Privacy Policy

CrestStay (“we”, operated by Win Central Co., Ltd.) provides hotel management software. This policy explains what personal data we process and your rights under Myanmar’s PDPA and the EU GDPR.

1. Data we process

For hotel staff users: name, email, role and activity logs. For hotel guests (entered by the hotel): name, contact details, identification, stay history, and any registration signature. We process this on behalf of the hotel (the data controller); CrestStay acts as a data processor.

2. How we use it

To operate the booking, check-in, billing and reporting features the hotel uses; to secure accounts; and to provide support. We do not sell personal data.

3. Storage & security

Data is stored on Supabase (Singapore region) with row-level security, encryption in transit and at rest, multi-factor authentication and full audit logging. Access is least-privilege and tenant-isolated.

4. Sharing

We share data only with sub-processors needed to run the service (cloud hosting, payment and messaging providers) under data-processing terms, and where legally required.

5. Retention

We keep data for as long as the hotel’s account is active, then delete or anonymise it within a reasonable period unless law requires retention.

6. Your rights

You may request access, correction, export or deletion of your personal data, and object to or restrict processing. Contact the hotel (data controller) or email us at privacy@creststay.com and we will assist.

7. Contact

Win Central Co., Ltd. — privacy@creststay.com.