Last updated: October 2026
Bytnaa operates a booking platform for Syria — stays, restaurants, gathering places and car rental. This policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and the rights you have over it. It applies to guests, hotel owners and visitors to bytnaa.com.
The controller of your personal data is Aqlomate (Chamber of Commerce 84461772), trading as Bytnaa, Box G1338, Strevelsweg 700/303, 3083 AS Rotterdam, Netherlands. You can reach us at [email protected] for anything to do with your data. When you complete a booking, the hotel you booked also becomes a controller of the data it needs to host you, and handles that data under its own responsibility; write to us and we will pass on what concerns the hotel.
From guests: full name, phone number, email address (optional), booking dates, number of guests and any special requests. From hotel owners: your name, contact details, property details, licence information and bank or transfer details for payouts. From everyone: technical data such as IP address, browser and device type, pages visited, and your language and currency preference. We do NOT store your card number: card payments are entered on the payment provider's own page and we only receive confirmation that a payment succeeded, plus the last digits and card brand.
To perform your booking contract: name, phone, dates and payment status — without these a booking cannot exist. For our legitimate interest in running a safe platform: technical logs, fraud prevention and service improvement. With your consent: marketing emails and the newsletter, which you can withdraw at any time. To meet legal obligations: keeping accounting records and responding to lawful requests from Syrian authorities.
The hotel you book, which receives your name, phone, dates, guest count and any requests — it needs these to hold your room. Because the hotels are in Syria, a country without an EU adequacy decision, that transfer is made under art. 49(1)(a) and (b) GDPR: it is necessary to perform the booking contract you asked us for, and we send only what the hotel needs. Our processors, who act only on our instructions: Hetzner (servers in Germany), Cloudflare (traffic protection), Zoho (email, EU data centre) and, for card payments, the payment provider. We never sell or rent your data.
Access is restricted by role. Staff accounts are granted only the specific permissions their work requires — for example, someone who edits hotel listings cannot open financial records, and only the platform owner can access payout and settings data. Administrative actions are recorded in an internal activity log.
If you publish a review after a stay, your first name, rating and review text become publicly visible on the hotel's page. Do not include information in a review that you do not want to be public. You may ask us to remove your review at any time.
If you are a hotel owner and sign a partner agreement on the platform, we record your typed name, your job title and any ID or registration number you supply, together with the time of signature taken from our server, your IP address and your browser identifier, and a digital fingerprint of the contract text. This record exists to prove who signed what and when, and is retained for the life of the agreement plus ten years for evidentiary and accounting purposes. If you delete your account, the agreement and its signature record are deleted with it.
We use cookies that are necessary for the site to work: keeping you signed in, remembering your chosen language and currency, and protecting forms against abuse. These cannot be switched off without breaking the site. We do not use advertising cookies. You can clear or block cookies in your browser, but you will then be signed out and your preferences will reset. To see how the site is used we count visits ourselves, without cookies and without any outside analytics service: for each page view we record the page, the site that sent you (for example Google), your approximate country and your device type. Your IP address is never stored; it is only combined with a key that changes every day into an anonymous code, so a visit can be counted once per day but can never be linked to you or followed from one day to the next.
Booking records: ten years from the booking date, as commercial and tax records require — unless you delete your account, in which case your bookings are deleted with it. Account data: for as long as your account exists. When you delete your account we immediately delete everything attached to it, including your bookings, reviews, messages and any place you list; a copy remains only in our server backups until newer backups replace it. If you ask us by email instead, we carry it out within 30 days. The steps are on the “Delete account” page. Technical logs: twelve months. Anonymous visit statistics: thirteen months. Newsletter subscriptions: until you unsubscribe. Contract signature records: as described in section 7.
Your data is stored on servers in Germany, inside the EU. We protect it with encrypted connections (TLS), hashed passwords, two-factor authentication on administrator accounts, permission-limited staff access, logging of administrative actions, firewalling and automatic security updates. Access to booking and account data is limited to the people who need it for their work. No system is perfect: if a data breach nonetheless affects your rights, we report it to the Dutch Data Protection Authority within 72 hours and inform you where the law requires it.
You may ask us for a copy of the data we hold about you, to correct anything inaccurate, to delete your data, to receive it in a portable format, to restrict or object to processing, and to withdraw consent at any time. Write to [email protected] and we will respond within 30 days. If we cannot act on a request — for example because a booking record must be retained for tax law — we will explain why. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl), or with the supervisory authority of the country where you live.
The platform is not intended for anyone under 18. We do not knowingly collect data from children. A booking that includes children is made by the responsible adult, who provides only the number and ages of the children travelling. If you believe a child has given us data directly, contact us and we will delete it.
We do not make automated decisions that have a legal or similarly significant effect on you. Search ranking and recommendations are based on relevance, price, availability and ratings, and never restrict your ability to book.
We may update this policy as the platform develops. For material changes we will notify you by email or with a notice on the platform before they take effect. The date at the top of the page always shows the current version.
If you have any questions about our privacy policy, or want to exercise any of the rights above, please Contact Us or email us at [email protected]
| Legal name | Aqlomate |
| Trade name | بيتنا — Bytnaa |
| Legal form | eenmanszaak (sole proprietorship) |
| Address | Box G1338, Strevelsweg 700/303, 3083 AS Rotterdam, Netherlands |
| [email protected] | |
| Chamber of Commerce (KvK) | 84461772 |
| VAT number | NL003967425B15 |