1. Our commitment
JHotels, operated by SomICT, processes personal data in line with Ethiopia's Personal Data Protection Proclamation No. 1321/2024 and other applicable law. This page explains how responsibilities are shared between us and the hotels that use JHotels, and how we keep data safe. Our Privacy Policy explains what we collect and why.
2. Roles
- Hotels are the controllers of the guest records they enter in JHotels (guest names, ID numbers, phone numbers, stay dates and payments). The hotel decides why and how this data is used.
- SomICT is the processor of that guest data. We process it only to provide the Service and on the hotel's instructions, and never for our own purposes.
- SomICT is the controller of account and billing data for hotel users, and of the details guests give when booking through JBooking, which we pass to the hotel they book.
3. What we commit to as a processor
- Process guest data only to run the Service and as the hotel instructs
- Keep guest data confidential, and limit access to staff who need it to support you
- Never sell personal data or use it for advertising
- Help hotels respond to guests who ask to access, correct or delete their data
- Tell the hotel without undue delay, and within 72 hours at the latest, after we become aware of a personal data breach affecting its data
- Delete or return the hotel's data when the subscription ends, as described in section 7
4. Hotels' responsibilities
- Have a lawful basis to collect guest data, such as the guest registration required by law
- Collect only the guest data you need, and tell guests how you use it
- Give each staff member their own account with the right role, and remove accounts when staff leave
- Keep passwords private and devices locked
5. Security measures
- All traffic is encrypted with HTTPS (TLS)
- Passwords are hashed with bcrypt and never stored in plain text
- Each hotel's data is kept separate from other hotels' data
- Role-based access: owners, managers and receptionists see only what their role allows
- Changing a password signs out every other device
- Important actions are recorded in an audit log
- Uploaded files are checked by content type before they are stored
- Daily database backups, stored away from the main server and kept for 30 days
- Security updates are applied promptly
6. Sub-processors
We use a small number of service providers to run the Service:
- Server hosting: runs the application and database
- Backup storage: stores database backups
- Email delivery: sends booking confirmations, password resets and notifications
- Payment providers: process subscription payments; we do not store card details
Some of these providers may store data outside Ethiopia. Where they do, we choose providers with appropriate safeguards and share only what they need. Email info@somict.com for the current list of sub-processors.
7. Retention and deletion
- Hotel data is kept while the subscription is active and for 90 days after it ends, so you can come back or export it.
- After that it is deleted from the live system. Copies in backups are removed as backups expire, within a further 30 days.
- Hotel owners can export their data at any time from Settings → Export, and can clear operational data from Settings.
- You can ask us to delete your account earlier by emailing info@somict.com.
8. Guests' rights
Guests can ask to access, correct or delete their personal data. If you stayed at a hotel that uses JHotels, please contact that hotel first, because it controls your stay records. For bookings made on JBooking, or if you cannot reach the hotel, contact us at info@somict.com and we will help. We reply within 30 days.
9. Breach notification
If a breach affects personal data, we will contain it, investigate it, and notify affected hotels within 72 hours with what we know, what data is involved, and what we are doing. We will help hotels meet their own duty to notify the regulator and affected guests.
10. Contact
Data protection questions and requests: info@somict.com.