Privacy notice
This notice explains how your personal data is used when you visit this website, request or make a booking, use the guest or supplier portal, or contact us. It is written to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Last updated 27 September 2026.
Who we are
What we collect
- Contact details — name, email address, phone number and company (for corporate bookings).
- Booking details — dates, property and unit, guests, extras, quotes, amendments and cancellations.
- Guest registration — details you provide before arrival, such as arrival information and, where required, identity verification.
- Payments — payment status and amounts. Card details are entered directly with Square and are never stored by us.
- Messages and requests — messages, issues and service requests you send through the portal or by email.
- Supplier information — for suppliers: contact details, property information, documents and submissions.
- Technical data — the minimum needed to run and secure the website (see the cookie policy). We do not use analytics, advertising or tracking cookies.
Why we use it and our lawful basis
- To take and manage your booking or supply agreement — performance of a contract.
- To keep tax, VAT and accounting records — legal obligation.
- To keep the website, payments and accounts secure and prevent fraud — legitimate interests.
- To answer your enquiries and requests — legitimate interests, or steps before entering a contract.
- Anything else we ask your permission for — consent, which you can withdraw at any time.
Who processes it for us
We use trusted service providers who process data only on our instructions:
| Provider | What for | Data involved | Where |
|---|---|---|---|
| Vercel | Hosting of the website and application | All data passing through the website | UK (London) for the application; worldwide network for delivering pages |
| Supabase | Database and secure sign-in for guests and suppliers | Account, booking, registration, message and document records | UK (London) |
| Square | Card payments and refunds | Payment details (entered directly with Square — card numbers are never stored by us) | Provider’s own locations (see its privacy notice) |
| Google (Gmail) | Sending booking and account emails | Name, email address and message content | Provider’s own locations (see its privacy notice) |
| Microsoft 365 | Staff email, calendars and documents used to handle enquiries | Correspondence and documents you send us | The operator’s own Microsoft 365 tenant |
| TypeSafe AI (Jev) | Sorting incoming operations email by what needs to happen next (for example urgent or needs a reply) | Sender, subject and the first 400 characters of each email, which can include names and booking details; nothing is stored by us after sorting | Provider’s own locations (see its privacy notice) |
| Property management system | Reservations, units and stays | Booking and stay details | Provider’s own locations (see its privacy notice) |
| HubSpot | Customer relationship management for corporate clients handled by our sales team | Business contact and enquiry details | Provider’s own locations (see its privacy notice) |
| OpenStreetMap | Maps on the locations pages | Your browser loads map images directly; no account data is shared | Provider’s own locations (see its privacy notice) |
| GitHub | Source code, automated checks and encrypted nightly database backups | Database backups (encrypted before upload; only the operator holds the key) | USA |
The full list, including services used only for staff work, is on the sub-processors page. Business customers can use our data processing agreement.
Some of these providers may process data outside the UK. Where they do, the transfer is protected by the safeguards UK law requires, such as the UK International Data Transfer Agreement or an adequacy decision. We never sell your personal data.
How long we keep it
We keep booking, invoice and payment records for six years to meet UK tax law. Other personal data is kept only as long as needed for your stay, supply agreement or enquiry and any follow-up, and is then deleted or anonymised.
Your rights
You have the right to access your data, correct it, have it deleted, restrict or object to its use, receive it in a portable format, and withdraw consent. Some records (for example invoices) must be kept by law, so we may anonymise rather than delete them.
To use your rights, contact agenticos@agentic.os. We reply within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk.
Security
Data is encrypted in transit, access is limited to staff who need it and is checked by role, and payment card data is handled only by Square.
Changes
We will update this notice when how we use personal data changes, and show the new date at the top.