Privacy & Fair Processing Notice
Privacy & Fair Processing Notice
SuperControl, a company registered in Scotland with the company number SC249531 and with its registered office at 4 Market Street, Castle Douglas, Dumfries And Galloway, DG7 1BE, (“SuperControl”) strives to protect the privacy of all personal data collected during the course of our activities and it is important for you to know how we process your data.
We strive to protect the privacy of all personal data collected during the course of our activities and it is important for you to know how we process your data. We will process your personal data under the terms of this policy and in accordance with any agreement with you.
We are a “data controller” in terms under data protection laws (including the UK Data Protection Act 2018 including the UK GDPR and, if applicable, the EU General Data Protection Regulation 2016 (“Data Protection Laws”).
We need to process personal data relating to our Clients/property owners, our suppliers and potential clients and also from people leaving reviews on our UpFront Reviews service (see www.upfrontreviews.com) in order to function effectively as a business, to ensure good governance, for audit purposes and to enable us to meet our legal obligations.
Personal data is processed for commercial, administrative, statutory and marketing/promotion purposes. All such personal data is collected and held in accordance with all applicable Data Protection Laws.
This Privacy & Fair Processing Notice is intended to apply to situations where we are the data controller, rather than were we act as another data controller’s data processor. For example, it applies when we process personal data about our Clients or our Suppliers. We shall act as a controller of personal data that is collected or received in accordance with this Privacy & Fair Processing Notice.
Separately, SuperControl will process personal data on behalf of third parties in its capacity as a data processor. When SuperControl processes personal data is this capacity it will be set out in a written contract with that third party (and another data controller’s Privacy Notice would apply as opposed to this Privacy & Fair Processing Notice). For example, we do this when making our Property Management System available to our Clients pursuant to our contract. In that case, our Clients are the relevant data controller and we process personal data submitted to our Property Management System by their Guests on their behalf in our capacity as their data processor. If we process personal data as a data processor, we will process such personal data in accordance with the terms of the contract we have with the third party for whom we act as data processor, and this Privacy & Fair Processing Notice shall not apply to the processing of such personal data.
Where our website includes links to websites operated by third parties, such websites will have their own privacy notices which we suggest the visitor should review. We do not accept responsibility for the content of such third party websites or any appliable privacy policies.
What personal data will SuperControl use?
This list includes all the ways we may use your personal information, and which of the reasons we rely on to do so. This is where we tell you what our legitimate interests are.
Personal data we may process from Clients/property owners
| Purposes of processing | Legal basis | Categories of personal data | Recipients | Retention period |
| Providing you with our services | Fulfilling contracts | Client/property owner name Property owner date of birth (where provided to us by the Client) Client/property owner contact details Order history Financial details Property owner Personal Tax ID (where provided to us by Client) | Our staff Other companies in our Group Our auditors Our professional advisors His Majesty’s Revenue & Customs Carefully selected third parties in the course of providing services to us under suitable obligations of confidentiality | 7 years from the last transaction or communication date |
| Allowing our Clients to be enrolled in the XCover Program so as to enable Booking Protect Limited to make XCover Refund Guarantees available to their Guests | Our legitimate interest to send your or your relevant employees’ name and contact details to Booking Protect Limited to enable them to enrol you in their XCover Program and to facilitate them making XCover Refund Guarantees available to your Guests, provided that you have not, by prior written notice, opted out of being enrolled on the XCover Program. | Client/property owner and/or employee names Client/property owner and/or employee contact details | Our staff Booking Protect Limited | 7 years from the last transaction or communication date |
| Direct marketing | Our legitimate interest for our Group companies to send marketing information to our Clients but only where permitted to do so in compliance with any applicable laws relating to marketing. | Client names Client contact details | Our staff Other companies in our Group Carefully selected third parties in the course of providing services to us under suitable obligations of confidentiality | Until you opt out of direct marketing |
