What we actually need
For an initial hotel-spend assessment, the information relevant to pricing is enough: hotels or markets, estimated room-night volumes, historical nightly rates, and approximate annual spend. A preliminary analysis can often be done without employee names or individual itineraries.
For a negotiation engagement, Zodiac and the customer agree upfront on what additional records, if any, are necessary, typically aggregate volume by property and booking period. We encourage customers to share only the minimum necessary for the specific task.
If individual-level booking records become relevant to a later stage (for instance, to audit whether negotiated rates are being applied), we'll work with your team to define and limit that scope before you send anything.
How your information is used
Information you submit for an engagement is used only within the scope we've agreed on: analyzing hotel-spend patterns, identifying sourcing opportunities, communicating relevant business-volume information to hotel sales contacts, negotiating rate arrangements, and reviewing whether agreed rates are being applied correctly.
We do not use customer hotel-spend records for cross-customer benchmarking, marketing, model training, or publication without explicit written authorization from the relevant customer. Any such use must be defined in your agreement with us.
Who can access it
Customer information is accessible only to Zodiac team members and service providers who need it for an authorized purpose within a specific engagement. All personnel with access are subject to confidentiality obligations.
Our website and application platform runs on infrastructure operated by vetted service providers acting on Zodiac's behalf under contractual confidentiality and security terms.
How files are transferred and stored
For hotel-spend records or other confidential files, contact us before sending anything. We'll agree on a transfer method, such as an encrypted channel or a shared secure folder, and confirm any applicable confidentiality terms first. We do not ask you to send sensitive records through a general email or contact form, and all file transfers use encrypted connections.
Our platform infrastructure is backed by independent SOC 2 Type II auditing and ISO 27001 certification. These standards support the security of the systems our services run on.
How long we keep your information
We work with customers to agree on retention and deletion schedules, and we keep engagement records only as long as needed for the agreed purpose, for audit and dispute purposes, or as required by law or contract. You can request deletion or ask about our default practices by contacting us at support@stayzodiac.com. More detail is set out in our Privacy Policy.
What happens if something goes wrong
If we become aware of a potential information-security incident affecting customer information, we investigate, take steps to contain it, and notify affected customers in accordance with our agreements and applicable law. Enterprise-specific incident-notification commitments are addressed in the relevant customer contract.
Frequently asked questions
Do you need employee names or itineraries to estimate savings?
Not for an initial assessment. We can typically evaluate opportunity using property-level and aggregate spend data. If individual records become necessary at a later stage, we'll scope that request with you before you send anything.
Will our employees have to change how they book hotels?
Zodiac is designed to work alongside your existing travel management setup: Navan, Concur, TravelPerk, or any other TMC or booking tool. Negotiated rates are loaded directly into your existing system.
Do you share our hotel-spend data with hotels?
Negotiating a corporate rate typically requires sharing relevant business-volume information, such as estimated room nights at a property during a specific period, with the hotel's group sales team. Before any disclosure, we agree with you on what information can be shared and with which hotels. We do not share identifiable employee data with hotels without your explicit authorization.
Is Zodiac SOC 2 certified?
Zodiac operates on infrastructure backed by independent SOC 2 Type II auditing and ISO 27001 certification. These standards support the security of our underlying platform.
For additional security documentation, vendor assessments, or data-processing inquiries, contact support@stayzodiac.com.
Can we request a data-processing agreement?
Yes. If your organization's procurement or privacy team requires a DPA as a condition of engagement, contact us and we'll work through the appropriate documentation before we begin.