GuestRevu Privacy Policy

1. Overview

This Privacy Policy explains how GuestRevu collects, uses and protects personal data in connection with:

• the GuestRevu website
• the GuestRevu reputation management platform
• integrations with third-party review and social media platforms
• communications with customers and users.

In summary:

• GuestRevu collects limited personal data necessary to provide its services.
• Hospitality businesses using GuestRevu remain the data controllers for guest feedback and review data processed through the platform.
• GuestRevu acts as a data processor for such data and processes it only on customer instructions.
• GuestRevu does not sell personal data.
• Personal data is protected using appropriate technical and organisational security measures.

Full details are provided in the sections below.

2. Introduction

GuestRevu (“GuestRevu”, “we”, “our”, or “us”) is committed to protecting and respecting personal data.

This Privacy Policy explains how GuestRevu collects, uses, stores, and protects personal data when:

• you use our website
• you use the GuestRevu platform and services
• your organisation interacts with our services
• you interact with us through third-party platforms such as review sites or social media integrations.

GuestRevu provides reputation management and guest feedback software for the hospitality industry.

3. Use of the GuestRevu Website

When you visit the GuestRevu website (www.guestrevu.com) we may collect limited information including contact details submitted through enquiry or demo request forms, analytics data, cookie information, and marketing interaction data. This information is used to respond to enquiries, provide requested information, improve our website and services, and understand how visitors interact with our content.

The GuestRevu public website is hosted by HubSpot, which may process visitor data such as analytics information, form submissions, and marketing interaction data on our behalf in accordance with applicable data protection laws.

This policy applies to:

• website visitors
• customers and prospective customers
• authorised users of the GuestRevu platform
• individuals whose feedback or review data may be processed through our services.

4. Data Controllers and Contact Information

For the purposes of applicable data protection laws including:

• UK General Data Protection Regulation (UK GDPR)
• EU General Data Protection Regulation (EU GDPR)
• Data Protection Act 2018
• Protection of Personal Information Act (POPIA)
• California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA)
• Colorado Privacy Act (CPA)
• Connecticut Data Privacy Act (CTDPA)
• Virginia Consumer Data Protection Act (VCDPA)
• Utah Consumer Privacy Act (UCPA)
• Oregon Consumer Privacy Act (OCPA)
• Texas Data Privacy and Security Act (TDPSA)
• Montana Consumer Data Privacy Act (MCDPA), and other applicable comprehensive US state consumer privacy
  laws

The GuestRevu services are provided by the following entities depending on the region in which services are delivered:

Where services are provided by GuestRevu (Pty) Ltd, that entity acts as the data controller for the purposes of POPIA. Where services are provided by GuestRevu Ltd, that entity acts as the data controller for the purposes of UK GDPR and EU GDPR. Both entities may jointly determine certain processing activities related to the operation of the GuestRevu platform. GuestRevu does not currently operate a separate United States entity; for individuals in the United States, GuestRevu Ltd (United Kingdom) is the responsible entity.

GuestRevu has appointed responsible persons for data protection oversight under the UK GDPR and EU GDPR, and has designated an Information Officer for the purposes of the Protection of Personal Information Act (POPIA) in South Africa. The US state privacy laws referred to above do not require a separate statutory officer designation; oversight of GuestRevu's compliance with those laws is coordinated through the same privacy function, contactable as set out below.

For privacy enquiries please contact: privacy@guestrevu.com

Individuals in the United Kingdom may lodge complaints with the Information Commissioner’s Office (ICO).
Individuals in South Africa may lodge complaints with the Information Regulator (South Africa).
Individuals in the United States may lodge complaints with their state Attorney General or other applicable state privacy regulator, where such a right exists under applicable law.

5. Our Role: Data Controller and Data Processor

GuestRevu operates in two different data protection roles depending on the context.

5.1 GuestRevu as Data Controller

GuestRevu acts as a data controller when processing personal data relating to:

• website visitors
• prospective customers
• account administrators
• marketing contacts
• support interactions

In these situations GuestRevu determines how and why personal data is processed.

5.2 GuestRevu as Data Processor

GuestRevu acts as a data processor when providing its reputation management and guest feedback services to hospitality businesses.

