Privacy Policy | FARENIO

FARENIO ECOSYSTEM

ARTICLE 1 – INTRODUCTION

GQ VENTURES SAS, trading as FARENIO, is committed to protecting the privacy and personal data of all users of the FARENIO Ecosystem.

This Privacy Policy explains how FARENIO collects, uses, stores, shares, transfers,

protects, and deletes personal data when users access:

FARENIO Marketplace
Host Portal
Cleaner Portal
Vendor Portal
Admin Portal
Mobile Applications
AI Services
PMS Integrations
APIs
Customer Support Services

This Policy applies to:

Hosts
Property Managers
Guests (where applicable)
Cleaners
Vendors
Partners
Enterprise Customers
Website Visitors

ARTICLE 2 – DATA CONTROLLER

The Data Controller is:

GQ VENTURES SAS

Trading Name: FARENIO

Email: privacy@farenio.com

ARTICLE 3 – DATA PROTECTION OFFICER

Where required by law, FARENIO shall appoint a Data Protection Officer (DPO).

Data Protection Contact: privacy@farenio.com

ARTICLE 4 – PERSONAL DATA COLLECTED

FARENIO may collect:

Identity Data

Full name
Date of birth
Nationality (where required)
Government identification
Profile photographs

Contact Data

Address
Telephone number
Email address
Emergency contacts

Business Data

Company name
VAT Number
SIREN/SIRET
Business registration documents
Insurance certificates

Financial Data

Bank account details
Payment information
Transaction history
Invoices
Payout information

Property Data

Property address
Property characteristics
Booking history
Operational records
Inspection reports

Booking Data

Check-in dates
Check-out dates
Reservation numbers
Guest occupancy
Cleaning schedules

Technical Data

Device information
Browser type
Operating system
IP address
Session logs
API activity

Usage Data

Login history
Clickstream
Dashboard usage
Workflow interactions
Feature usage

AI Operational Data

Scheduling requests
AI recommendations
Operational analytics
Automation history

ARTICLE 5 – PURPOSES OF PROCESSING

FARENIO processes personal data to:

Create user accounts
Manage bookings
Coordinate turnover operations
Dispatch Providers
Manage Vendor workflows
Process payments
Prevent fraud
Comply with DAC7
Comply with AML/KYC
Improve Platform performance
Train and validate AI systems where lawful
Provide customer support
Maintain security
Generate operational reports

ARTICLE 6 – LEGAL BASIS

Processing is based upon:

Contract performance
Legal obligations
Legitimate interests
Consent (where required)
Protection of vital interests
Public interest obligations where applicable

ARTICLE 7 – AI PROCESSING

FARENIO uses Artificial Intelligence to support:

Pricing
Scheduling
Dispatch
Property Operations
Customer Support
Fraud Detection
Business Intelligence

AI recommendations are subject to appropriate human oversight where required by law.

No solely automated decision producing legal or similarly significant effects shall be made without appropriate safeguards unless permitted by law.

ARTICLE 8 – DATA SHARING

Data may be shared with authorised recipients including:

Payment service providers
Cloud hosting providers
PMS providers
Communication providers
Tax authorities
Regulatory authorities
Insurance providers
Professional advisers
Law enforcement where legally required

FARENIO never sells personal data.

ARTICLE 9 – INTERNATIONAL TRANSFERS

Where personal data is transferred outside the European Economic Area (EEA),FARENIO shall implement appropriate safeguards, including:

Adequacy decisions;
Standard Contractual Clauses (SCCs);
Binding Corporate Rules where applicable;
Additional technical and organisational measures.

ARTICLE 10 – SECURITY

FARENIO implements appropriate technical and organisational measures, including:

Encryption in transit and at rest where appropriate;
Access controls based on least privilege;
Multi-factor authentication for privileged access;
Audit logging;
Vulnerability management;
Backup and disaster recovery procedures;
Security monitoring.

