Privacy Policy

ProManage UK Holdings Ltd (operating as Iconic Spaces) is the Data Controller responsible for your personal data. We are dedicated to protecting your privacy and handling your information in accordance with the UK General Data Protection Regulation (UK GDPR), EU GDPR, and the UK Data Protection Act 2018.

For privacy inquiries or to exercise your rights, please contact our Data Protection Lead at privacy@promanageuk.com.

To deliver seamless booking, check-in, and guest portal services, we collect and process the following specific categories of personal data:

• Identity & Contact Information: Legal full name, email address, mobile phone number, home billing address, nationality, and date of birth.
• Reservation & Stay Details: Booking reference number, check-in and check-out dates, selected property ID, guest headcount, co-guest names, special requests, and digital guidebook usage.
• Financial & Transaction Data: Nightly rates, total stay amounts, security deposit logs, payment status, currency, and Stripe payment reference IDs. Note: Full payment card details are processed directly by Stripe (PCI-DSS Level 1 compliant) and are never stored on our servers.
• Identity Verification & Security (KYC): Encrypted government-issued photo ID scans (Passport / Driving Licence) and facial liveness verification scans required for digital key pad code release, guest verification, and fraud prevention.
• Technical & Access Data: IP address, device type, browser version, access timestamps, and guest portal authentication tokens.

Under UK GDPR Article 6, we process your personal data relying on the following lawful bases:

• Performance of a Contract: Fulfilling your property booking, providing digital key codes, issuing booking confirmations, and delivering guest support.
• Legal Obligation: Complying with UK tax laws (HMRC financial record-keeping), local lodging regulations, and statutory accounting requirements.
• Legitimate Interests: Protecting property security, preventing fraudulent transactions, managing chargeback disputes, and ensuring house rule compliance.
• Consent: Sending promotional updates or optional surveys (you may withdraw consent at any time).

We do not sell or rent your personal data. We only share data with trusted data processors strictly necessary for operating our services:

• Smoobu GmbH (PMS & Channel Manager): Central reservation availability and booking synchronization across travel channels.
• Stripe Payments Europe Ltd: Secure payment processing, pre-authorization holds, and refund issuance.
• Supabase Inc. & Cloudflare R2: Encrypted database infrastructure, access control, and secure asset storage.

We employ industry-standard encryption protocols (TLS/HTTPS in transit, AES-256 at rest) to safeguard your information.

Retention Timelines: Identity verification document scans are securely deleted 30 days after check-out. Financial and tax transaction records are retained for 6 years in compliance with UK HMRC statutory accounting regulations.

Under UK & EU GDPR, you hold the following rights regarding your personal data:

• Right of Access: Request a copy of all personal data held about you (Subject Access Request).
• Right to Rectification: Request correction of inaccurate or incomplete personal records.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your data (subject to legal/tax retention requirements).
• Right to Restriction & Object: Restrict or object to data processing for marketing or legitimate interests.
• Right to Data Portability: Obtain your personal data in a structured, commonly used format.

To submit a request, email us at privacy@promanageuk.com. If you believe your rights have been infringed, you also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.