Two roles to keep separate
Innkept processes personal data in two distinct capacities, governed by different documents:
- This marketing site — we are the controller for personal data you give us when you sign up for an account, contact our support team, or subscribe to our newsletter or sub-processor change notifications. This page is the privacy notice for those activities.
- The embedded quote widget — we are the processor; the operator (the venue or caterer running the widget) is the controller. The terms of that relationship are in our Data Processing Agreement. The visitor's privacy notice is the operator's responsibility.
What we collect on this site
- Account: name, work email, password (hashed).
- Billing: handled by Stripe; we don't see card numbers.
- Support: what you send us through our contact form (your name, email, business name and message) or by email, including any attachments.
- Sub-processor change notification subscribers: email address and a verification flag.
We do not run third-party analytics, advertising, or cross-site tracking on this marketing site. The dashboard sets a session cookie and a CSRF cookie; both are strictly necessary.
Lawful bases
- Performance of contract (Article 6(1)(b) UK GDPR) for delivering the service to operators.
- Consent (Article 6(1)(a)) for the newsletter and sub-processor change notifications.
- Legitimate interests (Article 6(1)(f)) for security logging and abuse prevention.
Sub-processors
The third parties we engage to deliver the service are listed at /legal/sub-processors. You can subscribe to change notifications from that page.
International transfers
Where personal data is transferred outside the United Kingdom we rely on the UK Data Bridge (UK Extension to the EU-US Data Privacy Framework), the UK Addendum to the EU SCCs, or the IDTA, depending on the recipient. The transfer mechanism for each sub-processor is identified in the list linked above.
Your rights
Under UK GDPR you have the right to access, rectify, erase, restrict, port, or object to processing of your personal data. To exercise any of these rights write to dpo@innkept.co.uk.
You also have the right to complain to the Information Commissioner's Office (ico.org.uk), the UK's supervisory authority for data protection.
Retention
We keep account data for as long as your account is active and for 12 months after closure, then delete or anonymise it. Backup copies are pruned within the backup retention window (currently 35 days). Subscriber emails are kept until unsubscribe. For each email the service sends, we keep a delivery record (recipient, subject, time, and whether it was delivered, bounced or marked as spam) for 12 months, so we and the venue can confirm what reached whom; email content is not kept, and we don't track opens or clicks. Other activity records (lead deliveries, texts, payment events) are kept for 90 days, as is the sign-in history for your team's accounts (time, IP address and browser), which we use to help with account security and support questions.
Contact
Innkept, United Kingdom. Data protection contact: dpo@innkept.co.uk.