Privacy Policy
Last updated: 23 Oct 2026
Draft document: this text must be reviewed and approved by a lawyer before bookings open. For now, Rinway is a demo version: no real booking or payment is possible.
This page explains in plain terms what information we collect when you use Rinway, what we do with it, and how to exercise your rights. We do not sell your data and we do not use it for advertising.
1. Who is responsible for your data
The data controller is the operator of Rinway, whose contact details are shown below.
- Operator
- to be completed before launch
- Legal form
- to be completed before launch
- Trade register and NIF (tax ID)
- to be completed before launch
- Address
- to be completed before launch
- Contact email
- to be completed before launch
- Phone
- to be completed before launch
2. The data we collect
We only collect what is useful for the service:
- Account: email address and password. The password is stored in an irreversibly encrypted form by our sign-in service: nobody at Rinway can read it.
- Profile: name, phone number (optional), preferred display language and currency.
- Bookings: property, dates, rooms, prices, accepted conditions, as well as the name, email and phone number of the travellers you provide.
- Payment: the payment reference and status sent by the payment provider. We never receive your bank card number.
- Support exchanges: the messages you send us from your customer area.
- Technical security data: date and time of sign-in, IP address and browser type, to protect accounts against fraud.
3. Why we use it
- To create and manage your account (performance of the contract).
- To process your bookings and pass them on to the property concerned (performance of the contract).
- To collect payments through the payment provider (performance of the contract).
- To answer your requests for help, changes or cancellations (performance of the contract).
- To protect the site and accounts against fraud and abuse (legitimate interest).
- To meet our accounting, tax and legal obligations (legal obligation).
We do not do targeted advertising, resell data, or profiling. If we ever wish to send you offers by email, we will first ask for your consent, which you can withdraw at any time.
4. Who receives your data
- The property you book: only the information needed for your stay (travellers' names, dates, room, contact details).
- Our technical providers, who act on our instructions and may not use your data for themselves: site hosting, database and sign-in, email sending, online payment (Chargily Pay for Algeria).
- Public authorities, only when the law requires us to.
The exact list of providers, with the country where their servers are located, will be published here before bookings open.
5. Data stored outside Algeria
Some technical providers may store data on servers located outside Algeria. Algerian Law No. 18-07 regulates these transfers: they will only be made after completing the required formalities with Algeria's National Authority for the Protection of Personal Data (ANPDP) and with appropriate safeguards in place.
6. How long we keep it
- Account and profile: as long as your account is active. It is deleted at your request, or after 3 years without any sign-in (you are warned by email beforehand).
- Bookings, payments and invoices: 10 years, a period required by accounting obligations.
- Support messages: 3 years after the last exchange.
- Technical security data: 12 months at most.
After these periods, data is deleted or made anonymous.
7. How we protect it
- All communications with the site are encrypted (HTTPS).
- Each customer can only access their own bookings and messages: this check is enforced directly by the database, not only by the page.
- Payment takes place on the payment provider's secure page: your card details do not go through our servers.
- Access to data by our team is limited to the people who need it and is logged.
No system is invulnerable. In the event of a data breach that poses a risk to you, we will inform you and the competent authority within the time limits set by law.
8. Your rights
Under Law No. 18-07 (Algeria) and, if you live in the European Union, the General Data Protection Regulation (GDPR), you can at any time:
- be informed about how your data is used and obtain a copy of it (right of access);
- have inaccurate data corrected (right to rectification);
- ask for your data to be deleted, except data that the law requires us to keep;
- object to processing or ask for it to be restricted;
- receive your data in a machine-readable format (portability);
- withdraw any consent you have given.
9. If you are not satisfied
We answer every request within one month at most. If our answer does not satisfy you, you can contact the ANPDP in Algeria, or the data protection authority of your country of residence (for example the CNIL in France).
11. Minors
Creating an account is reserved for people of legal adult age (19 in Algeria). When a booking includes children, the person booking provides their information, solely for the stay.
12. Changes to this policy
We may update this page. The date of the last update is shown at the top. In the event of a significant change, we will notify you by email before it takes effect.