Opally

GDPR overview

Opally ApS runs a dedicated GDPR page stating that it complies with the EU General Data Protection Regulation and Danish data protection law. It takes a dual role: processor for the hotels whose guest data it handles, controller for staff accounts, billing and logs. An Article 28 data processing agreement is concluded with every hotel and published as a downloadable PDF. The list of sub-processors is not published, but the company says it will supply it on request. Rights are spelled out - access, rectification, erasure, restriction, portability, objection, withdrawal of consent - through info@opally.dk, answered within one month, with complaints going to Datatilsynet. Transfers outside the EEA rely on the EU-US Data Privacy Framework or standard contractual clauses. No data protection officer is named, and no Article 27 representative applies. Privacy policy updated 30 July 2026, GDPR page 14 July 2025.

Who owns the data?

Opally's terms are explicit that the customer keeps full ownership of its Customer Data, including the AI-generated email drafts. Opally owns the platform itself - software, AI models and design - and takes a free, worldwide, perpetual licence over any feedback a customer sends it. Under the GDPR the roles are split: Opally acts as processor when it handles guest data on the hotel's behalf, and as controller for staff accounts, billing and technical logs. A separate data processing agreement is signed with every customer and published as a PDF. On termination, customer data can be exported as CSV or JSON, with assistance available for up to 30 days.

Reuse rights

Because the hotel owns both its Customer Data and the AI drafts, it can reuse, edit, send and export that content freely, with no permission to ask for. Opally itself uses personal data for a declared set of purposes: running the service, support, billing and accounting, security and abuse prevention, product development and analytics, and marketing where consent has been given. The legal bases cited are contract, legal obligation, legitimate interest and consent. The company states it never sells personal data, and that product development works on anonymised or aggregated data where possible. Guest emails are not stored at all; AI drafts are kept only when the Learning feature is switched on and the hotel has accepted it, so personalisation stays under a control the customer can flip. Voice calls may be recorded and transcribed, and informing callers is the hotel's responsibility. Transfers outside the EEA rely on the EU-US Data Privacy Framework or standard contractual clauses.

Data retention & training

Hosting summary

Opally states that data is stored in European data centres with a GDPR focus, but it never names a country, a specific region within the EU or a hosting provider: the claim stops at "the EU". Encryption is TLS 1.2+ in transit and AES-256 at rest. Access is controlled through Admin and Staff roles with multi-factor authentication, and the API keys and tokens for connected customer systems are stored encrypted. The GDPR page adds regular backups and system monitoring. Two storage choices matter as much as the location: guest emails are not stored at all, and AI drafts are retained only when the Learning feature is switched on. Transfers outside the EEA - the United States being the case cited - are covered by the EU-US Data Privacy Framework or standard contractual clauses, so EU storage should not be read as a guarantee that nothing ever leaves the bloc. Opally ApS is established in Denmark, and Datatilsynet is the supervisory authority.