1.Introduction

This Privacy Policy explains how The Butlr Concierge Ltd ("we", "us", "our", or "The Butlr") processes personal data when providing access to the Butlr digital concierge platform (the "Platform") during its beta phase.

The Platform is provided as a B2B service to accommodation providers ("Clients") and may involve the processing of personal data relating to guests and client representatives.

This Privacy Policy applies to beta usage only and should be read alongside:

• The Beta Test Agreement
• The Data Processing Agreement (DPA)
• Any applicable Client privacy notices

2.Our role in data processing

For the purposes of data protection legislation, including the UK General Data Protection Regulation ("UK GDPR"):

• Clients act as Data Controllers in respect of guest personal data.
• The Butlr acts as a Data Processor, processing personal data on behalf of Clients and in accordance with their instructions.

Clients are responsible for:

• Establishing a lawful basis for processing guest data
• Providing appropriate privacy information to guests
• Responding to data subject rights requests

3.Personal data we process

Depending on Platform configuration and Client use, we may process:

Guest Data

• Name
• Email address
• Phone number
• Booking reference and stay details
• Check-in and access-related information
• Communications submitted via the Platform

Identity Verification Data

• Government-issued identification documents
• Images or scans of identification
• Verification status and metadata

Client Representative Data

• Name
• Business email address
• Job role
• Contact details

Technical & Usage Data

• Device information
• IP address
• Log data
• Interaction records
• Error and performance logs

4.How we use personal data

We process personal data solely to provide and operate the Platform, including to:

• Facilitate digital check-in and guest communication
• Enable AI-assisted concierge interactions
• Support issue reporting and operational workflows
• Perform identity verification where enabled
• Monitor platform performance and security
• Improve and develop the Platform during beta

AI-assisted functionality is used to support guest communication and operational workflows and does not replace human oversight or decision-making where required.

5.Automated processing & human review

Some Platform processes — such as identity verification, check-in approval workflows, or access enablement — may involve automated or semi-automated processing.

Where such processing is used:

• Appropriate safeguards are in place
• Human review and intervention are available
• Automated processing does not operate in isolation for critical access or safety decisions

Guests who believe an automated decision has been made in error should contact the relevant Client. Clients may request review or assistance from The Butlr in its capacity as Data Processor.

6.Lawful basis for processing

Clients are responsible for identifying and documenting the lawful basis for processing guest data, which may include:

• Performance of a contract
• Legitimate interests
• Legal obligations
• Consent (where applicable)

The Butlr processes personal data only on documented Client instructions, as set out in the DPA.

7.Data sharing & sub-processors

We may engage third-party sub-processors to support Platform delivery, including for:

• Cloud hosting
• Email and messaging services
• Identity verification services
• Analytics and monitoring

All sub-processors are subject to appropriate contractual safeguards consistent with the DPA.

A current list of sub-processors is available upon request.

8.Data retention

Personal data is retained only for as long as necessary to fulfil the purposes described in this Policy or to meet legal and contractual obligations. In particular:

• Identity verification data is retained only for the duration required to complete verification and comply with applicable legal obligations, after which it is securely deleted or anonymised.
• Guest communication and operational data is retained in accordance with Client instructions.
• Technical logs may be retained for security, audit, and troubleshooting purposes.

9.Data security

We implement appropriate technical and organisational measures to protect personal data, including:

• Access controls
• Encryption where appropriate
• Secure hosting environments
• Restricted internal access

Despite these measures, no system can be guaranteed to be completely secure, particularly during beta operation.

10.International data transfers

Where personal data is transferred outside the UK, appropriate safeguards are applied in accordance with applicable data protection law, including standard contractual clauses where required.

11.Children

The Platform is intended for use by adult Clients and adult primary guests. It is not designed for direct use by children. Where accommodation bookings involve families or minors, responsibility for guest data submission and consent rests with the Client.

12.Data subject rights

Guests may exercise their data protection rights (including access, rectification, and erasure) by contacting the relevant Client as Data Controller. Clients may request assistance from The Butlr to fulfil such requests in accordance with the DPA.

13.Changes to this policy

This Privacy Policy may be updated during the beta period. Any material changes will be versioned and made available to Clients. Continued use of the Platform constitutes acknowledgment of the updated Policy.

14.Contact details

For data protection enquiries relating to the Platform, Clients may contact:

This Privacy Policy applies to the beta version of the Platform and does not override the Beta Test Agreement or Data Processing Agreement. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk