Privacy Policy

1. Who we are

Beast Benefits is an employee engagement and retention platform for hotels and hospitality. It is operated by Autrady EOOD, a single-member limited liability company registered in Bulgaria. In this policy, “we” and “us” mean Autrady EOOD. We are the controller of the data described in section 3.

Company

Autrady EOOD (in Bulgarian: „Аутрейди“ ЕООД)

Registered office

Varna, Bulgaria

Company number

UIC 206828616, Bulgarian Commercial Register

VAT

BG206828616

Email

hello@beastbenefits.com

This policy explains how we handle personal data when you visit beastbenefits.com or write to us. It also explains how the Beast Benefits app treats employee data when a hotel uses it. The web app and the live demo are at app.beastbenefits.com.

2. Our role: controller or processor

We act in two different roles, depending on who you are.

• Website visitors and people who write to us. Autrady EOOD is the data controller. We decide why and how your data is used.
• Employees of a hotel that uses the app. The hotel, our customer, is the controller of its employees’ data. We act as processor under a data processing agreement and process that data on the hotel’s instructions.

If you are a hotel employee and want to use your data rights, contact your employer or hotel first. We help the hotel to respond.

The live demo uses a fictional sample hotel with sample data that is reset regularly. Please do not enter real personal data there.

3. What we collect on this website

The contact form

The form asks for:

• your company or hotel name;
• your name;
• your work email;
• your phone number (optional);
• your employee range, which tells us roughly how many people work at your company or hotel;
• a message (optional);
• your confirmation that we may contact you.

Company, name, work email and employee range are needed so that we can answer you. Phone and message are optional.

The form also uses two technical spam signals: a hidden field and how long the form was open. We use them only to discard automated submissions. We do not store them.

When you send the form, your request is emailed to our team mailbox at hello@beastbenefits.com. It is sent through an email delivery service (Resend).

Email

If you write to us by email, we process your email address and what you tell us so that we can reply.

Technical data

Our website is delivered through Cloudflare, a CDN and security proxy. When you open a page, Cloudflare and our web server process standard technical data: your IP address, the time, the requested page and your browser type. We use it to deliver the page, keep it secure and find faults.

4. Cookies and trackers

This website sets no cookies of its own. It uses no analytics and no advertising trackers. It embeds no third-party content.

Cloudflare, which delivers the site, may set a strictly necessary security cookie when it needs to tell people from automated traffic. Cloudflare states that such cookies are used only for security. Because they are strictly necessary, we do not ask for consent.

The app at app.beastbenefits.com is a separate service and may store what it needs to work, such as your sign-in, in your browser.

The fonts are hosted by us, so your browser does not contact any font provider when you open a page.

5. Why we use your data

We use personal data for these purposes, on these legal bases under the GDPR:

• Answering business enquiries and preparing a quote or pilot. Article 6(1)(b), steps taken at your request before a contract, and Article 6(1)(f), our legitimate interest in replying to business enquiries.
• Keeping the website secure and working. Article 6(1)(f), our legitimate interest in keeping the website secure.
• Meeting legal obligations, where they apply to us. Article 6(1)(c).

Where we rely on legitimate interest, you can object at any time (see section 9). The tick box on the contact form records your request. It is not our legal basis.

We do not sell personal data. We do not use it for automated decision-making or profiling.

6. How long we keep it

• Contact requests: while we are in touch, and for up to 24 months after the last contact. If a contract follows, we keep the data as the contract and the law require.
• Server and security logs: only as long as needed for security and troubleshooting.

After that we delete the data, unless the law requires us to keep it longer.

7. Who receives your data

We share personal data with the providers that help us run the website and handle enquiries. These providers process data for us under data processing terms:

• our hosting provider;
• Cloudflare (CDN and security);
• Resend (email delivery);
• our email mailbox provider.

We may also share data with professional advisers, and with authorities where the law requires it.

8. International transfers

Where a provider processes data outside the European Economic Area, the transfer relies on an adequacy decision (for example the EU-US Data Privacy Framework) or on the EU Standard Contractual Clauses. Email us for details of the safeguards.

9. Your rights

Under the GDPR (Articles 15 to 21) you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict how we use your data;
• receive your data in a portable format;
• object to processing that relies on our legitimate interest.

Where processing relies on your consent, you can withdraw it at any time. Withdrawing does not affect what we did before.

To use a right, email hello@beastbenefits.com. We answer within one month.

Complaints

You have the right to complain to the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни, CPDP), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, https://www.cpdp.bg. You can also complain to the data protection authority in your own EU country.

We would welcome the chance to fix a problem first, but you do not have to contact us before you complain.

10. Security

We use measures suited to the risk, such as:

• access controls;
• encryption in transit (HTTPS);
• separation of each hotel’s data in its own tenant;
• role-based access.

11. If your hotel uses Beast Benefits

Your hotel decides how Beast Benefits is used at work, and it is the controller of your data (see section 2). The app is designed around these privacy rules:

• Pulse answers are shown to managers only as group averages, never individually.
• The monthly Pulse is always anonymous.
• Comments are shown without a name.
• Results stay hidden until enough people have answered (3 by default).
• AI conversations (the coach and the translator) are not shown to managers or HR. Management sees usage volume only.
• Each hotel’s data is isolated from other hotels.
• Data access, retention and deletion follow the hotel’s configured policy and applicable law.

For questions about your data at work, ask your hotel first.

12. Children

Our website is for businesses and is not directed at children. If you believe a child has sent us personal data, tell us and we will remove it.

13. Changes to this policy

When we change this policy, we post the new version here with a new date at the top. We tell customers about material changes by email.

14. Contact

For any privacy question or request, email hello@beastbenefits.com. We use the same address for everything, including requests to use your rights. We have not appointed a data protection officer.