Privacy Policy

This policy explains how Data First collects, uses and protects personal data when you visit data-first.co.uk, contact Data First, use the Data First Client Portal, or work with Data First as a contact at one of its clients.

In short: Data First collects only what it needs to respond to you, work with its clients and run its website and Client Portal. Data First does not sell personal data. You can ask to see, correct or delete your data at any time by emailing info@data-first.co.uk.

Data First develops, builds and supports technology for hotels, spas and resorts: booking engines, websites and system integrations.

Data First is a trading name of Lyon Paul Ltd, a company registered in England and Wales (company number 12334928). Registered office: Unit 10, Homelands Commercial Centre, Vale Road, Bishops Cleeve, Cheltenham GL52 8PX.

For the personal data described in this policy, Data First is the data controller. This means Data First decides how and why that data is used and is responsible for protecting it. Section 3A explains the different position for data Data First handles on behalf of its clients.

Contact for privacy questions: info@data-first.co.uk, or write to Data First at the registered office address above. Please mark your message "Privacy".

This policy covers personal data about:

- visitors to data-first.co.uk

- people who contact Data First through the website, using the contact form or the email address shown on it

- people who ask to receive update emails from Data First

- people who work for Data First's clients and deal with Data First, such as named contacts, people who raise or approve support requests, and people who receive invoices

- people who use the Data First Client Portal at portal.data-first.co.uk

This policy does not cover other websites linked from data-first.co.uk. Please read their privacy policies separately.

Data First collects only the information it needs. Please don't include sensitive information, such as health details, in your messages or support requests.

Who | Data collected | How it is collected

Website enquiries | Name, organisation, email address, phone number and your message | From you, through the contact form or by email.

Update emails | Name, email address and organisation | From you, when you ask to receive updates.

Website visitors | IP address, device and browser type, pages viewed, how you arrived at the site, approximate location (town or region level) | Cookies, only if you accept them (see section 5).

Client contacts | Name, job title, organisation, work email address, work phone number, your role in the relationship (for example primary contact or invoice contact), correspondence and meeting notes, and approvals you give | From you, or from your employer when it names you as a contact in an agreement or order.

Client Portal users | Name, work email address, login details, the support requests you raise and comment on (including any attachments and screenshots), approvals and sign-offs, time records linked to your requests, and technical data such as IP address, browser type and activity logs | From you, when you use the Client Portal, and automatically when you log in and use it

When Data First maintains and supports a client's website, booking engine and systems, it may see or handle personal data that belongs to that client, such as guest bookings, customer accounts and gift card purchases. This includes guest details that appear in support requests or screenshots.

For that data, the client is the controller and Data First acts as its processor. Data First uses it only to provide services to the client, on the client's instructions and under a written data processing agreement. If you are a guest or customer of one of Data First's clients, the client's own privacy notice explains how your data is used, and you should contact the client to exercise your rights. If you contact Data First instead, it will pass your request to the client.

Data protection law requires a lawful basis for each use of personal data. The table below sets out what Data First uses your data for and the basis it relies on.

Purpose | Lawful basis

Replying to enquiries and providing information you ask for | Legitimate interests (responding to people who contact the business), or steps before entering a contract.

Following up an enquiry about working together | Legitimate interests.

Sending update emails you have asked for | Consent. You can unsubscribe at any time using the link in every email.

Managing Data First's relationship with its clients, including communicating with client contacts, handling support requests, recording approvals and reporting | Legitimate interests (providing the services Data First has agreed to provide to your employer).

Providing and securing the Client Portal, including user accounts, access control and activity logs | Legitimate interests (keeping the portal working and secure, and keeping an accurate record of requests and approvals).

Invoicing and keeping accounting records | Legal obligation and legitimate interests.

Running and securing the website | Legitimate interests (keeping the site working, secure and useful).

Measuring website use with Google Analytics | Consent, given through the cookie banner.

Measuring advertising, such as Google Ads | Consent, given through the cookie banner.

Complying with the law, handling complaints and protecting Data First's legal rights | Legal obligation and legitimate interests.

Where Data First relies on legitimate interests, it has balanced those interests against your rights. You can ask for details of that assessment.

No automated decisions. Data First does not make decisions about you based solely on automated processing that have legal or similarly significant effects.

AI tools. Data First uses AI tools to help with everyday work such as drafting, summarising, investigating support requests and development tasks. Data First uses business-grade tools under commercial terms that include data protection commitments and prevent the provider from using the data to train its models. It does not use them to make decisions about you, and it limits any personal data it puts into them to what is needed for the task.

Cookies are small files stored on your device when you visit a website. Data First uses them to make its website and Client Portal work, to understand how the website is used, and, with your consent, to measure advertising.

Type | What it does | Your choice

Strictly necessary | Keeps the site and Client Portal secure and working, keeps you logged in to the portal, and remembers your cookie choices | Always on, as the site and portal cannot work without them.

Analytics | Google Analytics counts visits and shows which pages are useful, so Data First can improve the site. Data is reported in aggregate. | Off until you accept.

Advertising | Measures whether Data First's Google Ads lead to visits or enquiries, and may help show relevant ads | Off until you accept.

You can change your choices at any time using Cookie settings in the website footer, or through your browser settings. Blocking some cookies may affect how the site works.

