How can we help you?

Korotek International Ltd. respects your privacy and is committed to protecting the personal data we process. This policy applies to visitors of our website, users of KoroCRM, and guests whose information is managed by our resort clients through the platform.

By using KoroCRM or submitting information to us, you acknowledge the practices described in this policy. If you are a resort client, you are responsible for informing your guests about how their data is processed through KoroCRM.

We may collect and process the following categories of data:

• Account and contact data: name, email address, phone number, organization name, and secure login credentials.
• Guest and operational data: guest profiles, preferences, booking history, service logs, visit details, feedback, and loyalty program participation.
• Wellness and health data (optional): vitals, allergies, conditions, wellness goals, treatment records, and data from connected wearables such as Whoop. This data is encrypted and only collected when explicitly enabled by your organization.
• Device and usage data: IP address, browser and device type, operating system, session logs, crash reports, and feature usage analytics.

We use collected data to:

• Provide, operate, and improve KoroCRM features and personalized guest services.
• Analyze platform performance and develop new functionality.
• Enable health tracking, guest insights, and AI-assisted recommendations.
• Maintain security, prevent fraud, enforce access controls, and ensure compliance.
• Respond to support requests, inquiries, and service-related communications.

We process personal data on the basis of contract performance, legitimate interest, consent (where required), and legal obligation. Health and wellness data is processed only with explicit consent or where necessary for the provision of services under a contract with the resort client.

We do not sell personal data. We may share data only in the following circumstances:

• With authorized staff and administrators of the resort client that manages the data.
• With trusted service providers (such as cloud hosting and analytics) under strict confidentiality and data-processing agreements.
• When required by law, regulation, or valid legal process.

We apply industry-standard security practices, including:

• AES-256 encryption for data at rest and TLS encryption for data in transit.
• Role-based access controls and multi-factor authentication options.
• Regular security reviews, monitoring, and vulnerability management.

Sensitive health and guest data is handled with heightened protection and access restrictions.

KoroCRM is designed to support resort clients in meeting their compliance obligations. The platform includes features aligned with HIPAA principles for protected health information and provides tools to help fulfill GDPR data-subject rights requests.

Under GDPR, data subjects may request access to, correction of, or deletion of their personal data, withdraw consent, and lodge complaints with their local data protection authority.

We retain personal data only for as long as necessary to provide the service, fulfill the purposes described in this policy, and meet legal or contractual obligations. Data can be deleted or anonymized upon request by an authorized account administrator.

KoroCRM is not intended for direct use by individuals under the age of 16 without supervision by a licensed healthcare provider, guardian, or authorized resort staff member.

If you connect third-party platforms or wearables (such as Whoop, external calendars, or payment providers), their data handling is governed by those services' own privacy policies and terms. We recommend reviewing them before enabling integrations.

Depending on your location and applicable law, you may have rights to access, rectify, erase, restrict processing of, or port your personal data. To exercise these rights, contact us using the details below.

We may update this Privacy Policy from time to time. We will post the revised version on this page with an updated effective date and, where appropriate, notify users through the platform or by email.

If you have questions, concerns, or requests regarding this Privacy Policy, please contact us:

• Email: data.privacy@korotek.ai
• Company: Korotek International Ltd.
• Address: Varna, Bulgaria