| Statistical and analytical purposes | Our legitimate interest for our Group companies to perform statistical, business and market analysis and to operate the businesses of the members of our Group by understanding our client-base and our market. | Name Contact details Order history Financial details | Our staff Other companies in our Group Our auditors Our professional advisors Carefully selected third parties in the course of providing services to us under suitable obligations of confidentiality | 7 years from the last transaction or communication date |
Personal data we may process from Suppliers
| Purposes of processing | Legal basis | Categories of personal data | Recipients | Retention period |
| Performance of our contract with a supplier | Fulfilling contracts | Contact details Financial details | Our staff Other companies in our Group Our auditors Our professional advisors Carefully selected third parties in the course of providing services to us under suitable obligations of confidentiality | 7 years from the last transaction or communication date |
| Administering our business | Our legitimate interest to administer our business | Contact details Financial details IP addresses | Our staff Other companies in our Group Our auditors Our professional advisors Carefully selected third parties in the course of providing services to us under suitable obligations of confidentiality | 7 years from the last transaction or communication date |
| Communicating and managing relationships with suppliers | Our legitimate interest to keep in contact with our suppliers. | Contact details for supplier staff | Our staff | 7 years from the last transaction or communication date |
Personal data we may process from Potential clients
| Purposes of processing | Legal basis | Categories of personal data | Recipients | Retention period |
| Manage enquiries from potential clients | Taking steps to enter into a contract which we would perform with the potential client | Potential clients’ names Potential clients’ contact details | Our staff Other companies in our Group Our auditors Our professional advisors Carefully selected third parties in the course of providing services to us under suitable obligations of confidentiality | 7 years from the last transaction or communication date |
| Administering our business | Our legitimate interest to administer our business | Potential clients’ names Potential clients’ contact details | Our staff Other companies in our Group Our auditors Our professional advisors Carefully selected third parties in the course of providing services to us under suitable obligations of confidentiality | 7 years from the last transaction or communication date |
| Direct marketing | Our legitimate interest to send marketing information to potential clients in compliance with any applicable laws relating to marketing | Potential clients’ names Potential clients’ contact details | Our staff Other companies in our Group Carefully selected third parties in the course of providing services to us under suitable obligations of confidentiality | Until you opt out of direct marketing |
| Statistical and analytical purpose | Our legitimate interest to analyse personal data and produce statistical information to inform our business | Our staff Other companies in our Group Our auditors Our professional advisors Carefully selected third parties in the course of providing services to us under suitable obligations of confidentiality | 7 years from the last transaction or communication date |
Since SuperControl’s Clients are often companies, the personal data of the contacts at such companies will be processed under the legitimate interests of SuperControl, rather than by contracts with the individual data subjects.
Personal data we may process from people submitting reviews on our UpFront Reviews service
| Purposes of processing | Legal basis | Categories of personal data | Recipients | Retention period |
| Supplying questionnaire | Consent (obtained via Client/ property owner) | Reviewer contact details | Our staff | 7 years after the date any review no longer appears on our UpFront Reviews service |
| Providing and managing the UpFront Reviews service | Our legitimate interest in documenting a person’s review of a property booked through our SuperControl. | Reviewer name Reviewer contact details Details of visit (when stated, booking details etc) Experience of visit to a particular property booked through SuperControl | Our staff Other companies in our Group Our auditors Our professional advisors Carefully selected third parties in the course of providing services to us under suitable obligations of confidentiality | 7 years after the date any review no longer appears on our UpFront Reviews service |
| Managing complaints | Our legitimate interest in dealing with any complaint in relation to the review in accordance with the procedures set out in our UpFront Reviews Terms & Conditions. | Reviewer name Reviewer contact details Details of visit (when stated, booking details etc) Experience of visit to a particular property booked through SuperControl | Our staff Our Client or relevant property owner to whom the review relates The reviewer to whom the review relates Our professional advisors | 7 years after the date any review no longer appears on our UpFront Reviews service |
Where do we obtain your information?
In most cases we will obtain this information from you directly.
