Who We Are

Hospo is the controller of the personal data described in this policy, which means we decide why and how it is used and are responsible for using it lawfully.

Definitions

• Freelancer means a self-employed hospitality professional who has applied to, or works through, Hospo.
• Venue means a business that uses Hospo to book Freelancers, and Venue Manager means a person who posts or manages shifts for a Venue.
• Shift means a period of work at a Venue booked through Hospo.
• Personal data means any information about an identified or identifiable person.
• Processor means a company that handles personal data on our behalf and on our instructions. Our processors are listed in Schedule A.

Personal Data We Collect

3.1 If you are a Freelancer

• Application: your first and last name and mobile number.
• Interview: the email address you give us to receive the invite, the time you booked, the video call link, and our notes and decision.
• Your details: your name, email address, date of birth, and home address.
• Emergency contact: the name, relationship to you, and mobile number of someone we can contact in an emergency. Please tell them you have given us their details.
• Bank details: your bank name, the name on the account, account number, and sort code, used only to pay you.
• Right to work: a copy of your passport, biometric residence permit, or share code letter.
• Work preferences: the roles you can do, the days you want to hear about shifts, and the London boroughs you will travel to.
• Reference: the name, relationship to you, company or venue, and contact details of a referee. Please tell them you have given us their details.
• Declaration: the name you type to sign the Freelancer Declaration, when you signed it, and which version you signed.
• Shift activity: every shift offer we send you and whether it was delivered; every time you tap Accept and what came of it; the shifts you are booked on and work; check-ins; drop-outs and no-shows; the ratings and comments Venues give about your work; and the payments we make to you.

3.2 If you are a Venue Manager

• Contact details: your name, mobile number, and email address.
• Venue details: the venue's name, address, type, and dress code.
• Shifts: the shifts you post, change, confirm, and cancel, and check-ins you confirm.
• Payment: if you pay by card, your card is held by Stripe; we keep only Stripe's reference to it and never see or store your full card number. If your Venue pays by invoice, its billing name, billing email address, billing address, payment terms, invoices, and payment history.
• Ratings and comments you give about Freelancers.

3.3 If we contact your venue about using Hospo

When we approach venues about Hospo, we keep the name, role, and business contact details of the people we speak to, and notes of our conversations. This comes from you or from public sources such as the venue's own website.

3.4 If you visit our website

Our hosting provider, Cloudflare, processes your IP address and browser details to deliver the website to you and protect it from abuse and bots. We count visits using Cloudflare Web Analytics, which gives us totals (such as page views and the country visits come from) and does not identify you. We collect nothing else unless you fill in one of our forms. See section 6 for cookies.

3.5 WhatsApp

Most of the Service runs on WhatsApp. When you message us, or we message you, we receive the content of the messages and your phone number. WhatsApp, operated by Meta, also processes your data under its own privacy policy.

How We Use Your Personal Data

We only use personal data where UK GDPR gives us a lawful basis. The table sets out what we do, with which data, and on what basis.

4.1 How we decide who hears about a shift first

We keep a record of every shift offer we send each Freelancer and every response. We use that record, together with ratings, drop-outs, and no-shows, to decide the order in which Freelancers are offered shifts, so that the people most likely to take and complete a shift hear about it first. This affects the order and timing of offers, not whether you remain on the platform. Any decision to suspend or remove a Freelancer is made by a person at Hospo, not by a computer. If you want to know how this applies to you, or want a person to review it, contact us at support@hospo.ltd.

Who We Share Your Data With

We do not sell personal data. We share it only as follows.

5.1 Between Freelancers and Venues

When a Freelancer is booked on a Shift, we tell the Venue the Freelancer's name and role, and we tell the Freelancer the Venue's name, address, and the Shift details. We do not give Venues a Freelancer's phone number or email address, or Freelancers a Venue Manager's, unless the person agrees.

5.2 Our processors

The companies listed in Schedule A handle personal data on our behalf, only on our instructions, and under agreements that require them to keep it secure. They may not use it for their own purposes.

