Octorate Privacy Notice
1. Purpose of this page
Octorate S.r.l. is part of the Zucchetti Group. The processing for contracts, marketing and commercial communications is described in the Zucchetti Group’s privacy notice, published at octorate.com/privacy-policy/. This page describes the other processing that Octorate carries out as controller, namely browsing the website, use of the Octorate platform and of the OctoAgent console, and recorded video calls. It also explains how Octorate processes guest data on behalf of properties.
2. Controller and DPO
The controller of the processing described on this page is Octorate S.r.l., Via Filippo Caruso 23, 00173 Roma, tax code and VAT no. 13493861002, email legal@octorate.com, telephone 06 4542 0568. Octorate’s Data Protection Officer (DPO) can be contacted at dpo@octorate.com.
3. Website
When you visit octorate.com we collect technical browsing data, such as IP address, browser, pages visited, date and time, to run the website and protect it from abuse, on the basis of our legitimate interest. If you fill in a form to request information or a demo, the data are processed as described in the Zucchetti Group’s privacy notice. The website’s cookies are described in the Cookie Policy, where you can give or withdraw your consent.
4. Octorate platform and OctoAgent console
For users of Octorate accounts and of the OctoAgent console, we process access and usage data, such as credentials, two-factor authentication codes and access and activity logs, to protect accounts and data and to prevent fraud and abuse, on the basis of our legitimate interest.
The content of support requests and of conversations with the support team is processed to answer the requests, within the contract described in the Zucchetti Group’s privacy notice. In the support chat, an assistant based on artificial intelligence may reply first and passes the request to a human operator when needed.
In the OctoAgent console we use Microsoft Clarity, only with your consent, to understand how the console is used and what to improve. Details are in the console’s cookie notice.
5. Recorded video calls
Video calls with customers and contacts, for example demos, training and support, may be recorded and transcribed to document what was said, on the basis of our legitimate interest. We inform you at the start of the call and you can ask for it not to be recorded.
6. Data of the properties’ guests
When an accommodation property uses the Octorate platform, i.e. PMS, Channel Manager, Booking Engine, OctoAgent and the other modules, the data of guests and of the people who make bookings are processed by Octorate on behalf of the property, which is their controller. Octorate acts as processor under the appointment that the property accepts with the Privacy Annex. The appointment and the Service Processing Record, with the providers, retention periods and security measures, are published at octorate.com/data-processing-agreement/.
If you are a guest of a property that uses Octorate, the privacy notice covering your data is that of the property, which you can contact to exercise your rights. Octorate assists the property in handling the requests. Platform data are stored in data centres located in the European Union.
With the authorisation given by the property in the Terms and Conditions, booking data, their characteristics and geographical data may be extracted by Octorate and by the Zucchetti Group companies in order to be aggregated, anonymised and presented in that form, also with business intelligence and artificial intelligence tools. The data obtained in this way do not make it possible to identify the guests or the property.
OctoAgent replies to the properties’ guests with an agent based on artificial intelligence, on the channels enabled by the property, i.e. WhatsApp, email, messaging on the booking portals and telephone, and always presents itself as an automated system. When the voice module is active, calls may be recorded and transcribed, with a notice at the start of the call.
To generate content, OctoAgent and the platform’s other artificial intelligence features send only the necessary information to models provided by OpenAI, via an application programming interface. For OctoAgent, this information is the property’s knowledge base, the guest’s name and language, the booking data, the conversation, the images sent by the guest and, for online check-in, the image of the identity document with the photograph obscured. OpenAI does not use these data to train its own models and keeps them for a maximum of 30 days for abuse monitoring, after which it deletes them. OpenAI may also process the data in the United States, on the basis of the standard contractual clauses adopted by the European Commission. Octorate does not use the data to train general-purpose artificial intelligence models, and the lessons approved by a property remain in its account.
7. Providers and transfers outside the European Union
For the activities it carries out as controller, including those described in the Zucchetti Group’s privacy notice, Octorate uses providers that process data on its behalf, bound by agreements compliant with Article 28 of the GDPR. Pipedrive (Pipedrive OÜ, Estonia) for managing sales contacts and quotes. Mailchimp (The Rocket Science Group LLC, United States) for sending newsletters. Zapier (Zapier Inc., United States) for transferring data between the website forms and the CRM. Calendly (Calendly LLC, United States) for booking demos. Jotform (Jotform Inc., United States) for online forms. Fireflies.ai (Fireflies.ai Corp., United States) for recording and transcribing video calls. Intercom (Ireland and United States) for the support chat. Microsoft (Ireland and United States) for Microsoft Clarity in the OctoAgent console, only with consent. Google (Google Ireland Limited, Ireland) for Google Analytics and Google Ads and Meta (Meta Platforms Ireland Limited, Ireland) for advertising campaigns, only with the consent given through the cookie banner, managed with CookieYes (CookieYes Limited, United Kingdom).
The providers that process guest data on behalf of properties are listed in the Service Processing Record.
Transfers to countries outside the European Union take place on the basis of an adequacy decision of the European Commission, including the Data Privacy Framework for certified providers, or of the standard contractual clauses, with any supplementary measures that may be necessary.
8. Data retention
Technical browsing data are kept for as long as necessary for the security of the website. Platform logs are kept for the periods indicated in the Service Processing Record. Recordings and transcripts of video calls follow the retention periods of the data of the customer or contact to whom they relate. Data sent to artificial intelligence models are deleted by the provider within 30 days. Cookie retention periods are indicated in the Cookie Policy and in the OctoAgent console’s cookie notice. For other data, the periods indicated in the Zucchetti Group’s privacy notice apply.
9. Your rights
Under Articles 15 to 22 of the GDPR, you have the right to access your personal data, to obtain their rectification or erasure, to request restriction of processing, to object to processing based on legitimate interest, to receive the data in a structured format and to withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
To exercise your rights, write to legal@octorate.com. For processing carried out together with the Zucchetti Group companies, you can also write to ufficio.privacy@zucchetti.it. Octorate’s DPO can be contacted at dpo@octorate.com. We reply within one month of the request, unless the period is extended in the cases provided for by Article 12 of the GDPR.
If you believe that the processing of your data infringes the GDPR, you can lodge a complaint with the Garante per la protezione dei dati personali, the Italian data protection authority (www.garanteprivacy.it), or with the supervisory authority of the country where you live or work.
10. Cookies and newsletter pixels
The website’s cookies are described in the Cookie Policy, and those of the OctoAgent console in the console’s cookie notice. Newsletters sent with Mailchimp contain a pixel that records the opening of the email and clicks on links, to measure the effectiveness of our communications. You can avoid this by disabling automatic image loading in your email program or by unsubscribing with the link included in every newsletter.
11. Security
We adopt technical and organisational measures appropriate to the risk, as required by Article 32 of the GDPR, including encryption of communications, access control with two-factor authentication and daily backups. The measures applied to the platform are described in the Service Processing Record.
12. Changes to this page
We update this page when the processing, the providers or the rules change.