Privacy policy

1. Who we are

Beyond Stays Group Ltd (“Beyond Stays”, “we”, “us”, “our”) is the data controller for personal data collected through this website (beyondstays.co.uk) and in connection with your booking and stay. For properties where we act as a disclosed managing agent, the property owner may also be a controller; where that is the case it is explained to you at the time.

You can contact us about this policy or your data at [email protected].

2. The personal data we collect

Depending on how you interact with us, we may collect:

• Contact details: name, email, phone number, and postal address.
• Booking information: dates, number of guests, property, and preferences.
• Identity verification: photo ID presented at check-in.
• Payment information: handled securely by our payment processor; we do not store full card details.
• Communications: messages exchanged by email, WhatsApp, phone, or platform messaging.
• Technical and analytics data: IP address, device, browser, and pages viewed.
• Where installed at a property and clearly signposted: external CCTV footage and noise-monitoring alerts, used for security and nuisance prevention only.

3. How and why we use your data

We use your personal data on the following lawful bases:

• To take and fulfil your booking and provide the property and related services: performance of a contract.
• To verify identity, take and manage deposits, prevent fraud, and protect our properties, guests, and neighbours: our legitimate interests and, where relevant, legal obligation.
• To handle complaints, damage, and any charges: performance of a contract and our legitimate interests.
• To meet our tax, accounting, and other legal duties: legal obligation.
• To send you marketing about our own similar accommodation and offers: see section 5.
• To operate, secure, and improve our website and services: our legitimate interests.

4. Who we share your data with

We share personal data only where needed, with:

• Guesty, our property management and booking platform.
• Stripe, our payment processor.
• Klaviyo, our email marketing platform.
• Google Workspace, for email and document storage, and Cloudflare, for website security and performance.
• Property owners, where we act as their managing agent.
• Professional advisers, regulators, or authorities, where we are legally required to do so.

We do not sell your personal data and we do not use it for third-party advertising. Where personal data is transferred outside the UK, we rely on appropriate safeguards such as UK-approved Standard Contractual Clauses.

5. Marketing

If you book with us or make a direct enquiry, we will add you to our mailing list and send you occasional marketing about our own similar accommodation, offers, and direct-booking discounts. We do this on the “soft opt-in” basis permitted under the Privacy and Electronic Communications Regulations 2003, because you are an existing or prospective customer and we are only telling you about our own similar services.

We will only ever email you about staying with Beyond Stays, never anyone else. We do not share your details with other organisations for their own marketing, and we never sell them.

You are given a clear opportunity to opt out at the point we collect your details, and every email we send includes a one-click unsubscribe link. You can opt out at any time, free of charge, by any of these routes:

• Unsubscribe here: beyondstays.co.uk/opt-out
• Use the one-click unsubscribe link in any marketing email
• Reply STOP to any marketing SMS or WhatsApp message
• Email us at [email protected]

We will action any opt-out promptly and keep a record so we do not contact you again for marketing. Service messages relating to your booking, such as check-in details, payment receipts and anything you need in order to stay with us, will continue regardless of your marketing preferences, because we need to send those to deliver your booking.

6. How long we keep your data

• Enquiries that do not lead to a booking: 12 months.
• Booking and financial records: 6 years, to meet tax and accounting requirements.
• Marketing contacts: until you unsubscribe, after which we keep a minimal record on a suppression list to honour your choice.
• Website analytics: 26 months.
• CCTV and noise-monitoring data, where used: 30 days, unless needed for a specific incident.

7. Your rights

You have the right to access your data, to have it corrected or erased, to restrict or object to its use (including objecting to marketing at any time), to data portability, and to withdraw consent where we rely on it.

To exercise any of these rights, contact us at [email protected]. We will respond within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk, although we would welcome the chance to put things right first.

8. Cookies

Our website uses cookies as described in our Cookie Policy, including analytics and, where you have signed up, cookies relating to our marketing sign-up forms.

9. Changes to this policy

We may update this policy from time to time. The current version is always available on our website, and we will make clear when it was last updated.

10. Contact

For any question about this policy or your personal data, contact us at [email protected].