Privacy policy

Clarifications updated: 16 October 2026.

Effective date: 19 September 2026.

This Policy explains how Aplus PMS processes personal data through the website apluspms.com, the Aplus PMS service, including its Android and iOS applications, demo and job applications, and connected communication channels, including WhatsApp Business.

1. Who processes data and how to contact us

Where we independently determine the purposes and means of processing, the personal data controller is APLUS UKRAINE LIMITED LIABILITY COMPANY (referred to below as “Aplus” or “we”).

• EDRPOU registration code: 46348908.
• Location: Dnipro, Ukraine.
• Email: info@apluspms.com.

2. Scope and our roles

This Policy applies to website visitors, Aplus PMS users, client representatives, guests and people communicating through connected integrations whose data is processed.

An Aplus PMS client that manages an accommodation property and determines why guest data is used is generally the owner or controller of that data. Aplus acts as a data operator or processor on the client's instructions when providing the PMS, automations and communication channels.

Aplus is an independent data controller for account administration, support, security, service payments, legal compliance and its own business enquiries.

3. What data we process

Depending on the features used, we may process:

• name, telephone number, email address, job title and account details;
• information about accommodation properties, bookings, guests, employees, payments and operational activities that the client adds to Aplus PMS;
• demo, consultation and job application details, CVs, comments, enquiry sources and UTM tags;
• IP address, User-Agent, browser type, login logs, event times, errors, audit logs and other technical and diagnostic data.

For the WhatsApp Business integration, we may also process:

• Meta Business Portfolio, WhatsApp Business Account (WABA) identifiers and phone_number_id;
• the company's WhatsApp telephone number and verified display name;
• encrypted authentication credentials required for the connection;
• the telephone number, WhatsApp ID and profile name of a guest or other person communicating with the property;
• message text, attachments or media metadata, sending and receipt times, delivery and read statuses, and errors;
• approved message templates and their technical metadata;
• links between conversations and bookings created by matching telephone numbers;
• integration security, audit and diagnostic logs.

Do not send passwords, access tokens, payment card details, identity documents or other information that is unnecessary for your enquiry or the service.

In the Aplus Cleaning app, we process the worker’s name and identifier, cleaning tasks, comments and photos the worker takes with the camera or selects from the gallery and uploads, and task execution times and statuses. These data support the organisation and supervision of cleaning and are available to authorised users of the relevant Aplus PMS client. Sections 8 and 9 of this Policy explain retention and how to request deletion.

In the mobile app, notification registration can include a push token, installation identifier, operating platform, account/user identifiers and delivery status. Google Firebase Cloud Messaging and, on iOS, Apple Push Notification service deliver notifications. Permission is controlled in your device settings; disabling notifications does not itself delete the server records.

For passkey login we retain the credential identifier, public key and verification metadata. Face ID, Touch ID or another device confirmation is handled by the device and its credential provider; Aplus does not receive biometric templates.

Data comes from you, the PMS client and its authorised users, connected booking or communication services, and technical events generated while you use the site or app.

4. Why we use data

• to create and maintain accounts, provide Aplus PMS features and technical support;
• to connect WhatsApp Business, send and receive messages, display delivery statuses and manage templates;
• to run automations configured by the client and match conversations to bookings;
• to arrange demos, consultations and trial access, and review job applications;
• to diagnose errors, protect the service and prevent fraud and unauthorised access;
• to maintain accounting records, meet contractual and legal obligations, and defend rights in disputes.

5. Legal bases

Depending on the circumstances, processing is based on performing a contract or taking steps before entering into one, legitimate interests in operating the service securely and conducting business communications, consent, or compliance with legal requirements. Aplus PMS clients independently ensure an appropriate legal basis for processing the data of their guests, employees and people they communicate with.

Account access and requested services relate to performing the relevant agreement; accounting records may be needed to meet legal duties. Security, fraud prevention and handling business enquiries relate to legitimate interests, subject to balancing your rights. Where processing relies on consent, it must be specific to that purpose and may be withdrawn without affecting earlier lawful processing. Visiting the site or accepting service terms is not, by itself, consent to every processing purpose.

