The plain-English version: where data is kept, how long for, and what your data protection lead will want to know. We're a UK company and UK GDPR is the law we work to. You're in charge of your guests' data; we look after it for you.
What we store
| What | Examples | Legal basis |
|---|---|---|
| Your account | Your name, email, password (scrambled so nobody can read it), logos | Our contract with you |
| Your catalogue | Locations, products, menus, pricing plans | Our contract with you |
| Enquiries | Guest name, email, phone, event details | Taking steps at the guest's request before a contract. Marketing only with their opt-in. |
| Quotes | What they chose, totals, comments | Your contract with the guest |
| Technical records | Error reports and request logs | Legitimate interest, to keep the service running |
Where data is kept
Innkept runs on servers in London. A few services we rely on, such as error monitoring, are based outside the UK, and each one is covered by the UK's approved safeguards for sending data abroad.
The companies we use
The full list, with what each one does and where, is on our sub-processors page. You can sign up there to be emailed before anything changes. The ad-platform services (Google, Meta, TikTok) only receive data if you switch them on in Settings → Analytics & tracking.
How long we keep things
- While you're a customer, we keep your data for as long as your account is open.
- When you leave, you can export your data from the dashboard for 90 days. We then delete it within 90 days of your account ending, apart from records the law says we must keep, such as invoices.
- Backups are cleared on a rolling 35-day cycle.
Your guests' rights
Your guests have the usual UK GDPR rights: to see their data, correct it, have it removed, take it elsewhere, or object. If a guest asks you:
- To see or take their data: open Leads and use Export CSV, or copy the details from their lead.
- To be forgotten: open their lead and anonymise it. Their name, email, phone, IP address and tracking details are removed for good. The lead stays, without them, so your figures still add up.
- To stop marketing: remove them from your mailing list, for example in Mailchimp.
If a guest gets in touch with us, we'll pass it to you and copy you on the outcome. To raise a privacy question yourself, contact us.
The data processing agreement
Our data processing agreement is published in full, and you accept it from your dashboard. It includes the UK's approved wording for any data sent abroad. Most venues don't need to negotiate it.
Marketing permission on the booking form
Guests don't have to tick a consent box to send an enquiry. Asking for a quote is a request for you to get in touch, and that's enough legal basis to reply.
Marketing is different. You can add a marketing opt-in tickbox to the contact step of your booking form, in your own words, on the Widget page. It's never pre-ticked. Only guests who tick it should get your newsletters.