Privacy Policy

Who controls your information

Stay Near Universal UK is an independent accommodation directory operated by Stay Near Universal. Stay Near Universal is the data controller for the personal information described in this policy. For privacy questions or to exercise your rights, contact us through staynearuniversal.uk/contact.

Accommodation providers are separate controllers for enquiries and booking-related information they receive through a listing. Their own privacy information applies to what they do after receiving it.

What we collect and where it comes from

• Account information: name, email address, company or trading name, account type, password hash, verification and login records, and account preferences.
• Listing information: property and contact details, descriptions, photographs, amenities, addresses, coordinates, availability information and provider details. Information selected for publication is visible to anyone.
• Enquiries and support: names, email addresses, phone numbers, stay requirements, message content, support correspondence and related moderation or delivery records.
• Payments and subscriptions: order, package, coupon, invoice, refund and subscription references, billing contact information, transaction status and limited payment metadata. We do not store full payment-card details.
• Newsletter information: email address, consent time, signup source, IP address, browser information, subscription status and unsubscribe record.
• Listing alert information: email address, selected property type and distance, consent time, signup source, subscription status and unsubscribe record.
• Browser-only property choices: saved, recently viewed and comparison properties are kept in local storage on your device. Shareable shortlist links contain public listing details but no account information.
• Technical, security and usage information: IP address or a derived hash, session or visitor identifier, request path, search terms and filters, referrer, browser, device and operating system, approximate country, region or city, cookie choice, timestamps, page activity and security events.

We receive information directly from you, automatically from your browser or device, from a signed-in account, and from providers involved in the service such as Stripe, Cloudflare and Google Analytics. A listing owner may also supply information about authorised staff or a property they manage.

Why we use it and our legal bases

Where we rely on legitimate interests, those interests are service delivery and improvement, security, fraud prevention, administration, customer support, and the protection of our users and legal rights. We balance those interests against the effect on you and limit the information used.

Analytics and cookies

Our first-party server analytics may record page paths, searches and filters, listing views, referrers, browser and device type, approximate location supplied by our network provider, timestamps, signed-in user ID, and shortened, hashed or full IP information depending on your account and cookie choice. Before optional analytics consent, guest activity is measured using a short-lived rotating hash rather than a persistent analytics identifier, and detailed guest fields are limited. This information is used for aggregate statistics, service improvement, fraud prevention and operational monitoring.

If Google Analytics is configured, its script loads only after you accept analytics. We configure it with advertising signals and ad personalisation disabled and request IP anonymisation. Google may still receive online identifiers, IP and device information, and information about pages and interactions. You can reject or later withdraw consent without losing access to the site.

Strictly necessary cookies and storage support sessions, security, forms, your privacy choice, and browser-only saved, recent and comparison property features that you choose to use. Cloudflare Turnstile may process device, network and interaction information to detect automated abuse. See our Cookie Policy to review or change your choice.

Payments

Stripe may process card details, billing information, transaction identifiers, device and fraud-prevention information for payments, invoices, refunds and subscription management. Full card details are entered into Stripe's systems rather than stored by us. Stripe acts as a processor or independent controller depending on the activity described in its own privacy information.

Who receives information

• the accommodation provider you choose to contact;
• hosting, database, backup, email delivery and technical-support providers;
• Stripe for payment and subscription services;
• Cloudflare for network security and Turnstile checks;
• Google for consented Google Analytics, and Mapbox where map or geocoding features are used;
• professional advisers, insurers, auditors, regulators, courts, law enforcement or public authorities where reasonably necessary or legally required; and
• a buyer, investor or successor if the service or business is reorganised, sold or transferred, subject to appropriate confidentiality protections.

We do not sell your personal information. Public listing information is intentionally published and may be indexed by search engines or shared by visitors.

International transfers

Some providers may process information outside the UK or European Economic Area. Where data protection law requires safeguards, we use a relevant adequacy decision or contractual measures such as the UK International Data Transfer Agreement or UK Addendum and, where EU GDPR applies, the European Commission's Standard Contractual Clauses. You may contact us for information about the safeguard relevant to your data.

How long we keep information

• Analytics events: up to 365 days under the site's current retention setting. Google Analytics data follows the retention configured with Google.
• Accounts and listings: while active and afterwards for as long as needed to handle restoration, moderation, disputes, fraud prevention or legal claims.
• Orders, invoices and payment records: generally six years after the relevant financial period or transaction where needed for UK tax, accounting and legal records.
• Enquiries, support and security records: for as long as needed to deliver the service, protect users, enforce rules and resolve disputes; blocked or quarantined material may be retained for a limited fraud-prevention period.
• Newsletter records: while subscribed. After unsubscribing, we may keep the minimum information needed to prove consent and honour the opt-out.
• Cookie choices: the browser choice normally lasts up to 180 days; a consent record may be retained longer where reasonably needed to demonstrate compliance.

We may keep information longer where law requires it, a dispute or investigation is active, or a legal claim could arise. We securely delete or anonymise information when it is no longer required.

Your data protection rights

Subject to the conditions in applicable UK or EU data protection law, you may ask us to give you access to your personal information, correct it, erase it, restrict its use, or provide it in a portable format. You may withdraw consent at any time without affecting processing that was lawful before withdrawal. You are not normally required to pay a fee, and we normally respond within one month after verifying the request. Some rights do not apply in every circumstance, including where records must be kept by law.

To exercise a right, use our contact page. You may complain to the UK Information Commissioner's Office. If EU GDPR applies to you, you may also complain to the data protection authority where you live, work, or believe an infringement occurred.

Your right to object

You may object at any time to our use of your personal information based on legitimate interests. We will stop unless we demonstrate compelling legitimate grounds or need the information for legal claims. Your right to object to direct marketing is absolute: if you object or unsubscribe, we will stop using your information for that marketing.

Automated decisions and children

We do not make solely automated decisions that produce legal or similarly significant effects for users. Automated security or moderation signals may flag activity for restriction or human review. The service is not directed at children, and provider accounts and paid services are intended for people aged 18 or over.

Future advertising and Google AdSense

We do not currently serve Google AdSense advertising. We may introduce advertising in the future, but this policy is not consent to advertising cookies or personalised advertising. Before enabling AdSense, we will update this policy and the Cookie Policy, identify the advertising partners and purposes in use, and provide the required controls.

If AdSense is enabled, Google and other approved advertising vendors may use cookies, web beacons, IP addresses and other identifiers to deliver, limit, measure and personalise ads, subject to your choices and applicable law. For users in the UK, EEA and Switzerland, we will use a Google-certified consent management platform where required and will not request personalised ads unless the necessary consent has been given. Google's use of information from partner sites is explained in Google's partner-sites privacy information.

Changes to this policy

We may update this policy when the website, providers, legal requirements or our use of information changes. We will post the revised policy here, change the date above and provide a more prominent notice where a change materially affects your rights or choices.