1. Who we are
HostHQ is the controller for the personal data described in this notice. You can contact us about privacy at info@hosthq.uk. If we appoint a data protection officer or a UK representative, we will name them here.
2. What personal data we collect
As a controller, we collect and use:
- Account data — the name, work email, and role of the people who sign up for and administer a workspace.
- Billing data — the billing contact, billing address, VAT details and subscription record. Card details are handled by our payment processor; we do not store full card numbers.
- Enquiry data — the name, email and message of people who contact us or request a demo.
- Usage and device data — how the Platform and website are used, including log data, IP address, browser type and pages viewed, collected to keep the service secure and to improve it.
- Support data — the content of messages you send us and our correspondence with you.
We do not seek to collect special-category personal data as a controller. Personal data about a customer’s owners and guests is Customer Data that the customer controls; see our Data Processing Addendum.
3. Why we use it, and our lawful bases
Under the UK GDPR we rely on the following lawful bases:
- Contract — to create and administer your account, provide the Platform, take payment and provide support.
- Legitimate interests — to secure and improve the Platform, prevent fraud and abuse, respond to enquiries, and carry out limited business-to-business marketing to existing customers about similar services; we balance these against your rights and you can object at any time.
- Legal obligation — to meet our tax, accounting and other legal duties.
- Consent — for optional cookies and for any marketing where consent is required; you can withdraw consent at any time.
As part of our fraud-prevention work, we compare hashed card fingerprints provided by our payment processor solely to prevent abuse of referral and promotional offers; the card details themselves never reach our systems.
5. Sub-processors and service providers
We use a small set of trusted providers to host and operate the Platform. The same providers process Customer Data under our Data Processing Addendum:
- Supabase — Managed Postgres database, authentication and file storage that hold the platform’s core data. European Union / United Kingdom region (as configured).
- Vercel — Application hosting and content delivery for the platform’s web front end and serverless functions. Global edge network; primary region configured for the EU/UK.
- Stripe — Subscription billing and card payment processing for HostHQ’s own charges to the customer. European Union / United Kingdom, with group entities elsewhere.
- Amazon Web Services (AWS SES) — Delivery of transactional and notification email sent by the platform. European Union / United Kingdom region (as configured).
- The customer’s configured channel manager / PMS — Two-way synchronisation of the customer’s own property, booking and guest data with the property-management system that customer has connected (for example Uplisting). Determined by that provider; named in the customer’s integration settings.
- PriceLabs (optional add-on) — Market-rate benchmarking for customers who enable the PriceLabs integration. United States, with data-transfer safeguards in place.
Each provider is bound by a written contract that restricts their use of personal data to providing their service to us. We keep the current list up to date and notify customers of changes as set out in the Data Processing Addendum.
6. International transfers
We aim to keep personal data within the UK and the European Economic Area. Where a provider processes personal data outside the UK/EEA (for example an add-on hosted in the United States), we put appropriate safeguards in place — such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any additional measures needed — so the data stays protected.
7. How long we keep it
We keep the personal data described in this notice for six years after the end of the relationship (or, for financial and transactional records, at least six years from the end of the accounting period they relate to). Our lawful bases for this retention are: (a) legal obligation — UK tax and company law (including HMRC record-keeping rules) requires us to keep financial and transactional records, and the personal details embedded in them, for at least six years; and (b) legitimate interests — keeping an accurate account of what happened so we can respond to complaints, disputes, chargebacks, insurance claims and regulatory enquiries, and detect fraud. We keep the surrounding records whole because redacting individual details from financial records would undermine their evidential value. We review this retention period and will shorten it for categories of data where the justification no longer holds. After the retention period we delete or anonymise the data.
8. Your rights
Under UK data protection law you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have data erased in certain circumstances;
- restrict or object to our processing, including direct marketing;
- data portability, where processing is based on consent or contract and carried out by automated means; and
- withdraw consent at any time, without affecting processing already carried out.
To exercise any of these rights, contact us at info@hosthq.uk. We will respond within one month, and will tell you promptly if a complex request needs longer. Exercising these rights is free unless a request is manifestly unfounded or excessive.
If you are a guest or a property owner of one of our customers, that customer — the property manager or host you dealt with — is the controller of your data, and the quickest route is to send your request to them directly. If you send it to us instead, we will pass it to that customer without undue delay and help them respond; we do not answer it in their place.
Some records cannot be erased on request. Where the law requires us to keep records — including the six-year retention of financial and transactional records described in section 7 — the right to erasure does not apply to them (Article 17(3)(b) UK GDPR). Rather than erase those records, we restrict them: we keep them, stop using them for anything beyond meeting our legal obligations and handling legal claims, and delete or anonymise them when the retention period ends. We will tell you when we rely on this exemption and why.
10. How we protect personal data
We use technical and organisational measures appropriate to the risk, including encryption in transit, access controls, tenant isolation so one customer’s workspace cannot read another’s, and restricted administrative access. No system is perfectly secure, but we work to protect personal data and to detect and respond to incidents.
11. Complaints and the ICO
If you have a concern about how we handle personal data, please contact us first so we can try to resolve it. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority, at ico.org.uk, by calling its helpline, or by writing to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
12. Changes to this notice
We may update this notice from time to time. When we make a material change we will update the date at the top and, where appropriate, tell you directly.
13. Company details
HostHQ’s operating company and its registered details will be confirmed here before this notice takes effect. Not registered for VAT.