The cookies used on data-first.co.uk are:

Cookie | Set by | Type | Purpose | How long it lasts

| df_consent | Data First | Necessary | Remembers your cookie choices | 12 months |

| XSRF-TOKEN | Data First | Necessary | Protects forms against cross-site request forgery | 2 hours |

| laravel_session | Data First | Necessary | Keeps your session working as you move between pages | 2 hours |

| _GRECAPTCHA | Google reCAPTCHA | Necessary (security) | Protects the contact form from spam and abuse. Set on google.com | 6 months |

| _ga | Google Analytics | Analytics | Distinguishes visitors so they can be counted | 2 years |

| ga4JXS8Y34FE | Google Analytics | Analytics | Keeps track of your visit | 2 years |

| gclau | Google Ads (once advertising is live) | Advertising | Measures whether ads lead to visits or enquiries | 90 days |

The Client Portal (portal.data-first.co.uk) uses only strictly necessary cookies:

Cookie | Set by | Type | Purpose | How long it lasts

| [XSRF-TOKEN] | Data First | Necessary | Protects forms against cross-site request forgery | [2 hours] |

| [portal session cookie name] | Data First | Necessary | Keeps you logged in as you move between pages | [2 hours] |

| [remember-me cookie, if used] | Data First | Necessary | Keeps you logged in between visits, if you choose this option | [period] |

Analytics and advertising cookies are only set on data-first.co.uk, and only if you accept them. The Client Portal does not use analytics or advertising cookies.

Data First does not sell your personal data. It shares data only where needed, with:

- Service providers who help run the website, the Client Portal and the business, such as website and Client Portal hosting, email and collaboration tools, AI tools, Google Analytics and Google reCAPTCHA. They act on Data First's instructions and must keep your data secure.

- Advertising platforms, such as Google, only where you have accepted advertising cookies.

- Professional advisers, such as accountants, lawyers and insurers, where needed.

- Regulators, law enforcement or courts, where the law requires it.

- A buyer or investor, if Data First is involved in a sale, merger or investment. Any recipient would have to protect your data in line with this policy.

A list of Data First's main service providers is available on request.

Some of Data First's service providers store or access data outside the UK, for example in the European Economic Area or the United States.

When this happens, Data First makes sure your data stays protected by using one of the safeguards UK law allows. These include countries the UK recognises as having adequate protection, the UK-US Data Bridge, or approved contract terms such as the UK International Data Transfer Agreement.

You can ask for more information about these safeguards.

Data First keeps personal data only as long as it needs it for the reason it was collected.

Data | How long it is kept

Enquiries that do not lead to work | Up to 2 years from the last contact.

Enquiries that lead to work | Moved into client records (below).

Client contact records, correspondence and agreements | For the length of the relationship with the client, and then [6 years] to meet legal and accounting requirements and deal with any claims.

Invoices and accounting records | [6 years] from the end of the financial year they relate to, as the law requires.

Client Portal accounts | Until the client's agreement ends, or earlier if the client removes you as a user.

Support requests and portal activity logs | Until the client's agreement ends, and then deleted or returned to the client in line with that agreement.

Update email subscribers | Until you unsubscribe.

Analytics data | 14 months.

Unsubscribe records | Kept indefinitely as a short suppression record, so Data First does not contact you again.

At the end of these periods, Data First securely deletes or anonymises the data.

Data First uses technical and organisational measures to protect personal data from loss, misuse and unauthorised access. These include access controls so only people who need data can see it, multi-factor authentication on key systems, encrypted connections, and confidentiality terms with subcontractors.

No system is completely secure. If a data breach is likely to put your rights at risk, Data First will tell you and the ICO where the law requires it.

Under UK data protection law you have the right to:

- Access a copy of the personal data Data First holds about you

- Correct data that is wrong or incomplete

- Delete your data in certain circumstances

- Restrict how your data is used in certain circumstances

- Object to Data First using your data based on legitimate interests, including for direct marketing at any time

- Data portability: receive data you gave Data First in a common format, or have it sent to another organisation, where the processing is based on consent or contract

- Withdraw consent at any time, where Data First relies on consent. This does not affect anything done before you withdrew it.

How to make a request. Email info@data-first.co.uk with "Privacy request" in the subject line. Tell Data First which right you want to use and give enough detail to find your data. Data First may ask you to confirm your identity.

What happens next. Data First will respond within one month of receiving your request. If a request is complex, this may be extended by up to two more months, and Data First will tell you why. There is usually no charge.

If your request is about data Data First handles for one of its clients (section 3A), Data First will pass it to that client.

If you are unhappy with how Data First has handled your personal data, please tell Data First first, so it can put things right.

How to complain. Email info@data-first.co.uk with "Data protection complaint" in the subject line, or write to the registered office address in section 1.

What happens next. Data First will acknowledge your complaint within 30 days of receiving it. It will then look into it and reply without undue delay, explaining what it found and any action taken.

Complaining to the ICO. You also have the right to complain to the Information Commissioner's Office, the UK regulator for data protection. Website: ico.org.uk/make-a-complaint. Helpline: 0303 123 1113.

Data First reviews this policy regularly and will update it if the way it uses personal data changes. The date at the top shows when it was last updated. If a change significantly affects you, Data First will let you know directly where it can.

For any question about this policy or your personal data:

- Email: info@data-first.co.uk

- Post: Data First, Unit 10, Homelands Commercial Centre, Vale Road, Bishops Cleeve, Cheltenham GL52 8PX