Privacy policy
Who we are
Hive Stewards UK is a trading name of Hive International Group Ltd, registered in England and Wales under company number 17368328, with its registered office at 66 Paul Street, London, England, EC2A 4NA. We are the data controller for the personal data described in this policy.
For anything about your data, email dpo@hivestewards.com.
What we collect
If you contact us or use the readiness review
- Your name and email address, and a contact phone number if you choose to provide one. Providing a phone number is optional.
- The area or postcode of your property, and any listing link you share
- The answers you give in the readiness review, if you choose to send them
- Anything you send us on WhatsApp, if you use the message button
The WhatsApp button on our site is an ordinary link. It opens WhatsApp on your own device and sets nothing on ours. Anything you then send is held in your WhatsApp account and ours, under Meta's terms as well as this policy.
When you send the enquiry form, the details go to our web host in the UK or the European Economic Area and are emailed to us. They are not stored in a database.
The postcode check sends your full postcode to Postcodes.io to identify the council. Your building number or name and review answers stay in your browser until you submit the enquiry form. The transfer button copies your result into the enquiry form so you can check it before sending.
If you become a client
- Contact and billing details, and bank details for payments
- Property details, access codes, safety certificates and insurance documents
- Booking and earnings records for the properties we manage
- Guest names and contact details supplied through booking platforms, which we handle only to run your bookings
Guest details reach us from the booking platform or from you, not from the guest directly. We use them to run the stay (arranging access, answering questions and coordinating the changeover), to ask for a review through the platform afterwards, and to keep the business records the law requires. We send guests our own guest privacy notice with the first message we send them: the platform’s notice covers what the platform does, not what we do.
Why we use it, and our lawful basis
- To answer enquiries and prepare quotes, because you asked us to, as steps before entering a contract.
- To provide management services, to perform our contract with you.
- To meet legal duties: tax records, and short-term let registration and safety requirements.
- To improve the service and keep records of what we advised, in our legitimate interests in running the business, balanced against your rights.
We do not use your data for marketing unless you have asked to hear from us, and you can stop that at any time by replying to any message. Where we rely on your consent for anything, you can withdraw it at any time; that does not affect anything we did lawfully before you withdrew it.
You do not have to give us any of this information, but there is some we cannot work without. If you don't give us the property address, safety certificates or access details, we won't be able to manage the property.
No automated decision-making
We do not make decisions about you by automated means and we do not profile you. Nightly pricing is set by software, but that concerns the property's rates, not decisions about any person.
Who we share it with
We share only what is necessary, with:
- The booking platforms you use
- Cleaners, tradespeople and contractors, who are given access details for a specific job
- Our group company in Egypt, which manages properties there and shares the same systems as us, so its staff can reach the records held in them
- Our accountant, insurer and professional advisers
- Software we use to run the service, such as pricing and messaging tools
- Public authorities where the law requires it
We never sell personal data.
Where your data is held
Our hosting provider keeps standard server access logs, recording things like IP address, time and the page requested, for security and troubleshooting; they are deleted automatically on our hosting provider’s standard schedule. We do not use them for anything else, and we can tell you the retention period currently in force on request. Data is held in the UK and the European Economic Area where possible. Some of our software providers are based outside the UK, and our group company in Egypt uses the same systems we do, so your data may be reached from Egypt.
Egypt is not covered by UK adequacy regulations. Where data goes there, or to any other country without adequacy, we rely on the International Data Transfer Agreement or the UK Addendum, together with an assessment of the risks involved. You can ask us for a copy of the safeguards that apply to a transfer.
How we keep it safe
Access to client records is limited to the people who need it, on accounts protected by strong passwords and two-factor authentication where the service offers it. Devices are encrypted and kept up to date. Keys, access codes and certificates are held in a password manager, and codes are changed when a contract ends or a contractor stops working with us.
If a breach happens that is likely to put your rights at risk, we will tell you without undue delay, and we will report it to the Information Commissioner's Office within 72 hours of becoming aware where the law requires it.
Children's data
Our services are for property owners and we do not knowingly collect data about children. A guest booking may list the number of children staying; we use that only to prepare the property, and we do not ask for their names or any other detail about them.
How long we keep it
The readiness review sends the full postcode you enter to Postcodes.io to look up its local council. The building reference and review answers stay in your browser until you submit them to us.
