Privacy Notice (UK GDPR & Data Protection Act 2018)

1. Overview

This Privacy Notice explains how ACCOMODOO.COM LTD (“Accomodoo”, “we”, “our”, “us”) collects, uses, shares and protects personal data when you:

  • visit our websites,
  • contact us,
  • request a demo or trial,
  • create an account, or
  • use our platform (including operational tools for vacation-rental management), or receive booking support, distribution, payment administration or related digital platform services connected with short-term rental operations.

Some platform features may process personal data about guests, Property Owners, customers and authorised users. Depending on the context, Accomodoo acts as:

  • Controller for its own website, business, account, billing, security, marketing, booking-support, payment-administration and compliance activities; and/or
  • Processor where it processes guest, owner, booking and operational data solely on behalf of a customer and under that customer’s documented instructions.
2. Data controller and contact details

ACCOMODOO.COM LTD
71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Company number: 16327953

ICO registration: ACCOMODOO.COM LTD — Reference ZB978729 (ico.org.uk/register)

Contact emails:
Legal/privacy: legal@accomodoo.com
Complaints: complaints@accomodoo.com

3. Personal data we collect

Depending on how you interact with us, we may collect:

A) Website and enquiry data (Controller)
  • Identification and contact details (name, email, phone, company)
  • Enquiry content and communications
  • Marketing preferences
B) Account and customer admin data (Controller)
  • User profile data for admin, billing and support
  • Business details (company name, address, billing info)
  • Contract and subscription records
  • Support tickets, call notes and troubleshooting logs
C) Platform data (often Processor for customers)

Depending on customer configuration and the nature of the services provided, the platform and related operational services may process:

  • Guest data (name, contact details, booking details, stay dates, messages)
  • Booking and payment-administration data, including booking amounts, payment status, transaction references, refunds and chargebacks
  • Operational data (tasks/checklists for cleaning, check-in, maintenance; status updates; notes; photo reports)
  • Owner portal data (owner contact details, limited portfolio visibility as configured)
  • Technical logs for security and reliability
D) Technical and usage data
  • IP address, device/browser identifiers, log files, timestamps, referring pages, and feature usage analytics (subject to cookie settings and legal requirements).

Special category data: We do not intentionally collect special category data. If users upload it into free-text fields or documents, we will minimise use and protect it appropriately.

4. Where we get data from
  • Directly from you (forms, email, calls, platform usage), from bookings, guest communications and operational workflows connected with property-related services, where applicable.
  • From our customers/your employer (where you’re a user invited to their workspace)
  • From devices/cookies and similar technologies (see section 9)
  • From connected booking channels, payment providers, Property Owners, customers and authorised local service providers, where applicable
5. How we use personal data and our legal bases (Controller)

We process personal data where we have a lawful basis under Article 6 UK GDPR:

  • Operate, secure and maintain our website and services
    Legal basis: Legitimate interests
  • Respond to enquiries; schedule demos; provide customer support
    Legal basis: Contract / steps prior to entering a contract; legitimate interests
  • Create and administer accounts; billing and subscription management
    Legal basis: Contract; legal obligation (e.g., accounting records)
  • Service communications (e.g., security, uptime, product updates)
    Legal basis: Legitimate interests; contract (where applicable)
  • Marketing communications (where permitted)
    Legal basis: Consent and/or legitimate interests (as applicable)
  • Analytics and product improvement
    Legal basis: Legitimate interests and consent where required (non-essential cookies)
  • Compliance, dispute handling, and enforcement
    Legal basis: Legal obligation; legitimate interests
  • Provide booking support, distribution, administrative and related operational services to property owners or operators
    Legal basis: Contract; legitimate interests; legal obligation where applicable

Where we act as a processor, the customer is the controller of the relevant guest, owner, booking and platform-content data, and Accomodoo processes that data only under the customer’s documented instructions.

Where Accomodoo acts as an independent controller, it processes limited personal data for the purposes and legal bases described in this Notice, including contractual administration, invoicing, compliance, fraud prevention, platform security, payment administration and booking support.

Customers are responsible for providing any privacy information required to their guests, Property Owners and authorised users.

6. Sharing and disclosures

We may share personal data with:

  • Relevant Property Owners or customers, connected booking channels, payment providers and authorised local service providers, where necessary to administer bookings, payments and related platform services
  • Service providers / processors (hosting, email, analytics, CRM, customer support tooling, security, backups), acting under contracts and appropriate safeguards
  • Professional advisers (legal/accounting) where necessary
  • Authorities where legally required or to protect rights and safety
  • Corporate transactions (buyers/investors and advisers) with confidentiality safeguards

We do not sell personal data.

7. International transfers

Where personal data is transferred outside the UK, we use recognised safeguards such as UK adequacy regulations, the IDTA, and/or other contractual and technical measures appropriate to transfer risk.

8. Cookies and similar technologies

We use cookies and similar technologies for core functionality and (where enabled) analytics and performance. Where required, we obtain consent for non-essential cookies. You can control cookies via browser settings and any on-site cookie controls.

