Platform Privacy Policy

1. Introduction

Welcome to Haveaspot! This Privacy Policy explains how Haveaspot Ltd (“Haveaspot”, “we”, “us”, “our”) collects, uses, stores, shares, and protects your Personal Data when you use our Platform and services. “Platform” refers to the Haveaspot website (https://haveaspot.com/), mobile applications, and associated services that connect Venues listing their Listed Premises with Bookers seeking to hire them.

We are committed to protecting your privacy and handling your Personal Data transparently and securely in compliance with applicable UK data protection laws.

This Policy should be read in conjunction with our Venue Service Agreement (for Venues) and our Booker Terms of Service (for Bookers).

2. Data Controller

Haveaspot Ltd, a company registered in England and Wales (Company Number: 15535913) with its registered office at The Cleve, Mantle Street, Wellington, Somerset, United Kingdom, TA21 8SN, is the primary Data Controller for the Personal Data processed through the Platform as described in this policy.

Venues using our Platform are independent Data Controllers for the Personal Data of Bookers they process in connection with managing bookings for their Listed Premises. This includes the independent operation of CCTV or surveillance equipment at their Listed Premises. Bookers should refer to the Venue’s own privacy notices or House Rules regarding onsite data collection.

3. Information We Collect

“Personal data,” “personal information,” and, if the context requires, “information” is any information that identifies you or that we can reasonably link to you. We collect and process certain personal information when you use the Platform, including information you directly provide to us and information we collect automatically (e.g., information about your device and use of the Platform). We also collect information from third parties such as our partners (like Stripe).

Classification of Data	Categories of Data	Source
User Account & Profile Data	Name, email address, phone number, city/postcode, professional title/role (for Venue Reps), affiliated organisation name, optional uploaded profile photos, communications sent/received via the Platform’s messaging features or with Haveaspot support.	Provided by you.
Device & Technical Data	Internet protocol (IP) address, browser type/version, device type, operating system, device identifiers, internet service provider, general geographic location derived from IP address, Platform sign-on method/data.	Collected automatically from your device.
Platform Usage Data	Platform access dates/times, pages viewed, features used, searches for Listed Premises conducted, messages sent/received via Platform, Booking Requests made, confirmed Bookings history, reviews submitted, Platform analytics data, error logs.	Your interaction with the Platform; your device.
Cookie & Tracking Data	Information about your interaction with our Platform collected via cookies, pixels, and similar technologies.	Haveaspot-placed cookies/tech; third-party cookies/tech.
Listed Premises Information	Address, geographical coordinates, timezone, capacity details, descriptions, photos, amenities details, optional onsite contact information, entry instructions, Wi-Fi details. May contain incidental personal data.	Provided by Venue; third parties (e.g., mapping services).
Booking Data	Requested and confirmed Booking start/end dates & times, details provided about the event, prices, taxes/fees applied, communications specifically regarding a Booking. Unique Booking ID assigned by Haveaspot.	Provided by Booker and Venue; generated by Platform.
Survey & Feedback Data	Responses to surveys or questionnaires, feedback provided via forms or email, general correspondence with Haveaspot support.	Provided by you.
Agreement Data	Record of your acceptance of the applicable Terms of Service (Venue or Booker), potentially electronic signatures if used for any related agreements, information related to contract terms.	Provided by you; Platform interaction.
Payment Transaction Data	Masked payment card details (e.g., last 4 digits, expiry date), transaction IDs, payment amounts, payment status, billing address. For Venues: bank account details provided via Stripe Connect for payouts. Note: Full payment details collected/stored by Stripe.	Provided by you (via Stripe interface); Stripe; payment networks.
Interaction & Dispute Data	Information provided by Venues or Bookers when communicating about issues via the Platform, information submitted when raising a complaint or dispute directly with Haveaspot.	Provided by you.

4. How We Use Your Information

We use the Personal Data collected for purposes necessary to provide and improve the Platform and services, including:

• Providing Platform Services: Enabling listing creation, searching, booking requests, booking confirmations, user communication.
• Account Management: Creating and managing Venue and Booker accounts.
• Facilitating Transactions: Processing payments (Total Fees for Bookers, Service Fee debits for Venues, Payouts to Venues) via Stripe. Handling refunds according to the Cancellation Policy.
• Communication: Sending service messages, booking notifications, responding to enquiries, facilitating communication between Venues and Bookers (where applicable).
• Enforcement: Enforcing our Terms of Service (Venue and Booker), monitoring for compliance, investigating potential fraud or misuse.
• Platform Improvement, Analytics & Security: We process Platform Usage Data, Device & Technical Data, and information from Cookies & Tracking Data to understand how users interact with our Platform. This helps us to improve Platform features, monitor performance, and ensure security. We may use third-party web analytics services (such as Google Analytics) for these purposes.
• Marketing and Promotions: We may use your Identity, Contact, Platform Usage, and Booking Data to form a view on Haveaspot features, services, or promotions that we think may be relevant or of interest to you. You can ask us to stop sending you marketing messages at any time by following the “unsubscribe” links or contacting us. We will always obtain your express opt-in consent before sharing your Personal Data with any third party for their direct marketing purposes.
• Tailored Online Advertising: We work with third-party advertising partners to show you Haveaspot advertisements on other websites and services. These partners may place tracking technologies on your browser to collect information and serve relevant ads.
• Legal & Compliance: Complying with legal obligations, responding to lawful requests, protecting our rights and the rights of others.

