Legal
Privacy Notice
1. About this notice
MSK Guestbook helps hospitality businesses connect guest journeys and daily operations with their existing property management systems. This notice explains how [MSK Guestbook Limited, registered in England and Wales under number [COMPANY NUMBER], with its registered office at [ADDRESS]], trading as MSK Guestbook, uses personal information when we are responsible for deciding why and how it is used.
Contact our privacy team at privacy@mskguestbook.com. [Add DPO or representative details only if applicable.]
This notice covers our public website at www.mskguestbook.com, our operator portal at msk-guest-web.vercel.app/operator, and our guest portal at msk-guest-web.vercel.app. It is distinct from any privacy notice an individual property operator publishes for their guests. Where we act as a processor for a property operator, the operator's notice governs that processing.
2. If you are staying at a property
Your accommodation provider normally decides how information about your booking, check-in, stay and requests is used. When we provide the platform for that provider, we handle this information on its instructions. The provider's privacy notice explains its purposes, legal grounds and retention arrangements. You can find its identity and notice in the guest portal for your stay.
Contact the property first about correcting your reservation or exercising rights over its records. If you contact us, we will help identify the relevant provider and pass on your request where appropriate.
3. Information we receive
Enquiries and demonstrations. When you request a demo or contact us, you may provide your name, business contact details, organisation, role and enquiry content.
Business accounts. Account users provide their name, work email address, role and, for billing contacts, subscription and payment references. Payment handling is described in Section 6.
Website and application usage. When you use our website or application, we receive technical data such as IP address, device and browser information, authentication events and error logs. Optional analytics technologies follow your choices described in Section 11.
Invitations. An authorised administrator may invite you to an account and provide your work contact details and access role.
Connected PMS systems. Where enabled by a property, its connected property management system and other approved integrations may provide reservation references, stay dates and guest contact details. Our role and the property's responsibilities are explained in Section 2.
Support conversations. Support conversations contain what you send us. Please avoid including identity documents, card details or unrelated guest information in a general support request.
4. Why we use your information
| Purpose | Information | Legal basis |
|---|---|---|
| Reply to enquiries and arrange demonstrations | Contact details and enquiry content | Pre-contract steps when requested; or legitimate interest in responding to business enquiries |
| Create and administer business accounts | Account, role and organisation details | Contract where you are the contracting party; legitimate interest in administering the service for employee or representative contacts |
| Administer subscription billing | Billing contact, order and transaction references | Contract; applicable record-keeping obligations |
| Protect accounts and investigate technical problems | Authentication, security and diagnostic data | Legitimate interest in maintaining security; legal obligations where applicable |
| Send optional MSK news and offers | Contact details and preferences | Consent |
| Understand and improve the website | Analytics data where consent is given | Consent |
| Provide the guest and operator platform | Account, property and operational data | Contract with the operator; processor instructions for guest data |
When we rely on a legitimate interest, it is the specific interest described above and we assess it against your interests and rights. You can ask us about that assessment. We do not treat the fact that you use the service as agreement to unrelated marketing.
5. Marketing choices
You can choose whether to receive MSK Guestbook marketing by email. Use the unsubscribe link in any marketing email or contact us at privacy@mskguestbook.com. We keep the minimum suppression information needed to respect your choice.
Essential account, security and service messages may still be sent because they are needed to operate the service. A property may separately ask whether you want its offers; an MSK marketing preference does not give the property permission to market to you, or vice versa.
7. International transfers
Our services are hosted in [CONFIRM REGION]. Information may also be accessed or processed in [CONFIRM COUNTRIES] by relevant providers or support teams. Where a transfer requires safeguards, we use applicable adequacy arrangements or specified transfer instruments. Contact privacy@mskguestbook.com to request information about applicable safeguards.
[BUSINESS CONFIRMATION REQUIRED: Confirm hosting and support-access countries before publication. UK IDTA or UK Addendum may be required in addition to EU SCCs for UK-restricted transfers.]
8. How long we keep information
We apply different retention rules to different records:
- Enquiries: Kept for [CONFIRM PERIOD, e.g. 2 years] from last contact, then deleted unless a customer relationship develops.
- Business accounts: Kept for the duration of the subscription and for [CONFIRM PERIOD, e.g. 7 years] after closure for accounting and legal purposes.
- Security logs: Kept for [CONFIRM PERIOD, e.g. 90 days] unless needed to investigate a recorded incident.
- Marketing preferences: Kept for the period of the consent plus suppression information indefinitely to honour an opt-out.
Information processed for a property follows its instructions and our processing agreement. At the end of service we provide a data export facility and delete customer personal data in accordance with our agreed schedule. A legal obligation or properly documented dispute may require particular records to be retained longer.
9. Your rights and privacy concerns
Depending on the law and the processing, you may:
- Request access to your personal information (subject access request)
- Request correction of inaccurate information
- Request deletion of your information where we have no lawful reason to keep it
- Request restriction of processing while a dispute is resolved
- Request a portable copy of information you provided to us
- Object to processing based on legitimate interests or to direct marketing
- Withdraw consent at any time without affecting earlier lawful processing
Use our privacy request form at /contact?ref=privacy or email privacy@mskguestbook.com. You do not need to use a specific form. Tell us enough to locate the relevant information; we may ask for proportionate confirmation of your identity. We respond within one month for a subject access request, subject to permitted adjustments which we will explain where relevant.
You can complain about our handling of personal information through privacy@mskguestbook.com. We acknowledge applicable data protection complaints within 30 days, investigate and explain the outcome. You may also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint or the relevant authority where you live or work.
10. UK GDPR and data protection
MSK Guestbook is subject to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 for processing carried out in connection with our UK-based operations and customers.
Controller and processor responsibilities. MSK Guestbook acts as a data controller for our own business operations (account management, billing, security, marketing). For guest and staff data processed on behalf of property operators, MSK Guestbook acts as a data processor under a Data Processing Agreement (DPA). Operators remain the controllers responsible for their guests' data. Our DPA is available at /legal/dpa.
Data Processing Agreement. Property operators accessing the MSK Guestbook platform accept our DPA as part of their subscription agreement. The DPA sets out the processing description, security measures, subprocessor arrangements and data subject rights assistance.
ICO registration. [CONFIRM ICO registration number and fee status.] You can verify our registration at the ICO's public register at ico.org.uk.
12. Changes to this notice
We update this notice when our practices change. Its date and version appear at the top of this page. Where a change materially affects how we use your information, we will bring it to your attention through an appropriate channel — for example, a notification when you next log in or an email to active account holders.
Prior versions of this notice are available on request by emailing privacy@mskguestbook.com.
Privacy questions or requests
Contact our privacy team at any time. You do not need to use a specific form.