Privacy notice

Who is responsible for your information?

The person or organisation operating Hospitality Scout is the controller where they decide why and how personal information is used. Controller identity and contact details are intentionally not guessed in this draft and must be completed in the notice above before public launch.

What the site currently collects

Hospitality Scout does not currently offer user accounts, take bookings, accept enquiries or operate an email mailing list. The club, budget and search filters run in your browser and are not submitted to us. The deal-alert area is marked as coming soon and does not accept an email address.

Like most websites, the hosting and security infrastructure may receive technical information needed to return a page and keep the service secure. This can include an IP address, request date and time, requested URL, browser or device information, referral information and diagnostic or security events. The operator must confirm the hosting log configuration, recipients and retention before launch.

Deals feed and Google Sheets

Package data is read by the Hospitality Scout server from a publicly accessible Google Sheet and cached for roughly five minutes. Your browser requests the resulting deal list from Hospitality Scout; the deals feature does not send your search terms or contact details directly to Google.

External and affiliate links

Deal buttons open third-party providers or a tracked affiliate redirect in a new tab. Once you click, that third party receives ordinary web-request information and may use cookies or other technologies under its own privacy notice. Current destinations include P1 Travel affiliate redirects, Aston Villa, Seat Unique and VIP Football Hospitality. Those businesses control their own websites; Hospitality Scout does not receive your booking or payment details.

Purposes, lawful basis and retention

The intended purpose of technical processing is to deliver, protect and diagnose the website. The expected lawful basis is the operator's legitimate interests in running and securing the service, but the operator must document that assessment and confirm the final wording. No fixed retention period has been invented: the operator must verify the host's settings and publish a justified period or clear retention criteria.

Your rights and complaints

Depending on the circumstances, UK data-protection law may give you rights to ask for access, correction, erasure, restriction or portability, to object to processing, and to withdraw consent where consent is used. You may also raise a data-protection complaint with the operator. A monitored complaint channel must be added above; the operator should acknowledge a complaint within 30 days, investigate it and explain the outcome.

You can also complain to the Information Commissioner's Office. The ICO recommends giving the organisation an opportunity to resolve the issue first. Visit the ICO complaint service.

Changes to the service

This notice must be reviewed before enabling email alerts, analytics, advertising technology, accounts, enquiries, payments or new embedded services. Material changes should be explained clearly and dated.