Our customers (for example hotels or accommodation providers) are the data controllers for guest information collected through surveys, reviews or feedback requests.

In these cases, GuestRevu processes personal data only on the instructions of the customer and in accordance with our Data Processing Agreement.

6. Categories of Personal Data We Collect

We may collect and process the following categories of personal data.

6.1 Information you provide directly

This may include:

• name
• email address
• telephone number
• company name
• job title
• account login information
• communications with GuestRevu
• other personal data provided by the Customer in its configuration of the GuestRevu system, or submitted through forms and/or support requests

6.2 Account and subscription information

This includes:

• account registration details
• billing information
• subscription history
• transaction records

Payment details are processed by our payment providers and are not stored on GuestRevu servers.

6.3 Guest feedback and review data

Where our customers use GuestRevu to manage reviews or feedback, the platform may process information relating to hospitality guests including:

• guest name
• feedback responses
• ratings
• review text
• publicly available review content from external platforms

This information is processed on behalf of our customers as part of our services.

6.4 Technical and usage information

When you use our website or platform we may collect:

• IP address
• device information
• browser type
• operating system
• usage logs
• analytics data
• page interactions

Where possible this information is aggregated or anonymised.

6.5 Information from third-party platforms

Where customers connect external services to the GuestRevu platform, we may collect publicly available data from third-party platforms such as:

• Facebook
• Booking.com
• Expedia
• Google
• TripAdvisor
• other review or reputation platforms

This may include publicly available reviews, engagement data or account identifiers necessary to provide our services.

For visitors and users in the United States, the table below summarises these categories of personal data collected in the preceding 12 months, together with their source and business purpose, for the purposes of applicable US state
privacy laws.

*Guest Feedback Data: where a business uses GuestRevu to manage guest reviews and feedback, that business (GuestRevu’s customer) is generally the controller/business responsible for guest personal data, and GuestRevu processes it as a processor/service provider on that business’s behalf. Guests wishing to exercise privacy rights over their feedback data should generally contact the relevant business directly; GuestRevu will assist that business in responding, consistent with our Data Processing Agreement.

GuestRevu does not intentionally collect sensitive personal data (such as data revealing racial or ethnic origin, health information, or precise geolocation) through the website or platform, other than information a guest or user may voluntarily include within free-text feedback. GuestRevu does not use such information for any purpose requiring opt-in consent or a right to limit use of sensitive personal data under applicable US state privacy law, beyond providing the Services.

7. Lawful Bases for Processing

GuestRevu processes only the personal data that is necessary for the purposes described in this Privacy Policy and takes reasonable steps to ensure that such data is relevant, accurate and limited to what is required for those purposes. Where GuestRevu processes publicly available review content from third-party platforms, such processing is carried out under legitimate interests to enable reputation management services for our customers.

We process personal data under the following lawful bases:

7.1 Contract

To provide GuestRevu services to customers and fulfil our contractual obligations.

7.2 Legitimate interests

To improve our services, maintain security, perform analytics and communicate with customers about relevant services.

7.3 Consent

For marketing communications and non-essential cookies.

7.4 Legal obligation

Where we must retain or disclose information to comply with applicable laws.

8. How We Use Personal Data

We use personal data to:

• provide and operate the GuestRevu platform
• deliver guest feedback and reputation management services
• enable integrations with review platforms and social media
• communicate with customers and support users
• improve platform functionality and performance
• process payments and manage subscriptions
• send relevant service updates or product information
• maintain security and prevent fraud

GuestRevu does not sell personal data to third parties, and does not share personal data for cross-context behavioural
advertising, as that term is defined under applicable US state privacy laws. GuestRevu does not currently offer any
financial incentive, discount or other benefit in exchange for the collection, sale or retention of personal data.

9. Artificial Intelligence and Automated Tools

GuestRevu may use automated technologies including artificial intelligence to support certain features of the platform.

These may include:

• sentiment analysis of review content
• automated categorisation of feedback
• AI-assisted reply suggestions

These tools are used to assist users and do not make decisions that produce legal or similarly significant effects on individuals. Where AI tools are used, personal data is processed solely to provide the requested service and is not used to train external models unless explicitly permitted.