We save a private recovery copy of website submissions so we can confirm receipt and retry emails if mail is unavailable. We use the email address you provide to send an automatic receipt after recording enquiries, onboarding details and cancellation notices. We normally delete the recovery copy 30 days after our mail server accepts all required emails or they are manually resolved. If a temporary fault prevents the compact reporting entry being saved, we retain the recovery copy until that fault is repaired and the entry is safely preserved. Where a submission has both your receipt email and our internal notification, that period begins at the later completion time. Submissions still awaiting resolution remain available for review. The separate retention periods for business records and correspondence are listed below.
Submission monitoring and monthly reports
We keep a compact operational register of receipt references, submission times, form types, website languages and the delivery states of business notifications and customer acknowledgements. We use it to check requests are handled reliably and send monthly reports to the relevant country’s business inbox. It excludes names, contact details and client messages, but a reference can be linked to the original submission. This operational monitoring covers all recorded submissions, whether or not you allow optional review statistics.
The register and private report copies on our OVHcloud hosting account in France cover the current month and three completed months. Older copies are cleared at the next maintenance or report-processing run. Unresolved recovery records follow the retention described above; emailed report copies may remain in our business mailboxes under the correspondence policy.
We also use the email address and IP address supplied with a request to limit repeated submissions and automated emails. The security counters use protected identifiers and expire within a day; the next scheduled maintenance run removes expired counters.
- Guest messages and booking records: 12 months after checkout, or longer while a damage claim or dispute is open
- Any identity document we have asked a guest for: deleted within 30 days of checkout at the latest
- Enquiries that don't become work: 12 months
- Client records and correspondence: 6 years after the contract ends
- Financial records: 6 years, as HMRC requires
- Safety certificates and risk assessments: for as long as we manage the property, plus 6 years
Guests
This notice is written for property owners. Guests staying at a property we manage have their own notice setting out what we hold about them and why: guest privacy notice.
Your rights
Under UK data protection law you can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or transfer it elsewhere. You can also object to processing based on legitimate interests, and withdraw any consent you have given. We'll respond within one month, and there is no charge.
To exercise any of these rights, email dpo@hivestewards.com with what you would like us to do. We may ask you to confirm who you are before we act, so that we don't hand your data to someone else.
Data protection questions go to dpo@hivestewards.com, which reaches whoever is responsible for data protection here at the time. UK law does not currently oblige us to appoint a formal Data Protection Officer and we have not appointed one. If that changes, or once our Egyptian group company is required to appoint and register one, we will do so and publish their contact details here.
Complaining about how we use your data
You have the right to complain to us directly if you think we have not handled your personal data properly. Email dpo@hivestewards.com, or write to us at the registered office above, and say what has gone wrong. You do not need to use any particular form of words, and it doesn't matter how you send it.
We will acknowledge your complaint within 30 days of receiving it, look into it, keep you posted while we do, and tell you the outcome without undue delay.
You can also complain to the Information Commissioner's Office at any time, at ico.org.uk or on 0303 123 1113. You are not required to come to us first, though it is usually quicker if you do.
Language
This notice was written in English, and English governs its interpretation. Any translation is provided for convenience; if the two differ, the English version prevails.
Changes to this policy
If we change how we use personal data we'll update this page and the date at the top. Material changes will be sent to current clients by email.
Optional website statistics
With your consent, we record limited activity to improve the readiness review: a review starting, results being shown, a review being attached and an enquiry containing a review being saved. Reports contain monthly totals by country and website language, without your name, contact details, property details or answers. Normal submissions and emails remain covered by the rest of this notice.
Statistics are off by default. Decline or withdraw consent at any time through Statistics choices, without affecting use of the forms. A preference cookie remembers your choice for 180 days separately for each country. Withdrawal stops future activity and does not affect earlier lawful processing. Previous aggregate totals cannot isolate one person’s events.
Our OVHcloud hosting account in France processes statistics requests. We use no external analytics service. A temporary random token and derived keys prevent duplicates and excessive use; raw IP addresses are not saved in the statistics store. Browser-event keys last up to 24 hours, IP-derived protection keys up to one hour, and enquiry duplicate-prevention records until the report is prepared or 35 days at most. Expired entries are cleared on the next request or hourly maintenance run. Separate hosting security logs follow the retention described above.
We keep the current month’s totals and 13 completed months and email reports to the relevant country’s business inbox. Copies of these aggregate reports may remain in our business mailboxes. Consent is the basis for this optional use; abuse-prevention data protects the service. See our cookies page for details and controls.