This policy explains what personal data Prime Host collects, why we collect it, who we share it with and what rights you have over it. It applies to our website, to stays in our properties, and to everyone we deal with in the course of our business.

We are the data controller for the personal data described here. That means we decide what data is collected and what happens to it, and we are accountable for it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Prime Host is the trading name of PRIME H UK LTD, a company registered in England and Wales. We take long leases on residential properties in London and let them to guests on a short-stay, mid-term and corporate basis. We are the principal in those lettings: when you book with us, your contract is with us, not with the building’s owner.

We are not required to appoint a Data Protection Officer, and we have not appointed one. Responsibility for data protection sits with our directors, who can be reached at the address above.

2. Who this policy covers

This policy covers personal data about:

• Guests — anyone who enquires about, books or stays in one of our properties, whether they book with us directly or through a booking platform;
• Property owners and their advisers — landlords who lease property to us, and the agents, surveyors and solicitors acting for them;
• Website visitors — anyone who uses prime-host.co.uk, including people who use our revenue estimator or contact forms;
• Suppliers and contractors — cleaners, maintenance contractors, and the individual contacts at companies we buy from;
• Applicants — people who apply to work with us.

3. Personal data we collect

Guests

• Identity and contact details — name, email address, telephone number, home address, and the names and number of people in your party.
• Identity verification — a photograph of a passport, driving licence or national ID card, and in some cases a selfie for comparison, where we need to confirm who is staying. We collect this to protect the property and to meet obligations imposed by our leases and insurers.
• Booking and stay data — property, dates, rate, booking reference, arrival time, special requests, access codes issued to you, and records of check-in and check-out.
• Payment data — the amount, currency, date and status of payments, the last four digits and type of card, and any refund or chargeback. We do not receive or store your full card number. Card details are captured and held by our payment processor.
• Communications — emails, messages sent through booking platforms, WhatsApp and SMS messages, and notes of telephone calls.
• Reviews and feedback — what you write about your stay, and what we record about it.
• Incident records — where something goes wrong: damage, complaints from neighbours, breaches of house rules, or a matter reported to the police or our insurers.

Property owners

• Name, contact details and correspondence.
• Property address, title information, lease and mortgage details, and consents from freeholders, superior landlords and lenders.
• Bank details for rent payments, and identity and proof-of-address documents where we are required to verify who we are contracting with.
• Safety certificates and compliance records relating to the property.

Website visitors

• Information you type into a form, including any property address and details you enter into our revenue estimator.
• IP address, approximate location derived from it, device and browser type, operating system, referring page, pages viewed and time spent.
• Cookie identifiers, as described in section 8.

4. Where we get your data

Most of it comes from you. We also receive personal data from sources other than you, and UK GDPR requires us to tell you what they are:

• Booking platforms — Airbnb, Booking.com, Vrbo and Expedia Group pass us the guest details needed to deliver a stay booked through them. What we receive varies by platform, and typically includes your name, a masked or real email address, phone number, party size, booking dates and any messages you send.
• Our payment processor — the outcome of payments and card verification checks.
• Identity verification providers — the result of a document check, where one is carried out.
• Property owners and their agents — information about a property and the people connected with it.
• Publicly available sources — Companies House, HM Land Registry and public websites, where we need to confirm who owns a property or who we are contracting with.

5. How and why we use your data

We only use personal data where the law allows. The table below sets out what we do, and the lawful basis under Article 6 of the UK GDPR that we rely on for each.

Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights and freedoms, and concluded it is not. You can ask us to explain that assessment, and you can object to the processing — see section 15.

6. Special category data

We do not ask for data about your health, race, ethnicity, religion, political opinions, trade union membership, sex life, sexual orientation, genetics or biometrics, and we ask that you do not send it to us.

Occasionally a guest volunteers such information — most often an accessibility requirement or an allergy relevant to cleaning products or bedding. Where you tell us something like that so we can accommodate you, we treat it as given with your explicit consent under Article 9(2)(a), use it only to meet the need you have described, and delete it once your stay is over. You can withdraw that consent at any time, though it may mean we cannot meet the requirement.

Where we check an identity document, we use it to confirm that the document is genuine and that it matches the person booking. We do not use facial recognition to create a biometric template, and we do not use it to identify you across other contexts.

7. Marketing

If you have stayed with us or enquired about a stay, we may email you about similar stays. This is the “soft opt-in” permitted by the Privacy and Electronic Communications Regulations 2003. Every such email carries an unsubscribe link, and we act on unsubscribe requests promptly.

We will not send you marketing by email or SMS in any other circumstances unless you have asked us to. We do not sell, rent or share your details with third parties for their own marketing.

You can stop marketing at any time by using the unsubscribe link or emailing info@prime-host.co.uk. We will still send you messages we need to send about a booking you have made — confirmations, access instructions and the like — because those are part of delivering your stay, not marketing.

8. Cookies

Cookies are small files stored on your device. We use them in three ways:

• Strictly necessary cookies keep the site working — page delivery, security and remembering your cookie choice. These do not require your consent and cannot be switched off.
• Analytics cookies tell us which pages are visited and how people move through the site, so we can improve it.
• Marketing cookies measure whether an advert led to an enquiry.

We set analytics and marketing cookies only if you accept them. Our cookie banner lets you reject all non-essential cookies as easily as accepting them, and refusing them does not limit your access to the site. You can change your mind at any time through the banner, or by clearing cookies in your browser settings.

Some non-essential cookies are set by third parties, who will process the data they collect under their own privacy policies.

