Privacy notice

Eds Estate is a trading name of Schmoftware Limited. Schmoftware Limited decides how and why the personal information described here is used, which makes it the controller of that information under UK data protection law.

To ask anything about your information, email support@eds-estate.com or call 07598 826679.

• people who visit this website;
• landlords and owners who send us an enquiry;
• guests who book The Central Hub directly with us, or through Airbnb, Booking.com or Vrbo;
• landlords and owners who use the owner portal, and the accountants they invite to it.

When you send an enquiry

Your name, email address and phone number, the postcode or area of the property, its type and number of bedrooms, the service you are interested in, your message, your agreement to be contacted, the page you sent it from and any campaign tags in the page address.

We use it to reply, to arrange a call, a visit and a proposal, and to keep a record of the conversation. Our lawful basis is our legitimate interest in answering an enquiry you started and, where you ask for a proposal, taking steps at your request before a contract. We keep enquiries for 24 months after our last contact with you. If you become a client, the owner portal section below applies instead.

To keep automated spam out, the enquiry forms use Google reCAPTCHA, which looks at how the page is used to judge whether a person sent the form. Google receives technical information about your browser and device for this, and gives us a score that we keep with the enquiry. Our lawful basis is our legitimate interest in keeping the forms free of spam.

When you book The Central Hub directly

Your name, email address, phone number, expected arrival time, the dates and number of guests, your agreement to the house rules, any messages, and the status of your booking and payment.

Payments are taken by Stripe. Your card details go straight to Stripe: we receive the payment status and Stripe’s reference, never your full card number. We use your details to confirm and run your stay, send you the check-in information, take or release the payment, and keep our accounts. Our lawful basis is the contract with you, and our legal obligation to keep accounting records. To stop the same nights being sold elsewhere, we pass the dates of your stay (dates only, without your name or contact details) to our channel manager. We keep booking records for six years after the end of the financial year in which the stay took place.

When you book through Airbnb, Booking.com or Vrbo

The platform you booked with shares your booking details with us through our channel manager, Tokeet (AdvanceCM). We use them to host your stay and keep our accounts, on the basis of the contract for your stay and our legal obligation to keep records. Our own records and the owner reports show guests by first name only. We keep these records for six years after the end of the financial year of the stay. The platform’s own privacy notice covers what it does with your information.

When you use the owner portal

Your name and email address; your password, which we store only as a one-way hash that cannot be turned back into the password; when you sign in; the details of your property; your agreement, statements, payments, costs and receipts; documents and certificates; and messages. We use them to run the arrangement with you, to give you a record of it, and to keep the portal secure. Our lawful bases are the contract with you, our legal obligations (including tax records) and our legitimate interest in keeping accounts secure. We keep them for as long as the agreement runs and for six years after it ends.

When an owner invites their accountant

The accountant’s name and email address and when they sign in. Their access is read-only and limited to that owner’s records. Our lawful basis is the legitimate interest of the owner, and ours, in giving their accountant the records they need. We keep these details while the access is in place, and the sign-in records as for the owner’s account.

When you visit the website

Our web server records technical information about each request, such as the IP address, browser and page, to keep the site working and secure. We use your IP address for a few minutes to limit repeated form submissions. Our lawful basis is our legitimate interest in running a secure website. These logs are kept for a short period and then deleted.

When you accept analytics cookies

We use Google Analytics to understand how the website is used: which pages are visited and for how long, how people arrive (for example from a search engine or a link with campaign tags), the type of device and browser, the approximate area (country and town, worked out from the IP address, which Google Analytics does not store), and whether an enquiry was sent or a booking started or made. For an enquiry it records only which form was used; for a booking, the booking reference, the stay and the amount. It never receives your name, email address, phone number or anything you typed.

Our lawful basis is your consent, which you give with “Accept analytics” in the cookie banner and can withdraw at any time. Nothing is collected unless you accept. We keep this information in Google Analytics for up to 14 months. We do not use Google signals, advertising features or personalised advertising, and we do not use it to identify you.

The website sets two kinds of cookie. Those it needs to work are set without asking, because it cannot work without them. Analytics cookies are optional: they are set only if you choose “Accept analytics” in the cookie banner. Google Analytics never runs in the owner portal.

Cookies the website needs

• Session (sessionid): keeps you signed in to the owner portal. It is set when you sign in and lasts up to 14 days, or until you sign out. It is also set for a moment after you send an enquiry, so the next page can confirm what you sent, and removed once that page is shown.
• Form protection (csrftoken): protects the forms on this website and in the owner portal against forged submissions. It lasts up to a year.
• Messages (messages): shows a one-off confirmation in the owner portal, for example after you save a change. It is deleted once shown.
• Spam protection (_GRECAPTCHA): set by Google reCAPTCHA when you start filling in an enquiry form, to check that a person sent it. It lasts up to six months.
• Your cookie choice (eds_consent): remembers whether you accepted or rejected analytics cookies, so we do not ask on every page. It holds only that answer, and lasts 12 months; then we ask again.

Analytics cookies (optional)

• Google Analytics (_ga and _ga_H9EK8T63KF): tell one visit to the website from another, so we can count visitors and see which pages are useful. They last up to 14 months from your last visit.

Google provides Google Analytics to us as our processor: it handles this information on our instructions and under its data processing terms, not for its own advertising. Google may process it in the United States (see section 6).

To change your choice at any time, use Cookie settings, which is also at the bottom of every page. If you reject analytics after accepting it, we delete the Google Analytics cookies on this website and send nothing more to Google. You can also delete cookies in your browser’s settings.

When you pay for a direct booking, you are taken to a payment page run by Stripe, which sets its own cookies to keep payments secure and prevent fraud. Stripe’s privacy notice explains them.

We never sell your information or add you to anyone’s marketing list. We share it only with the organisations that help us run the business, under contracts that protect it:

• our hosting provider, which runs the server the website and its database are on;
• our email provider, which delivers our emails;
• Google, for reCAPTCHA on the enquiry forms and, if you accept analytics cookies, for Google Analytics;
• Stripe, which takes payments for direct bookings;
• Tokeet (AdvanceCM), our channel manager, and the booking platforms you book through;
• our accountant, and HM Revenue and Customs or other authorities where the law requires it.

Some of these providers store or process information outside the UK, for example in the European Union or the United States. Where they do, the transfer is covered by UK adequacy regulations, the UK extension to the EU-US Data Privacy Framework, or the UK International Data Transfer Addendum to the standard contractual clauses.

The website uses encrypted connections. Owner portal passwords are stored only as one-way hashes, sign-in attempts are limited, owners see only their own properties, and changes to money and statements are logged. Our own staff sign in with an authenticator code as well as a password. Guests appear in owner reports by first name only.

You can ask us to:

• give you a copy of the information we hold about you;
• correct information that is wrong or incomplete;
• delete information we no longer need, or restrict how we use it;
• stop using it where we rely on our legitimate interests, unless we have strong reasons to continue;
• send information you gave us to you, or to another organisation, in a common format;
• stop contacting you, if you agreed to be contacted and change your mind;
• stop using analytics cookies, if you accepted them: use Cookie settings at the bottom of any page.

To make a request, email support@eds-estate.com or call 07598 826679. It is free, and we reply within one month.

If you are unhappy with how we have handled your information, please tell us first. You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint (opens in a new tab) or on 0303 123 1113.

We will update this notice when the way we use information changes, and show the date at the top. Our terms cover the use of the website, direct bookings and the owner portal.