Guest Privacy Notice
Last updated 26 September 2026
The short version
Your hotel is in charge of your data and Alejo OS handles it for the hotel. It is used to run your stay, take payments and keep things secure, not for advertising and never sold. Ask the hotel first if you want to see, correct or delete your data.
1. Who this is for and who is responsible
You are reading this because a hotel that uses Alejo OS has checked you in, taken a booking or order from you, or given you a link or NFC tag to use during your stay. The hotel decides what data it collects about you and why, and is the controller of that data. Alejo OS, made by Consulaw Tech Services, is the hotel’s processor: it stores and handles the data for the hotel and only as the hotel instructs.
The hotel should also give you its own privacy notice. This page explains the parts that come from Alejo OS. Where the hotel’s notice and this one differ about what the hotel does with your data, the hotel’s notice governs.
2. What data is involved
| Data | Why the hotel uses it |
|---|---|
| Your name, email address and phone number | To manage your booking, contact you and send receipts and confirmations. |
| ID type and number, nationality (if the hotel records them) | Identity checks and legal registration duties that apply to hotels. |
| Booking, stay and room details, special requests and notes | To run your stay. |
| Orders, service requests, event tickets and what they cost | To deliver food, services and events and to bill you. |
| Payments: amount, method, status, any service charge and a reference | To record and reconcile what you paid. Card details are handled by the payment gateway, not stored by Alejo OS. |
| Guest link or NFC tag activity, and door-access credentials for your room | To let you use your digital stay page and, where the hotel uses it, open your door. Access is removed when you check out. |
| A session token in your browser | To keep your stay page signed in for the length of your stay. |
3. How the data is used
- To provide your stay and the services you ask for through your phone.
- To take payments and give you receipts.
- To send booking, receipt and ticket emails from the hotel.
- To keep the platform secure and prevent fraud.
- To meet legal duties the hotel has, such as accounting and guest registration.
Alejo OS does not use your data for advertising and does not sell it. The hotel’s own use of it is described in the hotel’s notice.
4. Paying online, and the service charge
If you pay by card or bank transfer through your phone, you are taken to our payment partner (Paystack or Stripe) to enter your details. Some hotels add an itemised online payment service charge for paying that way, which you see before you pay and never pay for cash or room-tab charges. See our Payment Terms and Service Charge page.
6. How long it is kept
The hotel decides how long to keep guest records, within what the law requires. Your guest page stops working when you check out, and any door credential is revoked. Alejo OS keeps hotel data while the hotel is a customer, and deletes or anonymises it within 90 days after the hotel leaves, if it asks, except what the law requires to be kept.
7. Your rights and how to use them
Under the Nigeria Data Protection Act 2023 (and the GDPR if it applies to you) you can ask to see your data, have it corrected or deleted, restrict or object to how it is used, receive a copy in a portable form, and withdraw consent you gave. Because the hotel is in charge of your stay data, ask the hotel first, at its front desk or the contact address it gives you.
If you send a request to us at consulawtech@gmail.com we will pass it to the hotel and help it respond, and tell you we have done so. If you are not happy with the outcome you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng) or your local data protection authority.
8. Children
Guests under 18 should be registered by a parent or guardian, who is responsible for the details given. The hotel should only record a child’s data where it has a lawful basis and parental consent where needed.
9. Security
Data is encrypted in transit, access is limited by role and logged, and guest stay pages use signed, time-limited sessions that end at check-out. If a breach affects your data, the hotel and we will act as the law requires, including telling the Nigeria Data Protection Commission within 72 hours where required.
10. Contact
For anything about how Alejo OS handles data: consulawtech@gmail.com. For anything about what your hotel does with your data, contact the hotel.