ARTICLE 11 – DATA RETENTION

Personal data shall be retained only for as long as necessary to fulfil the purposes described in this Policy or to comply with legal obligations.

Detailed retention periods are contained in Annex B – Data Retention Schedule.

ARTICLE 12 – DATA SUBJECT RIGHTS

Individuals have the right to:

Access their personal data;
Rectify inaccurate data;
Erase data where applicable;
Restrict processing;
Object to processing;
Data portability;
Withdraw consent where processing is based on consent;
Lodge a complaint with the competent supervisory authority.

Requests should be sent to: privacy@farenio.com

ARTICLE 13 – COOKIES

Cookies are governed separately under the FARENIO Cookie Policy.

ARTICLE 14 – CHILDREN

The Platform is not intended for individuals under the age required by applicable law to contract independently.

FARENIO does not knowingly collect personal data from children without a lawful basis.

ARTICLE 15 – DATA BREACHES

FARENIO maintains procedures for:

Detection;
Investigation;
Containment;
Notification;
Remediation of personal data breaches.

Where required by GDPR, relevant supervisory authorities and affected individuals shall be notified within applicable legal deadlines.

ARTICLE 16 – POLICY UPDATES

This Privacy Policy may be updated to reflect:

Legal developments;
Regulatory guidance;
Platform enhancements;
AI governance changes.

Material updates shall be communicated through the Platform.

ARTICLE 17 – CONTACT

Privacy enquiries: privacy@farenio.com

ANNEX A

RECORD OF PROCESSING ACTIVITIES (RoPA)

Prepared in accordance with Article 30 GDPR.

For each processing activity, FARENIO shall document:

Processing activity name;
Purpose of processing;
Categories of data subjects;
Categories of personal data;
Legal basis;
Recipients;
International transfers;
Retention period;
Security measures;
Responsible business owner.

The RoPA shall be reviewed at least annually and whenever new processing activities are introduced.

ANNEX B

DATA RETENTION SCHEDULE

Retention periods shall be defined by category, including:

User account data;
Booking records;
Financial records;
Payment information;
Tax and DAC7 records;
Identity verification documents;
Customer support records;
Property operation logs;
AI operational logs;
Security logs;
Marketing preferences;
CCTV or image records (if applicable).

Each category shall specify:

Retention period;
Legal basis;
Disposal method.

ANNEX C

SUB-PROCESSOR REGISTER

FARENIO shall maintain a current register of authorised sub-processors.

The register should include:

Service provider name;
Processing purpose;
Categories of personal data processed;
Hosting location(s);
Applicable contractual safeguards;
Security certifications (where available);
Date of appointment.

Changes to material sub-processors shall be communicated where required by contract or law.

ANNEX D

INTERNATIONAL DATA TRANSFER REGISTER

Where personal data leaves the EEA, FARENIO shall record:

Destination country;
Recipient;
Categories of data transferred;
Transfer mechanism (e.g. adequacy decision or Standard Contractual Clauses);
Supplementary safeguards implemented;
Transfer risk assessment;
Review date.

ANNEX E

AI PROCESSING REGISTER

For each AI-enabled process, FARENIO shall document:

AI system name;
Business purpose;
Categories of data processed;
Lawful basis;
Human oversight measures;
Potential risks;
Bias mitigation measures;
Accuracy monitoring;
Model update process;
Logging and audit controls.

The register shall support compliance with applicable AI governance obligations.

ANNEX F

DATA SUBJECT RIGHTS PROCEDURE

FARENIO shall maintain documented procedures for handling requests relating to:

Access;
Rectification;
Erasure;
Restriction;
Portability;
Objection;
Withdrawal of consent.

The procedure shall include:

1. Receipt of the request;

2. Identity verification;

3. Registration in the rights request log;

4. Assessment of legal obligations and exemptions;

5. Internal allocation to responsible teams;

6. Response within applicable legal deadlines;

7. Record of actions taken;

8. Closure and audit trail.

All requests shall be handled consistently, securely, and in accordance with GDPR requirements.