6. Who receives data

Only authorised employees and contractors who need access to do their work receive it. To provide services, we may engage hosting, cloud infrastructure, email, technical support, analytics and security providers.

When the WhatsApp integration operates, data is transferred to Meta Platforms and WhatsApp group companies under their terms and policies. The Aplus PMS client and message recipients may also independently retain the data they receive.

We do not sell personal data or share it with third parties for their own marketing.

Depending on the integrations enabled by the client, recipients can also include Telegram, booking channels and their channel manager, payment and fiscalisation providers, Google Firebase and Apple notification services. Only data used by the relevant integration is transmitted. Opening an external messenger or payment page also makes the relevant provider responsible for its own processing.

When an enabled AI feature uses OpenAI or a ChatGPT connection, your request and the data made available to that feature may be sent to the AI provider. A PMS administrator controls the connection and available access. Review the provider terms before using such features and do not include unnecessary personal data or secrets.

7. International transfers

Aplus operates from Ukraine. Depending on hosting, support access and the connected services, data may be processed in Ukraine and in other countries outside the European Economic Area. Availability of the app in an EU App Store does not mean that all processing takes place in the EU.

Where GDPR applies, transfers outside the EEA require an applicable legal mechanism, such as an adequacy decision or appropriate contractual safeguards. This Policy does not itself constitute a data processing agreement (DPA), standard contractual clauses (SCC) or evidence that they have been executed. Contact info@apluspms.com for information about the recipients, processing locations and contractual documents relevant to your use of the service.

8. Retention periods

• Connection data and authentication credentials are retained while the integration is active. After disconnection or a verified deletion request, they are deleted or rendered unusable, taking backups and legal obligations into account.
• Messages, booking data and links between them are retained according to client settings, the contract and operational needs.
• Enquiry data is usually retained for up to 24 months after the last interaction, and candidate data for up to 12 months, unless another basis applies.
• Audit, security and diagnostic logs may be retained longer when needed to investigate incidents, prevent abuse, comply with the law or defend rights.

Deletion from active systems does not mean immediate removal from backup copies. Ask us about the relevant backup retention and deletion arrangements. We may restrict processing instead of immediately deleting data if retention is required by law, fraud prevention or dispute resolution.

The stated periods describe retention policy, not a guarantee of automatic deletion by the software. The applicable period also depends on the record category, the client’s instructions and legal retention requirements. Ask us for the retention criteria and deletion arrangements relevant to your data, including backup copies.

9. Your rights and data deletion

Depending on applicable law, you may request access, rectification, restriction, deletion or portability of data, object to processing, or withdraw consent.

Write to info@apluspms.com or use our separate Data deletion page. If a particular hotel or management company processed your data, also contact that Aplus PMS client. We may request the minimum additional information needed to verify your identity and protect against unauthorised deletion.

You may also lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights or the competent data protection authority in your country.

10. Cookies and external resources

The site uses technical storage for its operation and preferences. Some pages also load Google Analytics (Google tag), Google Fonts and Font Awesome from external servers. These providers can receive an IP address, browser information and page/request details.

The published Google Analytics script currently loads when the page opens. This Policy does not establish that optional analytics waits for consent. Browser privacy settings can limit some tracking, but they do not replace consent where required by applicable law. Your PMS session cookies and mobile push registration serve separate account and notification functions.

11. Security

We apply organisational and technical measures proportionate to the risks: access controls, protected communication channels, encryption of authentication credentials, audit logs, backups and incident response procedures. No method of transmission or storage guarantees absolute security.

12. Automated decisions and children's data

Aplus does not make decisions with legal or other significant effects solely by automated means. The website and service are not intended for independent use by people under 18.

13. Changes to this Policy

We may update this Policy as features, providers or legal requirements change. The current version and effective date are always published on this page.

14. Applicable law

This Policy has been prepared with regard to the Law of Ukraine “On Personal Data Protection”. If the GDPR or other mandatory rules apply to particular processing, they apply to the relevant extent.