Privacy policy

1. Introduction

Use Nook Ltd. ("Nook", "Company", "we", "us", or "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website (www.visitnook.com), book or stay at a Nook property, use our products and services, or otherwise interact with us.

This policy applies to information we collect from guests, franchisees and other business customers, prospective customers, website visitors, and other individuals who interact with our services.

Please read this Privacy Policy carefully to understand how we handle your personal data and the rights available to you.

2. Who We Are

For the purposes of data protection law, Use Nook Ltd. is the data controller responsible for your personal data, including booking data.

Nook properties are operated under a franchise model. Where a franchisee collects personal data at a property for its own purposes, the franchisee is the controller of that data and its own privacy notice will apply.

Data Controller:

Email: info@visitnook.com

If you have any questions about this Privacy Policy or our data practices, please contact us using the details above.

3. Information We Collect

We collect information in several ways depending on how you interact with us:

3.1 Information You Provide Directly

• Contact Information: Name, email address, phone number, job title, company name, and postal address when you contact us or enter into a business relationship with us.
• Communication Data: The content of emails, messages, and other communications you send to us.
• Contractual Information: Information necessary to fulfil our contractual obligations, including billing details.
• Feedback and Survey Responses: Information you provide when participating in surveys or providing feedback on our services.

3.2 Information Collected Automatically

• Device and Technical Data: IP address, browser type and version, operating system, device identifiers, and technical information about your device.
• Usage Data: Information about how you use our website and services, including pages visited, as recorded in server logs.
• Log Data: Server logs recording access times, referring URLs, and system activity.

3.3 Information from Third Parties

• Booking Platforms: Booking details, such as your name, contact details, and stay dates, from third-party platforms you use to book a stay with us.
• Business Partners: Information from partners, resellers, or distributors who refer you to us.
• Publicly Available Sources: Information from public databases, industry publications, and professional networking platforms.

3.4 Our Website

Browsing our website does not use analytics or advertising trackers. Our website is hosted on AWS Amplify Hosting by Amazon Web Services, which records basic technical information such as IP addresses in server logs for security and operational purposes. Property listings, photos and recommendations are stored with Supabase, our database and file storage provider, and are fetched by our servers and your browser from Supabase's infrastructure. Property maps are provided by Mapbox, so when you view a property page your browser contacts Mapbox's servers to load the map, which shares your IP address and basic usage information with Mapbox. Typefaces are served from our own hosting. Bookings are not made on our website: when you choose to book, you leave our website for a booking platform, such as Airbnb, which takes your booking under its own privacy policy and shares the booking details we need to host your stay with us.

4. How We Use Your Information

We use the information we collect for the following purposes:

4.1 To Provide Our Products and Services

• Managing bookings and providing your stay at Nook properties
• Providing customer support and technical assistance
• Fulfilling our contractual obligations

4.2 To Improve and Develop Our Offerings

• Developing new features and functionality
• Conducting research and development activities
• Performing quality assurance and testing

4.3 To Communicate With You

• Responding to enquiries and requests
• Sending service-related communications and updates
• Providing information about products, features, and services that may interest you
• Sending newsletters and marketing communications (where you have consented)

4.4 For Business Operations

• Managing our business relationships
• Administering contracts and agreements
• Invoicing
• Maintaining records and documentation

4.5 For Legal and Compliance Purposes

• Complying with applicable laws and regulations
• Responding to legal requests and court orders
• Protecting our rights, property, and safety
• Preventing fraud and security threats
• Enforcing our terms and conditions

5. Legal Basis for Processing

We process your personal data on the following legal bases under the UK GDPR and the Data Protection Act 2018:

5.1 Performance of a Contract

Where processing is necessary to fulfil our contractual obligations to you or to take steps at your request prior to entering into a contract.

5.2 Legitimate Interests

Where processing is necessary for our legitimate business interests, including:

• Operating and improving our products and services
• Marketing our business to prospective customers
• Protecting our business, employees, and customers
• Analysing and understanding our customer base

We balance our interests against your rights and only rely on this basis where your interests and fundamental rights do not override our legitimate interests.

5.3 Legal Obligation

Where processing is necessary to comply with our legal obligations, including tax, accounting, and regulatory requirements.