9. Retention

We retain personal data only for as long as reasonably necessary.

Enquiry and sales data is normally retained for up to 24 months. Account, contract, billing and support records may be retained for the duration of the customer relationship and for up to six years afterwards. Tax and VAT records are retained for the applicable statutory period, which may be up to ten years where the VAT One Stop Shop applies. Marketing data is retained until you unsubscribe or object.

Where Accomodoo acts as a processor, retention and deletion are governed by the customer contract, customer settings and documented instructions.

Data may be retained for longer where required in connection with a legal obligation, dispute, investigation or claim.

10. Your rights (UK GDPR)

Subject to conditions and exemptions, you may have the right to:

  • access, rectification, erasure, restriction
  • object to processing based on legitimate interests
  • data portability (where applicable)
  • withdraw consent (where we rely on consent)

To exercise rights (controller context): legal@accomodoo.com
Complaints: complaints@accomodoo.com
You also have the right to complain to the ICO.

If you are a guest/third party whose data is processed by a customer using our platform, we may direct you to the relevant customer (controller) where appropriate.

11. Automated decision-making

We do not generally use automated decision-making producing legal or similarly significant effects. If this changes, we will update this Notice and provide appropriate information.

12. Changes to this Notice

We may update this Notice from time to time. The latest version and effective date will be published on our website. Where a change materially affects how we use personal data, we will provide additional notice where required by law.


Data Protection & Information Security Policy

1. About this Policy

This Policy is a public, high-level summary of the organisational and technical measures used by ACCOMODOO.COM LTD (“Accomodoo”, “we”, “our”, “us”) to protect personal data and confidential information. It supports compliance with the UK GDPR and the Data Protection Act 2018, and is designed to reduce risks of unauthorised access, loss, misuse, alteration or disclosure.

Status: This document is published for transparency. It does not form part of any contract, except to the extent required by applicable law.

2. Who we are

ACCOMODOO.COM LTD
71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Company number: 16327953

ICO registration: ACCOMODOO.COM LTD — Reference ZB978729 (see ico.org.uk/register)

Contacts:
Legal: legal@accomodoo.com
Complaints: complaints@accomodoo.com

3. Scope

This Policy applies to all Accomodoo directors, officers, employees, agency staff and contractors (“Personnel”), and to all information processed by or on behalf of Accomodoo, including:

  • personal data processed for operating our websites and customer relationships;
  • personal data processed within our platform (including booking and operations features), and personal data processed in connection with booking support, distribution, administrative or agency-related services provided to property owners or operators;
  • system credentials, access tokens, and other confidential business information.

Personnel must comply with this Policy as a condition of access to Accomodoo systems.

4. Data protection principles

We process personal data in accordance with the UK GDPR principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity/confidentiality; and accountability.

5. Governance and accountability

We maintain a governance framework which includes:

  • management accountability for privacy and security;
  • a designated privacy/security owner for oversight, training and incident coordination;
  • risk-based reviews of higher-risk processing;
  • supplier/sub-processor due diligence and contractual controls appropriate to risk.
6. Key security controls (summary)
6.1 Access control
  • Access to guest, owner, property and booking-related data is restricted according to role, business need and service scope.
  • Multi-factor authentication for administrative and cloud accounts
  • Joiner/mover/leaver procedures; prompt revocation on role change/termination
  • Strong password and credential management standards
6.2 Encryption and secure communications
  • Encryption in transit (TLS 1.2+) where supported
  • Encryption at rest for supported storage and managed systems
  • Secure secret storage for keys/tokens where applicable
6.3 Monitoring, vulnerability management and testing
  • Security logging/monitoring proportionate to system risk
  • Regular patching and remediation based on severity
  • Periodic vulnerability scans and security reviews for internet-facing services
6.4 Resilience and backups
  • Backups for critical systems and configuration
  • Disaster recovery / business continuity measures proportionate to service criticality
  • Periodic restore tests where appropriate
6.5 Training and confidentiality
  • Confidentiality obligations for Personnel and need-to-know handling
  • Periodic privacy and security awareness training
7. Data lifecycle controls
  • Collection/use only for defined purposes and minimum necessary data, including in relation to platform, booking support, operational and administrative service activities.
  • Retention aligned to legal, operational and contractual requirements
  • Secure deletion or anonymisation when no longer required
8. International transfers

Where personal data is transferred outside the UK, we use recognised safeguards such as UK adequacy regulations, the International Data Transfer Agreement (IDTA) and/or other contractual/technical measures appropriate to risk.

9. Incident and breach management

We maintain procedures to identify, contain, investigate and remediate incidents. Suspected incidents must be reported immediately internally. Where required, we notify the ICO without undue delay and, where feasible, within 72 hours of awareness, and notify affected individuals where legally required.

10. Supplier and contractor requirements

Where suppliers/contractors access Accomodoo data, we require appropriate controls including confidentiality, access restrictions, incident notification, and secure return/deletion on termination.

11. Review and changes

This Policy is reviewed at least annually and whenever our processing, systems or risk profile materially changes. The latest version will be published on our website.