Legal
Privacy Notice
1. Who we are and how to contact us
MSK GUESTBOOK LIMITED, trading as MSK Guestbook, company number 17262129, registered office 66-68 Inverness Terrace, London, England, W2 3LB. Email info@mskguestbook.com. These labels are optional: you do not need an account or a particular form to exercise your rights.
2. What this notice covers
MSK is controller where it decides why and how visitors', account holders' and business contacts' information is used. This notice covers those activities: our public website, our operator platform, business accounts and related communications. It does not cover processing carried out by accommodation providers (property operators) who use our platform — those providers are controllers for their own guest and booking records. Where MSK handles guest and operational data on a provider's instructions, MSK acts as a processor and the provider's privacy notice governs that processing. Our Data Processing Agreement describes MSK's processor obligations.
3. Information and sources
Enquiries and demonstrations. When you contact us or request a demonstration, you may provide your name, business contact details, organisation, role and enquiry content.
Business accounts. Account users provide their name, work email address, role and, for billing contacts, subscription and payment references.
Website and application usage. When you use our website or application, we receive technical data such as IP address, device and browser information, authentication events and error logs. Optional analytics technologies follow your choices described in our Cookie Notice.
Invitations. An authorised administrator may invite you to an account and provide your work contact details and access role.
Connected systems. Where enabled by a property, its connected property management system and other approved integrations may provide reservation references, stay dates and guest contact details.
Support conversations. Support conversations contain what you send us. Please avoid including identity documents, card details or unrelated guest information in a general support request.
4. Why MSK uses information and our lawful bases
| Purpose | Information | Lawful basis |
|---|---|---|
| Reply to enquiries and arrange demonstrations | Contact details and enquiry content | Pre-contract steps when requested; or legitimate interest in responding to business enquiries |
| Create and administer business accounts | Account, role and organisation details | Contract where you are the contracting party; legitimate interest in administering the service for employee or representative contacts |
| Administer subscription billing | Billing contact, order and transaction references | Contract; applicable record-keeping obligations |
| Protect accounts and investigate technical problems | Authentication, security and diagnostic data | Legitimate interest in maintaining security; legal obligations where applicable |
| Send optional MSK news and offers | Contact details and preferences | Consent |
| Understand and improve the website | Analytics data where consent is given | Consent |
| Provide the guest and operator platform | Account, property and operational data | Contract with the operator; processor instructions for guest data |
When we rely on a legitimate interest, it is the specific interest described above and we assess it against your interests and rights. You can ask us about that assessment. We do not treat the fact that you use the service as agreement to unrelated marketing.
5. Required information and your choices
Where we ask for information, we identify what is required and what is optional. Providing optional information is your choice; not providing it may limit some features. You can withdraw consent at any time (including for marketing) without affecting earlier lawful processing. Use the unsubscribe link in any marketing email or contact info@mskguestbook.com. We keep the minimum suppression information needed to respect your choice. Essential account, security and service messages may still be sent because they are needed to operate the service.
6. Identity, location, sensitive information and automated decisions
Identity documents.Where a property operator enables digital check-in features requiring identity verification, the platform handles identity document images on that operator's instructions. Retention defaults are set out in section 9.
Location. Location features are optional and explained when you are invited to use them. Location data is not collected passively without your awareness.
Sensitive information. Special category data should not be submitted to the platform without prior written agreement with MSK. Where MSK processes sensitive data as a controller, we identify the additional lawful basis and apply enhanced safeguards.
Automated decisions. MSK does not make decisions about you that produce legal or similarly significant effects based solely on automated processing.
7. Who receives information
Access is limited to people and organisations that need information for the stated purpose. Depending on the functions you use, these include:
- Our hosting and infrastructure providers
- Authentication and security services
- Communication platforms used to deliver notifications and messages
- Support and operational tools
- Payment reference processors (MSK does not hold full card data)
- Authorised personnel with a need-to-know
- Legal and professional advisers where required
- Regulatory or law enforcement bodies where legally required
We do not sell personal information. Our Subprocessors page describes the categories of service provider we use. Operators may request the applicable verified register.
8. International processing
Where information is transferred outside the UK or EEA, MSK uses applicable adequacy arrangements or specified transfer instruments to protect it. Contact info@mskguestbook.com to request information about applicable safeguards for a particular transfer.
9. Retention and deletion
We apply different retention rules to different records. The defaults below apply unless a legal obligation, documented dispute, or operator instruction requires different treatment.
| Record | Standard period and starting point |
|---|---|
| Enquiries and waitlists | 24 months after last meaningful contact |
| Support case content | 24 months after resolution |
| Security/diagnostic logs | 90 days after the event |
| Access audit records | 12 months after the event |
| MSK account profile | Account lifetime and up to two years after closure |
| Minimal contract/dispute evidence | Six years after the relationship ends |
| Finance/tax records | Six years after the relevant financial year ends |
| Marketing contacts | Until withdrawal or 24 months without meaningful engagement |
| Marketing suppression | Only the minimum details needed for as long as necessary |
| Operator guest/stay records | Default: 12 months after checkout |
| Identity-document images | Default: 30 days after checkout |
| Minimal verification status | Default: 12 months after checkout |
| Optional raw analytics | Maximum 13 months after collection |
After termination of a platform subscription, we provide a 30-day data export window and complete active deletion within 60 days, with backup expiry within 90 days, in accordance with our Data Processing Agreement.
10. Security
MSK implements and maintains technical and organisational measures appropriate to the risk, including encryption in transit and at rest, role-based access controls, access reviews, monitoring, incident response procedures and staff training. These measures are described further in Schedule 2 of our Data Processing Agreement. Report a suspected security issue to info@mskguestbook.com with "Security incident" in the subject line.
11. Your rights
Depending on the law and the processing, you may:
- Request access to your personal information (subject access request)
- Request correction of inaccurate information
- Request deletion of your information where we have no lawful reason to keep it
- Request restriction of processing while a dispute is resolved
- Request a portable copy of information you provided to us
- Object to processing based on legitimate interests or to direct marketing
- Withdraw consent at any time without affecting earlier lawful processing
Contact us at info@mskguestbook.com or see our Privacy Requests page. No particular wording or form is required. We normally respond within one calendar month.
12. Complaints
We acknowledge a data protection complaint within 30 days of receipt, investigate appropriately and provide our outcome without undue delay. You may also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint. You do not have to complete our internal process before contacting the ICO.
13. Children and changes
Children. Our platform and website are not directed at children. We do not knowingly collect personal information from anyone under 18 years of age without appropriate authorisation.
Changes. We update this notice when our practices change. The version and publication date appear at the top of this page. Where a change materially affects how we use your information, we will bring it to your attention through an appropriate channel. Prior versions are available on request by emailing info@mskguestbook.com.
Privacy questions or requests
Contact us at any time. You do not need to use a specific form.