we also review and update it regularly.
Changes
If we change this policy in a meaningful way we will update the date above.