Privacy Policy

Introduction

Guest It ("we", "us", "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use and store information when you use our platform, including Guest It web portals, manager and staff systems, QR-code interfaces, and related services. It also covers this website, guestit.co.uk, including the contact form and the newsletter.

For the purposes of UK data protection law (including the UK GDPR), we act as a Data Controller for the data we process to operate the service. In many cases we also process data on behalf of venues (our customers). Where a venue controls the purpose and means of processing, it may act as Data Controller and we act as Data Processor.

General data protection enquiries: hello@guestit.co.uk
Named data protection contact: Louis Lusso (Co-founder & CTO), louis.lusso@guestit.co.uk
ICO registration: ZC095042
Address: Guest It LTD, Unit 26g-26m Springfield Mill, Bagley Lane, Farsley, West Yorkshire, United Kingdom, LS28 5LY

Data we collect

We collect information necessary to operate our platform and provide the services you request. This may include:

• Account and login data: names, usernames, access codes, roles, and authentication data linked to a venue or event.
• Contact information: email address, telephone number, and other details used for account setup, communications, alerts, or support.
• Operational data: information entered into checklists, audits, dockets, orders, forms, and logs created through our system (typically on behalf of venues).
• Usage and technical data: device type, IP address, browser details, diagnostic logs and activity data used for security and performance.
• Uploaded media: photos and digital signatures where you choose to upload them (for example, audits, dockets, evidence, or forms).
• Staff and workforce data: where you use our staffing features, we may collect date of birth, nationality, right-to-work status, bank details (account number, sort code, bank name) for payment purposes, and location data (GPS coordinates) recorded at shift clock-in and clock-out.
• Guest interaction data: where guests use QR-code chatbots, we may collect name, email address, and phone number as provided by the guest, along with feedback, survey responses, and marketing preferences.
• Website enquiries and newsletter: the name, email address, company, phone number and message you send through the contact form, and the email address, sign-up page and time of consent for the newsletter.

How we use your data

We use your data to:

• Provide, operate and maintain the Guest It platform.
• Authenticate users and manage secure access for staff, managers and authorised users.
• Record operational data (for example, checklists, audits, orders and reports) and make it available to the venue.
• Send service messages such as confirmations, alerts and operational notifications via email or SMS (where enabled).
• Generate AI analytics, summaries and insights from operational data to help venues improve their operations (see AI & automated processing).
• Process guest interactions through AI chatbots to provide information and collect feedback.
• Record staff shift attendance, including GPS location at clock-in and clock-out, for workforce management purposes.
• Deliver push notifications through mobile applications (where enabled by the user).
• Reply to enquiries sent through the contact form, and send the monthly newsletter to people who have subscribed to it. Every newsletter carries an unsubscribe link.
• Monitor and improve reliability, usability and security.
• Comply with legal obligations and protect the integrity of our systems.

We do not sell personal data or share it with advertisers.

Legal basis

We process personal data under one or more lawful bases under UK GDPR:

• Contract: where processing is necessary to provide the services to a venue or user.
• Legitimate interests: to operate the service securely, prevent misuse, and improve performance.
• Consent: where you choose to submit data (for example, surveys or guest submissions), and consent is the appropriate basis.
• Legal obligation: where we must retain or provide information to comply with law.

Storage & security

We use appropriate technical and organisational measures designed to protect personal data against loss, misuse, and unauthorised access. This includes access controls, encryption in transit where applicable, and security monitoring.

Files such as images or signatures may be stored in secure cloud storage (for example, AWS S3) and linked to the relevant record.

Retention

We keep personal data only for as long as necessary for the purposes described in this policy, or as required by law. Specific retention periods include:

• Account data: retained for the duration of the venue's contract with us, plus 12 months after termination.
• Operational data (checklists, audits, orders, logs): retained for the duration of the venue contract plus any period required for compliance or record-keeping (typically up to 24 months).
• Guest interaction data (chatbot submissions, feedback): retained for 12 months from the date of the interaction (for service quality, debugging, abuse detection, and investigation of guest complaints from past events), unless the venue requires longer retention for compliance.
• Staff workforce data: retained for the duration of the staffing relationship plus the period required by employment and tax law (typically up to 6 years for financial records).
• Technical and usage logs: retained for up to 12 months for security and diagnostic purposes.
• Newsletter subscriptions: until you unsubscribe. Contact form messages are emailed to us and are not stored on the platform.

Operational data may also be retained at the request of the venue for record-keeping and regulatory compliance. When data is no longer needed, it is securely deleted or anonymised.