AI tools used within GuestRevu process review content solely for the purpose of providing insights and assistance to platform users. Guest data is not used to train external AI models.

10. Cookies and Tracking Technologies

Our website and applications use cookies and similar technologies to improve user experience and analyse usage.
Cookies may be used for the following purposes, each with its own legal basis and duration:

• Essential platform functionality — necessary for the website and platform to operate; used on the basis of legitimate interest and contractual necessity; do not require consent; typically session-based or short-term persistent cookies.
• Analytics — used to understand and improve usage of our website and platform; used only with your consent; may be set by third-party analytics providers acting on our behalf; duration is set out in our cookie consent tool.
• Remembering user preferences — used with your consent where not strictly necessary; persistent, retained
  until you change your preferences, withdraw consent, or clear your browser.
• Security and fraud prevention — necessary to protect our services and users; used on the basis of legitimate interest; do not require consent; typically session-based.

Some cookies, particularly analytics cookies, may be set by third-party service providers acting on our behalf. We require these providers to use the data collected only for the purposes we specify and in accordance with applicable data protection law. Non-essential cookies are used only with your consent and are managed through our cookie consent tool.

You have the right to withdraw or change your cookie preferences, and to object to non-essential cookies, at any time through our cookie consent tool. This section is intended to comply with the UK Privacy and Electronic Communications Regulations (PECR), the UK GDPR, the EU GDPR, and, for visitors in South Africa, the Protection of Personal Information Act (POPIA), and, for visitors in the United States, applicable state privacy laws. Where required by applicable US state privacy law, GuestRevu honours recognised opt-out preference signals, including the Global Privacy Control, as a valid request to opt out of any sale or sharing of personal data, or use of personal data for targeted advertising.

11. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected.

Typical retention periods include:

• Financial records — up to 6 years
• Customer support records — up to 2 years after account closure
• Analytics data — retained for as long as necessary to provide services to the Customer, anonymised or deleted thereafter

System logs and security logs may be retained for limited periods where necessary for platform security, fraud prevention, and operational monitoring. Retention periods may vary depending on legal, contractual or operational requirements.

Where GuestRevu processes personal data on behalf of its customers in its capacity as a data processor/operator, retention periods are determined by the customer as data controller, subject to any applicable legal or contractual obligations. GuestRevu will retain such data only for as long as necessary to provide the services or as instructed by the customer.

12. Data Storage and International Transfers

12.1 Contracting Entity

Depending on your location and the services being provided, your contract may be with either GuestRevu Ltd (UK) or GuestRevu (Pty) Ltd (South Africa). The relevant entity providing the service will be identified in your customer agreement or order form. Both entities may share certain operational systems and infrastructure in order to deliver the GuestRevu platform and services.

GuestRevu primarily hosts its platform infrastructure on Amazon Web Services (AWS). Our primary production environment is hosted in the United Kingdom, with selected supporting workloads hosted in South Africa.

Because GuestRevu operates internationally through GuestRevu Ltd (UK) and GuestRevu (Pty) Ltd (South Africa), personal data may be accessed or processed by authorised personnel located in the United Kingdom, the European Economic Area, or South Africa.

Where data is transferred between GuestRevu entities or to other countries, we implement appropriate safeguards including:

• Standard Contractual Clauses (SCCs)
• adequacy decisions where applicable
• contractual data protection commitments with processors
• organisational and technical security safeguards

For South African data subjects, international transfers occur only where permitted under POPIA, including where adequate protection exists, where the data subject consents, or where the transfer is necessary for the performance of a contract.

Personal data may also be transferred to the United States in connection with GuestRevu’s use of US-based sub- processors and service providers (see ‘Sub-processors and Third-Party Service Providers’ below). Depending on the specific provider, such transfers are safeguarded through Standard Contractual Clauses, the UK International Data Transfer Addendum, the EU–US Data Privacy Framework, the UK–US Data Bridge, or other legally recognised transfer mechanisms, as applicable to that provider.

