MD Hospitality & Management Consultancy is the data controller for data collected from hotel operators who subscribe to our platform. For personal data relating to hotel guests, LuviaGuest acts as a data processor on behalf of the hotel (the data controller).
Our registered address is: [MD Hospitality & Management Consultancy, Registered Address, England]. Our Data Protection contact is reachable at [email protected].
We are registered with the Information Commissioner's Office (ICO) under registration number [ICO Registration Number].
The table below sets out each category of data we collect, the purpose, and the lawful basis under UK/EU GDPR:
| Data Category | Specific Data | Purpose | Lawful Basis | Retention |
|---|---|---|---|---|
| Hotel Operator Data | Name, email, phone, company name, billing address | Account management, billing, support | Contract | Duration of subscription + 7 years (tax) |
| Guest Identity | Full name, email address | Personalising the guest app, check-in validation | Contract | 90 days post check-out |
| Reservation Data | Room number, check-in/out dates, booking reference | Delivering stay services, request fulfilment | Contract | 90 days post check-out |
| Guest Requests | Content of requests (e.g. "extra towels"), timestamps | Fulfilling service requests, hotel operations | Legitimate Interests | 90 days post check-out |
| ID Documents | Passport or driving licence image | Identity verification for self check-in only | 90 days post check-out (max) | |
| Payment Data | Transaction reference, amount, status | Processing outstanding balances at check-in | Contract | 7 years (legal/tax obligation) |
| AI Chat Conversations | Messages sent to the AI concierge | Generating AI responses; quality improvement | Legitimate Interests | 30 days, then anonymised |
| User-Generated Content | Photos and images uploaded via the maintenance / photo-reporting hub | Reporting and resolving maintenance issues; creating a timestamped accountability record | Contract Legitimate Interests | 90 days post check-out; extended for the duration of any open formal dispute |
| WhatsApp Messages | Messages routed to hotel staff via WhatsApp | Delivering guest requests to hotel staff | Contract | Meta's own retention policies apply |
| Usage Data | Pages visited in the app, features used, timestamps | Platform improvement, analytics | Legitimate Interests | 12 months, then aggregated |
| Device & Technical Data | IP address, browser type, device type | Security, fraud prevention | Legitimate Interests | 30 days |
| Cookie Data | Session cookies, preference cookies | App functionality, remembering preferences | See Cookie Policy |
Identity documents (passports and driving licences) may contain special category data under UK/EU GDPR Article 9, including nationality and physical characteristics. We process this data only on the basis of your explicit consent and only for the purpose of verifying your identity in connection with your hotel reservation.
You can withdraw your consent at any time by contacting the hotel or emailing [email protected]. Withdrawing consent will mean self check-in is no longer available for your current stay.
We do not sell your personal data. We share it only with the following categories of recipients:
- Your hotel — as the Data Controller, your hotel's authorised staff can access your guest data via the admin panel.
- Stripe Inc. — for secure payment processing. Stripe is PCI DSS Level 1 certified.
- Supabase Inc. — our database and file storage provider, hosted on AWS Frankfurt (EU). Guest-submitted photos (maintenance / photo-reporting hub) are stored in Supabase Storage in the same EU region.
- Anthropic PBC — the provider of the Claude AI model that powers our concierge. Chat content is sent to Anthropic's API for processing.
- Meta Platforms (WhatsApp Business API) — for routing guest requests to hotel staff via WhatsApp.
- Amazon Web Services — cloud infrastructure hosting, EU region.
- Law enforcement or regulatory authorities — where we are legally required to disclose data.
All third-party sub-processors are bound by Data Processing Agreements and are required to maintain appropriate security standards.
Some of our sub-processors are based in the United States. Where we transfer personal data outside the UK or EEA, we ensure appropriate safeguards are in place:
- For transfers from the UK: we use the International Data Transfer Agreement (IDTA) approved by the ICO.
- For transfers from the EU: we use the Standard Contractual Clauses (SCCs) approved by the European Commission.
- We conduct Transfer Impact Assessments for all international transfers to ensure an adequate level of protection.
We implement appropriate technical and organisational measures to protect your personal data, including:
- Encryption at rest using AES-256 for all stored personal data.
- Encryption in transit using TLS 1.3 for all data transmission.
- Role-based access controls ensuring staff only access data necessary for their role.
- Multi-factor authentication required for all admin panel access.
- Regular security assessments including penetration testing.
- Data minimisation — we collect only what is necessary for each purpose.
In the event of a personal data breach that is likely to result in risk to your rights and freedoms, we will notify you and the relevant supervisory authority within the legally required timeframes (72 hours to the ICO/supervisory authority; without undue delay to affected individuals where there is a high risk).
Under UK GDPR and EU GDPR, you have the following rights. You can exercise any of these by contacting us at [email protected]. We will respond within 30 days.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk (UK), or your local data protection authority (EU). We would however appreciate the opportunity to address your concerns before you contact a supervisory authority.
The LuviaGuest self check-in process involves automated checks (name matching, time window, payment status, room status). These checks may result in your self check-in being blocked or placed on hold. These are not solely automated decisions with significant effects — hotel staff can review and override any automated outcome at any time.
The AI concierge generates responses automatically based on your inputs. No automated profiling is used to make decisions about your stay or your access to services.
The LuviaGuest app is not intended for use by persons under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has submitted data via the App without appropriate consent, please contact us at [email protected] and we will take immediate steps to delete the data.
We may update this Privacy Policy from time to time. Where changes are material, we will notify hotel operators by email and update the effective date at the top of this document. Guests will be prompted to review the updated policy on their next use of the App. Continued use of the App constitutes acceptance of the updated policy.