5. Legal Basis for Processing

We rely on one or more of the following legal bases when we process your Personal Data:

• Performance of a Contract: We need to process your Personal Data to enter into or perform the contract we have with you. This applies when you agree to our Haveaspot Venue Service Agreement or our Haveaspot Booker Terms of Service.
• Legitimate Interests: We may process your Personal Data where it is necessary for our legitimate interests (or those of a third party), provided these interests are not overridden by your fundamental rights and freedoms. This includes preventing fraud, ensuring security, improving the Platform, and sending direct marketing communications.
• Compliance with a Legal Obligation: We may need to process your Personal Data to comply with our legal or regulatory obligations under UK law (e.g., tax law, responding to law enforcement).
• Consent: In specific circumstances, we may ask for your explicit consent to process your Personal Data for a particular purpose (e.g., non-essential cookies). You have the right to withdraw your consent at any time.

6. Data Sharing and Disclosure

We only share your Personal Data when necessary to provide our Platform and services, fulfill our business purposes, comply with the law, or with your consent. We may disclose your Personal Data to the following categories of recipients:

• Publicly Available Information: Certain information you provide may be publicly visible on the Platform to users searching for or viewing listings (e.g., Venue name, Listed Premises details).
• Disclosures Between Venues and Bookers: To facilitate Booking Requests and confirmed Bookings, we share necessary information between the involved Venue and Booker (e.g., Booker’s name to the Venue, exact Venue address to the Booker).
• Stripe (Payment Processor): We share necessary payment and identity information with Stripe for payment processing purposes. Venues are required to provide identity and business verification information directly to Stripe for mandatory Know Your Customer (KYC) checks.
• Third-Party Service Providers: We engage trusted third-party companies (Data Processors) to perform services on our behalf (e.g., cloud hosting, analytics, customer support).
• Building Management/Owners (Conditional): We may disclose limited Booker or Booking information to building management if a Listed Premises is located within a larger managed property.
• Legal and Safety Reasons: We may disclose your Personal Data if reasonably necessary to comply with a legal obligation, protect safety and rights, or prevent fraud.
• Business Transactions: If Haveaspot is involved in a merger, acquisition, or sale of assets, your Personal Data may be transferred.
• Aggregated or De-identified Data: We may share aggregated information for industry analysis or research.

7. Data Security

We have put in place appropriate technical and organisational security measures, including measures such as encryption and access controls, designed to prevent your Personal Data from being accidentally lost, used or accessed in an unauthorised way, altered, or disclosed. We limit access to your Personal Data to those who have a legitimate business need to know. While we strive to protect your Personal Data, we cannot guarantee absolute security.

8. Data Retention

We retain your Personal Data only for as long as is reasonably necessary to fulfil the purposes for which we collected it, including for legal, accounting, or reporting requirements. Generally, we retain your core account information for as long as your account remains active. Following account closure, core profile information may be retained for up to 48 months. Financial and transactional data must be retained for longer periods (typically 6 years plus the current financial year) to comply with UK law.

9. Your Data Protection Rights

Under UK data protection law, you have the right to request Access, Rectification, Erasure, Restriction, and Portability of your Personal Data. You also have the right to Object to processing and Withdraw Consent. To exercise any of these rights, please contact us at support@haveaspot.com.

10. Artificial Intelligence, Profiling, and Automated Decision-Making

We are committed to continually improving the Haveaspot Platform. As part of this, we may utilise machine learning algorithms and artificial intelligence (AI) tools — both proprietary and provided by trusted third parties — to enhance your user experience, improve our services, and maintain platform security.

(a) How We Use AI and Profiling: We may use these technologies to analyse Platform Usage Data and booking preferences to provide tailored search recommendations, optimise the matching of Bookers with Venues, triage customer support inquiries, and detect potentially fraudulent activity.

(b) AI Training: We do not use your identifiable Personal Data to train proprietary generative AI models or large language models (LLMs) for commercial purposes outside of providing the Haveaspot service. Where we use data to train algorithms to improve our platform’s functionality (e.g., search ranking), we rely on aggregated or anonymised data wherever technically feasible. Where third-party service providers (such as customer support software) utilise AI, they process your data strictly under our instructions as Data Processors.

(c) Automated Decision-Making: While we use algorithms to assist our operations, we do not subject you to decisions based solely on automated processing (including profiling) that produce legal effects concerning you or similarly significantly affect you. Decisions resulting in significant actions, such as the termination of an account or the rejection of a Venue listing, are subject to human review and oversight.

11. International Data Transfers

Your Personal Data is primarily stored and processed within the United Kingdom (UK) or the European Economic Area (EEA). Where your Personal Data is transferred by us or our service providers outside the UK/EEA to a country not covered by UK Adequacy Regulations, we will ensure that such transfers are lawful and protected to the standards required under UK data protection law (e.g., using the UK Addendum to the EU SCCs or the UK IDTA).

12. Cookies and Tracking Technologies

Our Platform uses cookies and similar technologies. Please refer to our separate Cookie Policy for detailed information on the types of cookies used, their purpose, and how you can manage your preferences.

13. Children’s Privacy

Our Platform and services are not intended for or directed at children under the age of 18. We do not knowingly collect Personal Data from children. If you become aware that a child has provided us with Personal Data, please contact us so we can take steps to remove such information and terminate the account.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on the Platform or by email, and will update the “Last Updated” date.

15. Contact Us

If you have any questions about this Privacy Policy or our data protection practices, or if you wish to exercise your rights, please contact us at:

Email: support@haveaspot.com

Postal Address: Haveaspot Ltd, The Cleve, Mantle Street, Wellington, Somerset, United Kingdom, TA21 8SN

16. Complaints to Regulator

You have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk), if you believe your data protection rights have been infringed. We would, however, appreciate the chance to deal with your concerns first.