Sharing & sub-processors

We may share limited personal data:

• With the venue or organisation that manages your account (for example, managers viewing operational logs).
• With trusted sub-processors who help us deliver the service, under contractual confidentiality and security obligations.
• If required by law, regulation, or to respond to lawful requests.

Sub-processors

We use the following third-party service providers to operate the platform:

• Amazon Web Services (AWS) — cloud hosting, RDS PostgreSQL, S3 storage, ElastiCache (Redis), SES email delivery, CloudFront content delivery, Location Service. Production data is processed in the UK (eu-west-2, London), with cross-region backup snapshots in the EU (eu-west-1, Ireland).
• OpenAI — AI analytics, summaries and chatbot inference. United States.
• Twilio — SMS and phone number verification. United States.
• Google Cloud — chatbot translation via Google Cloud Translate. United States.
• Google Analytics — page-view statistics for the public website, set only if you allow analytics on the cookie banner. United States.
• Microsoft 365 — internal mail, OneDrive and SharePoint. European Union.
• Sentry — application error monitoring. Region per Sentry account configuration.
• Expo — mobile push notifications and over-the-air updates. United States.

We maintain contracts with all sub-processors that include appropriate data protection obligations. If you are a venue customer and require a full sub-processor list for your records, please contact us at hello@guestit.co.uk.

AI & automated processing

We use artificial intelligence to help venues improve their operations. This includes generating summaries, analytics, and insights from operational data such as guest feedback, sales figures, kitchen operations, and staffing performance.

AI processing is carried out using OpenAI's API. When we send data to OpenAI for analysis:

• We send only the operational data necessary for the specific analysis (for example, aggregated feedback comments or sales totals).
• We do not send data for the purpose of training AI models. Our API usage agreement with OpenAI specifies that data sent via the API is not used for model training.
• Results are returned to the platform and made available to authorised venue users.

The legal basis for AI processing is legitimate interests — specifically, our interest in providing valuable operational insights to venues as part of the service. No solely automated decisions with legal or similarly significant effects are made about individuals.

International transfers

Your data is primarily stored in the UK (AWS eu-west-2, London), with cross-region backup snapshots in the EU (AWS eu-west-1, Ireland). However, some of our sub-processors are based in the United States, which means personal data may be transferred outside the UK.

The following services involve transfers to the United States:

• OpenAI — AI analytics, summaries and chatbot inference
• Twilio — SMS and phone number verification
• Google Cloud — chatbot translation via Google Cloud Translate
• Google Analytics — public website page-view statistics, only if you allow analytics on the cookie banner
• Sentry — application error monitoring, where the Sentry account is hosted in the United States
• Expo — mobile push notifications and over-the-air updates

Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place. These may include the UK International Data Transfer Agreement (UK IDTA), Standard Contractual Clauses (SCCs) approved by the ICO, or reliance on the service provider's participation in recognised data protection frameworks.

If you require further details about the safeguards in place for any specific transfer, please contact us at hello@guestit.co.uk.

Your rights

Under UK GDPR, you may have the right to:

• Access your personal data.
• Request correction of inaccurate data.
• Request deletion (where applicable).
• Object to processing based on legitimate interests.
• Withdraw consent where processing is based on consent.
• Request data portability (where applicable).

To exercise any of these rights, email hello@guestit.co.uk. We will respond within one month in accordance with UK GDPR. We may need to verify your identity before responding.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data protection rights have been violated: ico.org.uk/make-a-complaint.

Cookies

We use cookies that are necessary for the website and platform to function (for example, authentication and session management). If you allow analytics on the cookie banner, the public website also sets Google Analytics cookies; the manager, staff and vendor portals and guest QR pages do not. We do not use advertising cookies that track personal behaviour across third-party websites. The cookies, how long they last and how to withdraw consent are listed in our Cookie Policy.

Children's privacy

Guest It is designed for venue staff, managers and authorised users. We do not knowingly collect personal data from children. If you believe a child has provided personal data to us, please contact us and we will take steps to delete it.

Changes to this policy

We may update this Privacy Policy from time to time. Updates will be posted on this page and the "Last updated" date will change accordingly.

Contact

If you have questions about this policy or your data, contact us:

• General data protection enquiries: hello@guestit.co.uk
• Named data protection contact: Louis Lusso (Co-founder & CTO), louis.lusso@guestit.co.uk
• ICO registration: ZC095042
• Address: Guest It LTD, Unit 26g-26m Springfield Mill, Bagley Lane, Farsley, West Yorkshire, United Kingdom, LS28 5LY