13. Sub-processors and Third-Party Service Providers

GuestRevu works with trusted service providers who support our operations.

These may include:

• Amazon Web Services (AWS)
• OpenAI
• Google
• Linode
• Mailgun
• HubSpot
• ChargeBee
• QuickBooks
• Stripe
• PayPal

These providers process personal data only where necessary to provide services to GuestRevu and are contractually required to maintain appropriate data protection standards.

GuestRevu requires all sub-processors to implement appropriate technical and organisational measures to protect personal data.

GuestRevu may update or replace its sub-processors from time to time as our services evolve or operational requirements change. Any such providers will be required to meet appropriate data protection and security standards consistent with applicable data protection laws. An updated list of sub-processors is available on request.

14. Data Security

GuestRevu implements technical and organisational measures to protect personal data, including:

• encryption in transit and at rest
• strict access controls
• secure infrastructure and monitoring
• internal security policies and procedures

GuestRevu maintains internal procedures for monitoring, detecting and responding to potential security incidents affecting personal data.

GuestRevu regularly reviews and updates its security controls to protect personal data against unauthorised access, alteration, disclosure or destruction. While we take strong precautions, no method of transmission over the internet is completely secure.

15. Data Subject Rights

Depending on your location, you may have rights including:

• access to personal data
• correction of inaccurate information
• deletion of personal data
• restriction of processing
• objection to processing
• data portability
• withdrawal of consent
• opting out of the sale or sharing of personal data, or its use for targeted advertising or certain profiling, where
  applicable under US state privacy law
• appealing a decision on your request, where required by applicable US state privacy law
• limiting the use of sensitive personal data, where applicable under US state privacy law

Requests can be submitted to: privacy@guestrevu.com

We will respond within the timeframes required by applicable law. For individuals in the United States, this is generally within 45 days of a verified request, which we may extend once by a further 45 days where reasonably necessary, with notice to you; we may need to verify your identity before acting on a request, and you may designate an authorised agent to submit a request on your behalf, subject to our ability to verify the agent’s authority to act for you. Where applicable US state privacy law provides a right to appeal a decision on your request, you may submit an appeal to privacy@guestrevu.com; if your appeal is unsuccessful, you may be entitled to refer the matter to your state Attorney General or other applicable regulator.

16. Facebook and Instagram (Meta) Data Use

Where customers connect Facebook, Instagram or other Meta services to the GuestRevu platform, GuestRevu may process publicly available Page content such as reviews, ratings, comments, engagement metrics, and limited account or Page identifiers necessary to connect and maintain the integration.

This data is processed in accordance with this Privacy Policy and the applicable Meta Platform Terms.

17. Facebook Data Deletion Instructions

If you have connected your Facebook account to GuestRevu and wish to request deletion of associated data, you may:

• Disconnect the integration within your GuestRevu account settings, or
• Contact GuestRevu support at privacy@guestrevu.com

Data collected through Facebook integrations is processed in accordance with the Meta Platform Terms and applicable data protection laws. Upon receiving a verified request, GuestRevu will delete Facebook-derived data associated with the requesting user where permitted by law.

18. Children’s Data

GuestRevu services are not directed to children. Where personal data relating to children is processed through the platform, this occurs on behalf of customers acting as data controllers. Customers are responsible for ensuring that appropriate legal bases, including parental or guardian consent where required, are obtained.

We do not knowingly collect personal data from individuals under the age of 16. If such data is discovered, it will be deleted promptly. Consistent with our approach to personal data generally, we do not sell or share the personal data of minors.

19. Links to Third-Party Websites

Our website may contain links to third-party websites.

GuestRevu is not responsible for the privacy practices of external sites and we encourage users to review their privacy policies.

20. Changes to This Policy

We may update this Privacy Policy periodically.

When changes occur, we will:

• update the “Last updated” date
• notify users where appropriate.

21. Contact

GuestRevu maintains a single central contact point for all data protection and privacy-related enquiries, including data subject requests. For questions about this policy or your personal data please contact: privacy@guestrevu.com

If you are not satisfied with our response you may lodge a complaint with the relevant supervisory authority for your location, as set out in ‘Data Controllers and Contact Information’ above.