Privacy policy
This policy explains which personal data Hoost receives through hoost.be, by email and by phone, what we use it for, and how you can contact us about it.
Draft of 15 September 2026. This page has not yet been reviewed by a legal adviser, and some details are still being confirmed by Hoost.
Who is responsible for your data
- Controller
- Tanguy De Keyzer
- Trading name
- Hoost
- Address
- Block A, Floor 8, Xemxija Park Residence, Triq Raddet ir-Roti, San Pawl il-Baħar (Xemxija) SPB 4233, Malta
- info@hoost.be
- Phone
- +32 484 44 96 17 · +32 480 65 99 41
- Data protection officer
- None appointed. For any question about your data, write to info@hoost.be.
Which personal data we receive
- Stay enquiries (Contact, Corporate, Project accommodation and Relocation forms): first name and last name (or name), email address, phone number (optional), company (where relevant), type of enquiry or purpose of the stay, arrival and departure dates, number of guests, number of apartments, preferred apartment type, whether a company invoice or parking is needed, the apartment you asked about, your message, and the language of the page.
- Property owner enquiries (Property management form): first name and last name, email address, phone number (optional), municipality or neighbourhood of the property, type of property, number of bedrooms, whether it is furnished, its current situation, your preferred start date, the service areas you are interested in, and your message.
- Email, phone and WhatsApp: the details and messages you share with us.
- Bookings and stays: the details needed for your booking and stay, including guest registration details and a copy of an identity document. Exactly which details are recorded: name, date of birth, nationality, home address, type and number of the identity document, and the dates of arrival and departure, as asked for by the guest register that accommodation in Belgium has to keep.
- Visiting the website: only if you accept analytics cookies in the cookie banner, Google Analytics 4 records how the website is used: the pages you view, the website you came from, your device and browser type, your approximate location (country or city, derived from your IP address, which Google Analytics 4 does not store) and anonymous interactions such as a click on a phone number or sending a form, without the form contents. Google acts as our processor for this. We do not use it for advertising, and Google signals are switched off. You can withdraw your consent at any time with “Cookie settings” at the bottom of every page (see the cookie policy). Technical data that the hosting provider may log when you visit: your IP address, the date and time, the page requested, the referring page and your browser type, in the server logs of our hosting provider Vercel. Vercel keeps these logs for a short period for security and to keep the website running; we do not use them to identify visitors.
If you arrive through a link with campaign parameters (utm_source, utm_medium, utm_campaign), those values are sent with the form.
With every form we also receive the page it was sent from and the page language. To stop spam, the form sends the time it was opened and a hidden field that must stay empty. To limit repeated requests, the website keeps a hashed code derived from your IP address and the date for at most 24 hours; the IP address itself is not stored and is not included in the enquiry.
Enquiries are delivered to Hoost by email. The website does not store them in a database. You also receive an email confirming your request, with its reference.
What we use it for
| Purpose | Legal basis |
|---|---|
| Answering your enquiry and preparing a proposal | Steps you ask for before a contract (GDPR article 6(1)(b)), or our legitimate interest in answering questions we receive (article 6(1)(f)) |
| Arranging and managing your booking and stay | Performance of the contract for your stay (GDPR article 6(1)(b)) |
| Invoicing and accounting | Legal obligations under accounting and tax law (GDPR article 6(1)(c)) |
| Answering questions from property owners | Our legitimate interest in answering questions from owners, or steps you ask for before a contract (GDPR article 6(1)(f) and (b)) |
| Guest registration, if required for accommodation | Legal obligation to keep a guest register (GDPR article 6(1)(c)) |
| Website statistics with Google Analytics 4 | Your consent, which you can withdraw at any time |
We do not send newsletters or marketing emails, and we do not sell, rent or share your data for anyone else’s marketing. We do not make decisions about you by automated means alone.
Who receives your data
We work with the service providers below. They process your data on our behalf and only for these tasks. We do not sell your data.
| Task | Provider | Location |
|---|---|---|
| Hosting the website | Vercel (Vercel Inc.) | United States and EU (Vercel Inc.) |
| Running the enquiry form function (hosting platform) | Vercel Functions (Vercel Inc.) | United States and EU (Vercel Inc.) |
| Delivering enquiries to Hoost by email, and the confirmation you receive | Resend | United States and EU (Resend) |
| Email for info@hoost.be | Google Workspace (Google) | United States and EU (Google) |
| Messages you send us on WhatsApp | WhatsApp (Meta) | United States and EU (Meta) |
| Direct bookings and guest messages | Hospitable | United States and EU (Hospitable) |
| Bookings made on Airbnb | Airbnb | Ireland (Airbnb Ireland UC) and United States |
| Invoicing and bookkeeping | Our external accountant | European Union |
| Website statistics, only with your consent | Google Analytics 4 (Google Ireland Limited) | United States and EU (Google) |
If you book through Airbnb, Airbnb also processes your data under its own privacy policy. If you message us on WhatsApp, WhatsApp processes your messages under its own privacy policy.
Transfers of personal data outside the European Economic Area: several of the providers above are based in the United States or use servers there. Where data leaves the EEA, we rely on the EU-US Data Privacy Framework for providers certified under it, or on the standard contractual clauses approved by the European Commission.
How long we keep it
| Data | Retention period |
|---|---|
| Enquiries that do not lead to a stay | 12 months after your last contact with us, then deleted |
| Guest and booking details | 12 months after the end of your stay, then deleted |
| Invoices and accounting records | As long as accounting and tax law requires (currently up to 10 years) |
| Property owner enquiries | 12 months after your last contact with us, then deleted |
| Hashed connection identifier used to limit repeated requests | Deleted automatically within 24 hours |
| Guest registration details and the copy of an identity document | Kept locally by Hoost for 90 days after the stay, then deleted |
Your rights
Under the General Data Protection Regulation (GDPR) you can ask us to:
- see the personal data we hold about you
- correct data that is wrong or incomplete
- delete your data
- limit how we use your data
- receive your data in a structured, commonly used format
- stop using your data, where you have the right to object
- withdraw consent you have given, where we rely on consent
Send your request to info@hoost.be. How and within what time we respond: we reply within one month of receiving your request. For a complex request we can extend this by up to two months, and we tell you why within the first month. We may ask you to confirm your identity first. Exercising your rights is free.
You can also lodge a complaint with the Belgian Data Protection Authority, or with the data protection authority of the EU country where you live or work.
Security
How personal data is protected (access, storage and providers): only the people at Hoost who need your data for your enquiry or stay can see it. We use providers that encrypt data in transit, the website sends forms over an encrypted connection (HTTPS), and our accounts are protected with passwords and two-step verification where the provider offers it. Copies of identity documents are kept apart and deleted on schedule. No system is completely secure: if a data breach is likely to put you at risk, we inform you and the supervisory authority as the law requires.
Changes to this policy
When the way we handle personal data changes, we update this page and its date.