5.3 Other disclosures

• To the police, regulators, or courts, where the law requires it.
• To our professional advisers, such as accountants, lawyers, and insurers, where necessary.
• To a buyer or investor if our business is sold or merged. We will tell you before your data becomes subject to a different privacy policy.

Cookies and Similar Technologies

• No tracking or advertising cookies: our website does not set cookies to track you or show you adverts, and we do not use Google Analytics.
• Security cookies: Cloudflare, which hosts our website, may set short-lived cookies to protect the site from bots and abuse. These are strictly necessary for the site to work safely.
• Bot check: our shift form uses Cloudflare Turnstile to check that a person, not a bot, is submitting it.
• Visit counting: Cloudflare Web Analytics counts visits without cookies and without tracking you across websites.
• A setting for your visit: our home page stores which view you chose in your browser for the current visit only. It is deleted when you close the tab.
• Fonts and icons: our pages load fonts from Google and icons from jsDelivr, which means those providers receive your IP address so they can send the files to your browser.

Because we use only what is strictly necessary and cookie-free visit counting, we do not show a cookie consent banner.

International Transfers of Personal Data

Some of our processors are based in, or access data from, countries outside the UK, including the United States. Where a country does not have UK adequacy status, we rely on one of the following safeguards:

• the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge"), where the provider is certified under it; or
• the International Data Transfer Agreement issued by the Information Commissioner, or the UK Addendum to the EU Standard Contractual Clauses.

How Long We Keep Your Data

• Applications we do not take forward: 12 months after our decision.
• Freelancer and Venue Manager accounts: while the account is open, then 6 years after your last Shift, for tax and legal purposes.
• Bank details: while your account is open. Deleted when it closes; records of payments we made to you are kept as shift records.
• Right to work documents: while your account is open, then deleted within 12 months of it closing, unless the law requires us to keep them longer.
• Emergency contact and reference details: while your account is open, then deleted.
• Shift offers and Accept taps: 5 years from the offer or tap.
• Shift records, ratings, payments, invoices, and messages: 6 years, for accounting and legal purposes.
• Venue contacts and conversation notes: 3 years after our last contact, or sooner if you ask us to stop contacting you.

When we no longer need data, we delete it or anonymise it. We will also delete your data sooner if you exercise your right to erasure and that right applies (see section 9).

Your Rights Under UK Data Protection Law

You have the following rights. Some apply only in certain circumstances.

• Access: ask for a copy of the personal data we hold about you.
• Rectification: ask us to correct data that is wrong or incomplete.
• Erasure: ask us to delete your data, where we no longer need it or have no other lawful reason to keep it.
• Restriction: ask us to pause using your data, for example while you contest its accuracy.
• Portability: receive data you gave us in a structured, machine-readable format, where we use it under a contract or your consent.
• Objection: object to our use of your data based on legitimate interests. If you object to marketing, we will stop.
• Automated decisions: we do not make decisions about you that have legal or similarly significant effects using automated processing alone (see 4.1).
• Withdraw consent: where we rely on your consent, withdraw it at any time.

To use any of these rights, email support@hospo.ltd. We may need to confirm your identity first. There is no fee, and we will reply within one month.

Complaints

If you are unhappy with how we have handled your personal data, please contact us first at support@hospo.ltd so we can put it right.

You can also complain to the Information Commissioner's Office (ICO), the UK's data protection regulator:

• Website: ico.org.uk
• Helpline: 0303 123 1113

Security

We protect personal data with access controls, encrypted connections, and private storage. Bank details and right to work documents can only be reached by the parts of our system that need them. No system is completely secure, but if a breach is likely to put your rights at risk, we will tell you and the ICO as the law requires.

Under-18s

The Service is only for people aged 18 or over. We do not knowingly collect personal data from anyone under 18, and if we find we have, we will delete it.

Links to Other Websites

Our website links to other websites, such as Stripe's payment pages. They have their own privacy policies, and we are not responsible for how they handle your data.

Changes to This Privacy Policy

We will update this policy when our practices or the law change, and change the version and date at the top. If a change materially affects how we use your data, we will tell you by WhatsApp or email.

Contact Us

For any question about this policy or your personal data, email support@hospo.ltd.

Our Processors

These companies handle personal data on our behalf.