Privacy Policy

1.1 This Privacy Policy is provided by Bokora Ltd, a company registered in England and Wales under company number 17072794 with registered office at 3rd Floor, 86-90 Paul Street, London, England, EC2A 4NE (we, our or us), for use of our products and services, including the Bokora platform accessible at bokora.co.uk and any associated services we offer (Services). The platform supports Guest, Host and Hotel accounts.

1.2 We take your privacy very seriously. Please read this Privacy Policy carefully as it contains important information on how and why we collect, store, use and share any information relating to you (your personal data). It also explains your rights in relation to your personal data and how to contact us or the relevant regulator if you have a complaint. Our collection, storage, use and sharing of your personal data is regulated by law, including under the UK General Data Protection Regulation (UK GDPR).

1.3 We are the controller of personal data obtained via the Services, meaning we are the organisation legally responsible for deciding how and for what purposes it is used. We are registered with the UK Information Commissioner's Office (ICO) under registration reference ZC102331.

2.1 This Privacy Policy relates to your use of the Services only. The Services link to or rely on websites, APIs and services operated by trusted third parties (such as Stripe and Google) to enable us to provide the Services to you. These third parties may also gather information about you in accordance with their own separate privacy policies, which you should consult as appropriate. For more information, see the section 'Who we share your personal data with' below.

3.1 The personal data we collect about you depends on the particular activities carried out through the Services. We collect and use the following personal data about you:

We collect and use this personal data for the purposes described in the section 'How and why we use your personal data' below.

4.1 Sensitive personal data (also known as special category data) means information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data (where used for identification purposes), data concerning health, or data concerning a person's sex life or sexual orientation.

4.2 We do not knowingly or intentionally collect sensitive personal data or information about criminal convictions, and you should not submit sensitive data to us. If you do submit sensitive data (for example, by including it in a message to a Host or in a review), we will assume that you have purposefully made it manifestly public.

5.1 We collect personal data from you directly, when you create an account, make or manage a booking, submit a booking enquiry, list a property, communicate with other users through the platform, or contact us; and indirectly, through your activity while using the Services, including by using cookies and similar technologies as described in our Cookies Policy, available on the platform.

5.2 If you do not provide personal data we ask for where it is required, it may prevent us from providing the Services to you (for example, we cannot process a booking without your booking details and payment).

6.1 Under data protection law, we can only use your personal data if we have a proper reason, namely: where you have given consent; to comply with our legal and regulatory obligations; for the performance of a contract with you or to take steps at your request before entering into a contract; or for our legitimate interests or those of a third party. A legitimate interest is when we have a business or commercial reason to use your information, so long as this is not overridden by your own rights and interests; we carry out a balancing assessment when relying on legitimate interests, details of which you can obtain by contacting us.

6.2 The table below explains what we use your personal data for and why.

7.1 We may use email marketing to inform you of our services, such as promotions. We will only send you marketing communications with your consent, and you can opt out at any time by contacting us at hello@bokora.co.uk or by using the 'unsubscribe' link included in every marketing email. We will never sell your personal data, or share it with other organisations for their marketing purposes.

8.1 We routinely share personal data with:

(a) Hosts/Hotels and Guests: when a booking is made, we share basic contact information and booking details between the relevant Guest and Host/Hotel to facilitate the booking. The Host/Hotel uses that information as a separate controller for the purposes of providing your stay;

(b) Stripe: for payment processing, payouts and fraud prevention (see https://stripe.com/gb/privacy);

(c) Google: for analytics and Google Sheets sync features (see https://policies.google.com/privacy);

(d) email service providers: to send transactional and (with your consent) marketing emails; and

(e) IT, hosting and other service providers we use to help us run our business and provide the Services.

8.2 We only allow service providers to handle your personal data if we are satisfied they take appropriate measures to protect it, and we impose contractual obligations on service providers so they can only use your personal data to provide services to us and to you.

8.3 We may also occasionally need to share your personal data with external auditors and professional advisers (bound by confidentiality obligations); law enforcement agencies, courts, tribunals and regulatory bodies, to comply with legal and regulatory obligations; and other parties in connection with a significant corporate transaction or restructuring (anonymised where possible, with recipients bound by confidentiality obligations). We do not sell your personal data to third parties.

9.1 The platform is international: Hosts/Hotels and Guests are located around the world. Where you make a booking for accommodation located outside the UK (or a Host receives a booking from a Guest located outside the UK), we transfer the booking details and contact information to the relevant Host or Guest in that country because the transfer is necessary for the performance of your contract, in accordance with Article 49(1)(b) UK GDPR.

9.2 Where we transfer your personal data to service providers located outside the UK, we can only do so where: the UK government has decided the particular country ensures an adequate level of protection of personal data (an 'adequacy regulation') under Article 45 UK GDPR; there are appropriate safeguards in place (such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses), together with enforceable rights and effective legal remedies for you; or a specific exception applies under relevant data protection law.

10.1 We keep your personal data for as long as you have an active account with us and as needed to fulfil the purposes described in this policy. Booking and transaction records are retained for 7 years for tax and legal compliance purposes, including in the event of the pursuit or defence of legal claims. Following the end of the applicable retention period, we will delete or anonymise your personal data.

11.1 You generally have the following rights, which you can usually exercise free of charge:

For further information on each of these rights, including the circumstances in which they do and do not apply, contact us (see 'How to contact us' below) or refer to the guidance from the ICO at ico.org.uk. To exercise any of these rights, email us at hello@bokora.co.uk, providing enough information to identify yourself (e.g. your full name and the email address on your account) and letting us know which right you want to exercise and the information to which your request relates.

12.1 We have appropriate security measures to prevent personal data from being accidentally lost, or used or accessed unlawfully, including encryption in transit (HTTPS) and access controls, and we limit access to your personal data to those who have a genuine business need to access it. We do not store full payment card numbers; payments are processed by Stripe. However, no method of transmission over the internet is completely secure.

12.2 We have procedures in place to deal with any suspected data security breach, and we will notify you and any applicable regulator of a suspected breach where we are legally required to do so. For detailed information on protecting your information and devices against fraud and other online problems, visit www.getsafeonline.org, which is supported by HM Government and leading businesses.

13.1 Please contact us if you have any queries or concerns about our use of your information (see 'How to contact us' below); we hope we will be able to resolve any issues you may have. You also have the right to lodge a complaint with the Information Commissioner, who can be contacted at https://ico.org.uk/make-a-complaint or on 0303 123 1113. If you are resident in the EEA, you may also complain to your local supervisory authority.

14.1 We may change this Privacy Policy from time to time. When we make significant changes, we will take steps to inform you, for example via the Services or by email.

15.1 You can contact us by post or email if you have any questions about this Privacy Policy or the information we hold about you, to exercise a right under data protection law, or to make a complaint. Our contact details are: Bokora Ltd, 3rd Floor, 86-90 Paul Street, London, England, EC2A 4NE; hello@bokora.co.uk.