9. Who we share your data with

We do not sell your personal data. We share it only where there is a reason to, with:

• Booking platforms — Airbnb, Booking.com, Vrbo and Expedia Group, where your stay is booked or managed through them. See section 10.
• Payment processing — Stripe, Inc. and its group companies, who process card payments and hold card data. Stripe’s privacy policy is at stripe.com/privacy.
• Operational suppliers — cleaning and laundry companies, maintenance contractors, locksmiths and key or smart-lock providers, who receive only what they need to attend the property.
• Technology suppliers — our website host, email provider, property management and channel management software, and analytics providers, who process data on our instructions.
• Professional advisers — accountants, auditors, insurers, insurance brokers and solicitors, where they need it to advise us.
• Authorities — HM Revenue & Customs, local authorities, the police and other regulators, where we are legally required to disclose, or where disclosure is necessary to report or investigate a crime.
• A buyer, if we sell or reorganise our business, under confidentiality terms.

Where a supplier processes data on our behalf, we have a written contract requiring them to keep it secure, use it only for what we have asked, and delete or return it when the work is done.

10. Booking platforms

When you book through Airbnb, Booking.com, Vrbo or Expedia Group, the platform and Prime Host each decide, separately, how to use your data. We are independent controllers, not joint controllers: neither of us processes your data on the other’s behalf, and each of us is separately responsible for its own compliance.

What that means in practice is that this policy explains what we do with your data. What the platform does with it is governed by its own privacy policy, and any rights you want to exercise against the platform have to be exercised with the platform:

• Airbnb — airbnb.co.uk/terms/privacy_policy
• Booking.com — booking.com/content/privacy.html
• Vrbo and Expedia Group — expediagroup.com/privacy

Where you book with us directly, we share your booking with a platform only if there is a reason to — for example, if you originally found us there and the reservation has to be reconciled.

11. International transfers

Some of the organisations we use are based outside the United Kingdom, or use infrastructure that is. That includes our booking platforms and our payment processor, which have operations in the United States and the European Economic Area.

Where personal data leaves the UK, we rely on one of the safeguards UK data protection law allows:

• UK adequacy regulations, where the destination country has been assessed as providing adequate protection — this covers transfers to the EEA;
• the International Data Transfer Agreement, or the UK Addendum to the European Commission’s Standard Contractual Clauses, backed by an assessment of the risks in the destination country.

You can ask us for details of the safeguard applying to a particular transfer, and for a copy of the relevant clauses, by emailing us.

12. How long we keep your data

We keep personal data only as long as we need it. In practice:

Where a claim, dispute or investigation is live, we keep the relevant data until it is concluded, even if the period above has run. When a period ends we delete the data, or anonymise it so it can no longer be linked to you.

13. Security

We take appropriate technical and organisational measures to protect personal data. These include encrypted connections to our website, access controls so staff and contractors see only what their role requires, multi-factor authentication on our core systems, and written confidentiality obligations for everyone who handles data for us. Card data is handled by our payment processor under the PCI DSS standard and does not reach our systems.

No system is completely secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner’s Office within 72 hours of becoming aware of it, and we will tell you directly where the risk to you is high.

14. Automated decisions and profiling

We do not make decisions about you by automated means alone that produce legal effects or similarly significantly affect you.

We do use automated pricing tools that set nightly rates according to demand, season and local events. Those tools price properties, not people: the rate shown does not vary according to who you are, and no profile of you is used to set it.

15. Your rights

Under UK data protection law you have the right to:

1. Be informed about how we use your data — which is what this policy is for.
2. Access a copy of the personal data we hold about you.
3. Rectification — have inaccurate data corrected and incomplete data completed.
4. Erasure — have data deleted where we no longer have a good reason to hold it.
5. Restrict processing — have us pause our use of your data while a question about it is resolved.
6. Object — to processing based on our legitimate interests. Where you object to direct marketing, we will stop, with no exceptions.
7. Data portability — receive data you gave us in a structured, commonly used, machine-readable format, or have it sent to another controller.
8. Withdraw consent at any time, where we rely on consent. This does not affect anything we did before you withdrew it.

To exercise any of these, email info@prime-host.co.uk. These rights are free to use. We will respond within one month, and will tell you if we need to extend that by up to two further months because the request is complex. We may ask you to confirm your identity before we release personal data, which is a safeguard for you rather than an obstacle.

Some of these rights are qualified. For example, we can decline to erase data we are legally required to keep, such as accounting records, and we can refuse a request that is manifestly unfounded or excessive. If we decline all or part of a request, we will tell you why and what you can do about it.

16. Children

Our services are sold to adults. Bookings must be made by someone aged 18 or over, and our website is not directed at children.

Children do stay in our properties as members of a guest’s party. Where that happens we collect no more than the first name and age of each child, given to us by the lead guest, and only where occupancy or bedding arrangements make it necessary. We do not market to children and do not knowingly collect their data in any other circumstances. If you believe a child has given us personal data, tell us and we will delete it.

17. Changes to this policy

We review this policy at least once a year and update it when our practices change. The version number and effective date at the top of the page show when it last changed. Where a change materially affects how we use data about you, we will tell you directly — by email where we hold your address — rather than relying on you to notice the update.

18. Contact and complaints

For anything to do with your personal data, contact us at info@prime-host.co.uk, or write to the registered office address in section 1.

If you are not satisfied with how we have handled a data protection matter, you can complain to the UK’s supervisory authority. We would rather have the chance to put it right first, but you do not have to come to us before going to the regulator.