Privacy Policy

This privacy notice explains how YorGuest Ltd collects, stores and processes your personal data when you visit our website, make an enquiry, or book a stay at one of our managed properties. This policy complies with the UK GDPR and the Data Protection Act 2018.

By providing us with your data, you confirm you are over 13 years of age.

1. Who We Are

YorGuest Ltd (Company No: 12602771) is the data controller. Our registered address is 4 Tadcaster Rd, York, YO24 1LH.

2. What Data We Collect, Why, and Our Legal Basis

We only collect what we need to run a smooth, safe stay for you and to run our business properly. Here is what we collect, why, and the legal basis we rely on for each:

Bookings & Identity Name, contact details, payment information, vehicle registration, and photo ID or names of guests aged 16+. Why: to confirm your booking, keep the property secure, prevent fraud, and meet fire safety rules. Legal basis: performance of our contract with you, and our legitimate interest in keeping guests and properties safe.

Stay Details Dates, guest numbers, and nationalities. Why: to plan cleaning and turnovers, and for statutory tourism reporting where required. Legal basis: performance of our contract with you, and legal obligation.

Communications Records of enquiries and booking correspondence, however you contact us (email, phone, WhatsApp, social media, contact form). Why: to respond to you, keep accurate records, and deal with any disputes or legal claims. Legal basis: our legitimate interest in providing good customer service and keeping proper records.

Technical & Web Data IP address and browser information, collected via cookies and analytics tools. Why: to keep our website secure, understand how it’s used, and improve it. Legal basis: our legitimate interest in running a secure, effective website. See our separate Cookie Policy for more detail.

Marketing Your contact preferences for service updates. Why: to let you know about things relevant to your stay or future bookings. Legal basis: your consent, which you can withdraw at any time. If you’re a returning guest or existing customer, we may also rely on legitimate interest for closely related service updates, but you can always opt out.

We do not collect “special category” data (health, religion, ethnicity, and so on) unless you choose to share it with us, for example to tell us about an accessibility need for your stay.

If you don’t provide this data: for booking-related information such as ID or payment details, we may not be able to confirm or complete your booking or let you check in.

We do not carry out any automated decision-making or profiling that has a legal or similarly significant effect on you.

3. Where We Get Your Data From

Most of the information we hold comes directly from you. We may also receive data from:

OwnerRez, our property management platform
Payment providers such as Stripe and PayPal
Booking platforms such as Airbnb and Booking.com, if you book through them
Website analytics providers (for example Google Analytics)
Publicly available sources such as Companies House, where relevant to business enquiries

4. Who We Share Your Data With

We share data with trusted partners who help us run the business, including:

OwnerRez (property management)
Stripe and PayPal (payments)
Booking platforms such as Airbnb and Booking.com
Our professional advisers, such as accountants or solicitors, where needed
Government bodies, where we’re legally required to report information

We only ever share what’s needed for these partners to do their job, and we require them to keep your data secure and use it only for the purpose we’ve shared it for.

5. International Transfers

Some of our partners are based outside the UK, for example in the USA. Where this happens, we make sure your data is protected by one of the following:

Transferring only to countries the UK government has approved as offering adequate data protection, or
Using the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, which are approved contracts that require the same level of protection your data would get in the UK

6. Data Security

We have security measures in place to protect your data from being lost, misused, altered, or accessed without permission. Only staff and partners who need it to do their job can access it, and they’re required to keep it confidential.

If a data breach ever happens that could affect you, we’ll notify you and the ICO where we’re legally required to.

7. How Long We Keep Your Data

Financial and booking records: 6 years, to meet tax rules
Enquiries that don’t turn into a booking: 2 years
Guest ID and verification records: 12 months after departure

After these periods, we securely delete or anonymise your data.

8. Your Rights

Under UK data protection law, you have the right to:

Access the data we hold about you
Correct inaccurate data
Ask us to delete your data
Restrict how we use it
Move your data to another provider (data portability)
Object to processing based on legitimate interest
Withdraw consent for marketing at any time

To use any of these rights, email hello@yorguest.com. We aim to respond within one month.

If you’re not happy with how we’ve handled your data, you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk. We’d appreciate the chance to sort things out directly first, so please contact us too.

9. Cookies

Our website uses cookies to help it run properly and to understand how it’s used. For full details, see our [Cookie Policy].

10. Changes to This Policy

We may update this policy from time to time. The date below shows when it was last changed.

Last updated: July 2026