Privacy Policy

Who we are and when this policy applies

Hospitality Flow Ltd (trading as Hospitality Flow) provides Handover + SOP for independent and boutique hotels: one product for shift handovers and hotel procedures. This policy explains how we handle personal data through our website, enquiries and service. Contact hello@hospitalityflow.co.uk. Our registered company details appear below.

We do not sell personal data.

Information we collect for our own purposes

Hospitality Flow acts as controller when we decide why and how to use data for our own business purposes. This may include your contact name, work email, hotel or company name, optional enquiry message; account, billing and support information where applicable; and basic technical and security information such as IP address, browser type and access logs.

We receive this information from you, your organisation and use of the service. The public pilot application prepares an email on your device; we receive it only when you send it. Required contact fields help us respond, and without them we may be unable to arrange access. Please keep staff and guest records out of enquiries.

Why we use it and our lawful bases

We use enquiry and business-contact information to respond to pilot requests, arrange onboarding, provide support and administer customer relationships. Our lawful basis is our legitimate interest in running and supporting the business, balanced against your rights. Where you personally enter a contract with us, we use information necessary to perform it or take steps you request before entering it.

We use technical and support information for our legitimate interests in protecting the service, preventing fraud, investigating problems and improving usability. We use information needed for legal and accounting duties to meet legal obligations.

We send marketing only where permitted, using consent where required or our legitimate interests where appropriate. You can object to direct marketing at any time, or withdraw consent, by contacting us or using an unsubscribe option. Withdrawing consent does not affect earlier lawful processing.

Hotel-controlled information: our processor role

For operational personal data in Handover + SOP, the hotel or customer normally acts as controller: it determines the purpose, lawful basis, access and retention. Hospitality Flow acts as processor, handling that data on the hotel’s documented instructions under the applicable data-processing arrangements.

Hotel-controlled information may include shift notes, task ownership, staff names, necessary guest or room references, SOP instructions, drafts, approved versions, step images and captions, and records of edits or approvals. The hotel determines who may use these records. HF does not make employment or guest decisions on the hotel’s behalf.

For questions or rights requests about hotel-controlled records, contact the hotel first. If you contact us, we will help route the request and assist the hotel as appropriate.

The initial pilot is for routine operational information. Do not enter medical information, sensitive HR or disciplinary records, payment card details, passwords or identity-document images. Check SOP images for personal information before adding them. Use the hotel’s approved systems for sensitive records and urgent safety matters.

Service providers and sharing

We use Vercel for website hosting, Supabase for account and application data services, and Zoho Mail for business email. We also use service providers where needed for security, payment processing where agreed and support, and professional advisers for business administration. Access should be limited to what is needed for the relevant purpose. For hotel-controlled records, relevant providers, their roles and necessary contractual protections are agreed through the applicable data-processing arrangements before live pilot use. We may also disclose information where legally required.

Where a service involves a restricted transfer of personal data outside the UK, the applicable legal transfer requirements must be met. The relevant provider, location and safeguards depend on the service; contact us for details of any transfers that apply to your use.

How long we keep information

We retain enquiry data while responding and following up, and account or support information for the customer relationship and any necessary follow-up. Retention depends on the purpose, whether information is still needed, legal or accounting obligations, and the need to resolve disputes. We delete or anonymise information when it is no longer required.

For hotel-controlled data, retention and return or deletion follow the hotel’s instructions and agreed processing terms, subject to legal requirements and applicable backup deletion cycles.

Security

We use technical and organisational measures intended to protect personal data, including access controls and limiting access to authorised people who need it. No online service can guarantee complete security. Customers must manage their users and avoid including unnecessary personal information.

Cookies, analytics and external services

We do not currently operate our own advertising tracking scripts on public marketing pages. Account access, security and connected services may use essential cookies or similar browser storage. If optional analytics or advertising tracking is introduced, we will update this notice and obtain consent where required.

Some pages load fonts from Google Fonts, which receives technical information needed to deliver them. External links, including LinkedIn, are subject to those providers’ privacy policies when you visit them. The public demos use fictional content. Changes and any example images remain in page memory and reset on refresh; the demos do not save records to a hotel workspace.

Your rights

Under UK data protection law, depending on the circumstances, you can request access to your personal data, correction, erasure, restriction of use or a portable copy, and object to processing. Where we rely on consent, you can withdraw it. These rights are subject to legal conditions; the right to object to direct marketing applies at any time.

Contact hello@hospitalityflow.co.uk to exercise rights relating to our controller processing. We may need to verify your identity. You can complain to the Information Commissioner’s Office (ICO) if you are concerned about how your data is handled.

You can also raise a data protection complaint directly with Hospitality Flow using the same email address, explaining your concern and how we can contact you. We will acknowledge a data protection complaint within 30 days, investigate it fairly without undue delay, keep you informed of progress and explain the outcome without undue delay. If your concern relates to personal data controlled by a hotel, we will help direct it to the appropriate controller while reviewing any issue with our own services.

Changes to this policy

Any personal information retained from an earlier service remains subject to the applicable privacy information and lawful retention requirements. We will update this page when our practices change and revise the date above. Where a change materially affects how we use personal data, we will provide further notice as appropriate.