5.4 Consent

Where you have given your consent to specific processing activities, such as receiving marketing communications. You may withdraw your consent at any time.

6. Data Sharing and Disclosure

We may share your information in the following circumstances:

6.1 Service Providers

We engage trusted third-party service providers to perform functions on our behalf, including:

• Cloud hosting and infrastructure providers
• Customer relationship management systems
• Communication and email service providers
• Professional advisors (legal, accounting, auditing)

These providers are contractually bound to protect your data and may only use it to provide services to us.

6.2 Business Partners

We may share information with franchisees operating Nook properties (for example, sharing your booking details with the property you are staying at), and with business partners, distributors, and resellers involved in delivering our products and services to you.

6.3 Legal Requirements

We may disclose your information where required by law, regulation, legal process, or governmental request, or where we believe disclosure is necessary to:

• Comply with applicable laws or respond to valid legal requests
• Protect the rights, property, or safety of Nook, our customers, or others
• Detect, prevent, or address fraud, security, or technical issues
• Enforce our agreements and policies

6.4 Business Transfers

In the event of a merger, acquisition, reorganisation, sale of assets, or insolvency, your information may be transferred as part of that transaction. We will notify you of any change in ownership or use of your personal data.

6.5 With Your Consent

We may share your information with third parties when you have given us your consent to do so.

7. International Data Transfers

Your information may be transferred to and processed in countries outside the United Kingdom, including countries that may not have data protection laws equivalent to those in the UK.

When we transfer personal data internationally, we implement appropriate safeguards to protect your information, including:

• The International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, issued by the UK Information Commissioner's Office
• Transfers to countries covered by UK adequacy regulations
• Other legally recognised transfer mechanisms

8. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including:

• Active Business Relationships: For the duration of our business relationship plus a reasonable period thereafter for follow-up communications.
• Contractual and Booking Records: For the duration of the contract or stay plus seven (7) years to comply with legal and accounting requirements.
• Marketing Data: Until you withdraw consent or opt out, or three (3) years from your last interaction with us, whichever is sooner.
• Legal Claims: For the period during which legal claims may be brought, typically six (6) years from the relevant event.

After the retention period expires, we securely delete or anonymise your personal data.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and at rest
• Access controls, so that only those who need personal data can reach it
• Security reviews proportionate to the size of our business
• Procedures for responding to incidents and, where required, notifying you and the regulator

While we strive to protect your information, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security.

10. Your Rights

Under data protection law, you have the following rights:

10.1 Right of Access

You have the right to request a copy of the personal data we hold about you.

10.2 Right to Rectification

You have the right to request that we correct any inaccurate or incomplete personal data.

10.3 Right to Erasure

You have the right to request that we delete your personal data in certain circumstances, such as when it is no longer necessary for the purposes for which it was collected.

10.4 Right to Restrict Processing

You have the right to request that we restrict the processing of your personal data in certain circumstances.

10.5 Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.

10.6 Right to Object

You have the right to object to processing based on legitimate interests or for direct marketing purposes.

10.7 Rights Related to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects, and to request human intervention.

10.8 Right to Withdraw Consent

Where processing is based on consent, you have the right to withdraw that consent at any time.

To exercise any of these rights, please contact us at info@visitnook.com. We will respond to your request within one month, or inform you if we require additional time.

11. Cookies and Tracking Technologies

Our website does not currently use cookies or similar tracking technologies. If we introduce them, we will update this Privacy Policy and, where required by law, ask for your consent before setting any non-essential cookies.

12. Third-Party Links

Our website may contain links to third-party websites, services, or applications. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party sites you visit.

13. Children's Privacy

Bookings can only be made by adults aged 18 or over. Children may stay at Nook properties when accompanied by the adult who made the booking. We do not knowingly collect personal data directly from children, and any information we hold about a child staying with us is limited to what the booking adult provides. If you believe we hold personal data about a child that we should not, please contact us and we will delete it.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by:

• Posting the updated policy on our website with a new "Last Updated" date
• Sending you an email notification (where appropriate)

We encourage you to review this Privacy Policy periodically.

15. Complaints

If you are not satisfied with our response to any privacy-related concern, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

Website: www.ico.org.uk
Helpline: 0303 123 1113

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Email: info@visitnook.com
Website: www.visitnook.com