Processing Conditions
We process the personal data referred to above for the purposes of any contract or potential contract with our Clients/property owners, our suppliers and potential clients; or for our legitimate interests in order to function effectively as a business, to ensure good governance, for audit purposes, to perform our business activities; and to enable us to meet our legal obligations that we may be subject to.
We may also use information in aggregate, where personal data is removed, for marketing and strategic development to improve and support our activities.
Direct Marketing
If you opt-in up to receive direct marketing communications from us you will be asked to indicate your preferences for receiving direct marketing communications from via email, SMS, telephone or post.
You may also receive marketing communications from us if you have requested information from us or if you have purchased goods or services from us and you have not opted out of receiving the marketing (this is on the basis of the “soft” opt-in).
You can unsubscribe from our marketing communications at any time by following the opt-out links within any marketing communication sent to you.
If you opt out of receiving marketing communications but are a Client using our Property Management System, you will still receive service-related communications that are essential for administrative or customer service purposes.
Cookies
For more information about the cookies we use please view our Cookie Policy. For information on how to change your cookie preferences, please see our Privacy Preference Centre banner by clicking the shield icon on the bottom left had corner of our website.
Security
We employ administrative, electronic, digital and physical security measures (including encryption) to ensure that the information that we collect about you is protected from access by unauthorised persons and protected against unlawful processing, accidental loss, destruction and damage.
Please be aware that unfortunately the transmission of information via the internet or by email is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of the data transmitted to us and any transmission is at your own risk.
The period for which the personal data will be processed
We will normally retain personal data for the periods specified in the tables above.
Some personal data may be retained for longer where it is in our legitimate interest to do so, such as to protect and defend our legal rights; or for research, archiving or statistical purposes. Individuals can request that other information relating to them be erased and we will deal with such requests in accordance with the law.
Transfers outside the United Kingdom
We, or carefully selected third parties that we contract with, may send personal data to countries outside the United Kingdom (“UK”). If and when this occurs, there will be protections in place to ensure the recipient protects the data to the same standard as the UK. The protections include:
- transferring to a country with privacy laws that give the same or similar protection as the UK (such as countries in the EEA).
- putting in place a contract with the recipient that means they must protect personal data to the same standards as the UK.
- an appropriate adequacy finding, data sharing framework or “data bridge” is available to permit the lawful transfer of such personal data.
For more information on the measures we have in place to permit transfers of personal data to third countries outside the UK, please contact our Data Privacy Manager.
Data subject’s rights
As an individual, you have the following rights as a data subject under applicable Data Protection Laws in relation to the processing of your personal data:
- The right to request from us access to information held about you – (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
- The right to request that inaccurate data held about you is rectified – this enables you to have any incomplete or inaccurate information we hold about you corrected.
- The right to request the erasure of personal data – this enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing.
- The right to restriction of processing – this enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
- The right to object to processing – objection to processing of your personal information can occur where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes; and
- The right to data portability.
If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact our Data Privacy Manager, Robert Kennedy, in writing.
Where we process your personal data based upon your consent, you have the right to withdraw your consent at any time.
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal data is not disclosed to any person who has no right to receive it.
In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal data for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact our Data Privacy Manager. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.
For more information and guidance about any of these rights please go to the website of the Information Commissioner’s Office at https://ico.org.uk/
Complaints
If you think there is an issue in the way in which we handle your personal data, you have a right to raise a complaint with the Information Commissioner’s Office. Their website contains details of how to make a complaint.
Changes to this Privacy & Fair Processing Notice
We keep our Privacy & Fair Processing Notice under regular review and reserve the right to update and amend it. This notice was last updated on 20 December 2024.
Further information
For further information about the proposed data sharing set out in this notice, or about any aspect of SuperControl and the processing of your personal data, please contact our Data Privacy Manager:
Data Privacy Manager
SuperControl Ltd
4 Market Street
Castle Douglas
DG7 1BE
Scotland
Email – privacy@supercontrol.co.uk
Book a Discovery Call
Schedule a call with one of our specialist Business Development Consultants and find out how our fully integrated
Property Management System, Channel Manager and industry leading partnerships can help your business thrive.
