API terms of use

These terms govern the use of the public API of Galaxy Hotel Cloud (the “API”), of the sandbox and of the integrator portal by whoever connects their own product to the properties that use the PMS (the “integrator”). The service is provided by PassportScan LTD.

Whoever accepts them from the portal declares they can bind the integrator. They do not govern the relationship between the integrator and the hotels, which stays between them.

•Access requires our approval, which we may refuse or withdraw.

•The product key identifies your product and is secret: keep it on your servers, never put it in applications distributed to users or in public code, and generate a new one if you suspect it has been exposed.

•The key of a property is valid only for that property and for the permissions the hotel accepted: do not use it for other purposes and do not hand it to third parties.

•You are responsible for what happens with your keys and with the users of your portal.

You may use the API only to run the product described in the sheet, for the properties that activated it. You may not:

•access data or properties other than those authorised, or get around limits and controls;

•ask for more permissions than the product uses;

•resell or grant third parties access to the API;

•use the API to build stores of hotel or guest data unrelated to the service rendered to the hotel, for profiling or to train models;

•run load or security tests without our written consent, or harm the service and the other users.

The data you receive through the API belongs to the property, which is its controller. We make it available to you on its instruction, when it activates your product and accepts its permissions: we act as the property's processor, not as your data supplier.

•You process that data on behalf of the property or as an independent controller, according to your agreement with it: it is for you and the property to govern that relationship, including, where needed, the agreement required by Article 28 of the GDPR.

•Use the data only for the service you render to that property, keep it for the time necessary and delete it when the property deactivates the product or asks you to, save for legal obligations.

•Do not transfer the data outside the European Economic Area without the safeguards required by the GDPR.

•Help the property answer the requests of data subjects concerning the data you hold.

Protect keys and data with appropriate measures: encrypted connections, access limited to those who need it, security updates. If you discover unauthorised access to the keys or to the data received through the API, notify the property concerned and us without delay, within 48 hours of becoming aware of it, by writing to support@galaxy-hotel.net, and cooperate to limit its effects.

What you write in the sheet must be true, up to date and yours, or used under licence. By publishing it you authorise us to show name, logo and description in the Marketplace and in our materials that list the connected products. You may say that your product is integrated with Galaxy Hotel Cloud, without suggesting that we recommend it or that we are partners in business. We review sheets before publishing them and may ask for changes or refuse them.

•The sandbox is shared with the other integrators and is reset every night: do not enter real personal data there.

•Use is subject to limits (today 600 calls per minute per property key), which we may adjust to protect the service.

•Within a version (/v1) we add fields and operations without removing any. A version we retire stays available for at least 12 months from the announcement, save for security or legal reasons.

•We guarantee no service levels for the API other than those of the PMS.

We may suspend a product or an integrator, at once and without notice, where there is a risk to security or to data, a breach of these terms or a request from an authority; in the other cases we notify you first. A suspension stops every key of the product.

You may stop using the API at any time by asking us to close the account; each hotel may deactivate your product whenever it wants. On termination you stop using the keys and handle the data already received as set out above.

Today access to the API, to the sandbox and to the Marketplace is free for integrators. If we introduce a fee we will tell you at least 60 days in advance and you may close the account before it applies.

The API is provided as is. To the extent permitted by law, and save for wilful misconduct or gross negligence, we are not liable for damage arising from the free use of the API, including indirect damage and loss of profits or data. You are responsible for how your product works and for the use you make of the data, and you hold us harmless from third-party claims arising from your breach of these terms or of the law.

We may update these terms: the new version is published here with its date and we ask you to accept it from the portal before the next review of a product. Material changes are announced by e-mail at least 30 days in advance.

The terms are governed by the law of England and Wales and any dispute falls under the jurisdiction of the courts of London. They are published in Italian, English, Spanish, French, Portuguese and German: in case of discrepancies the English text prevails. For questions write to support@galaxy-hotel.net.