GDPR

Autumn Rooms Technologies is the data controller for the personal information you give us when you enquire about, book, or occupy accommodation with us. We operate through separate registered entities in each country we work in; the addresses are listed in the footer of every page on this site.

If you are in the European Economic Area, our Irish entity is your point of contact. If you are in the United Kingdom, our UK entity is.

The GDPR requires a lawful basis for every use of your personal information. Ours are:

• Performance of a contract — to take a booking, hold a bedspace, issue a licence or tenancy agreement, collect payment and manage your stay. Without this information we cannot house you.
• Legal obligation — to run right-to-rent and identity checks where the law of the destination country requires them, and to keep financial records for the period tax law requires.
• Legitimate interests — to keep the service secure, prevent fraud, and improve how the product works — balanced against your interests, and never in a way you would not reasonably expect.
• Consent — for marketing you have opted into. You can withdraw it at any time without affecting anything else, and withdrawing it will never affect a booking you already hold.

Under the GDPR you have the right to access your data, correct it, have it erased, restrict or object to how it is used, and receive it in a portable form. Those rights, and how they apply, are set out in full in our privacy policy.

To exercise any of them, write to the support address for your country, listed in the footer. We will respond within one month, as the regulation requires. We may ask you to confirm your identity first — that check protects your data from someone else asking for it.

Some data we cannot delete on request: where we are required to keep it by law, or where it is needed to establish or defend a legal claim, we will tell you which exemption applies rather than simply refusing.

We operate in several countries, and your information may be handled in a country other than the one you live in — including the United Kingdom, Ireland, Canada, Australia, the United Arab Emirates and India.

Where data leaves the EEA or the UK to a country without an adequacy decision, the transfer is made under the appropriate safeguards the regulation provides. Details are available on request.

We keep your information for as long as you are a licensee or tenant, and afterwards only for as long as we have a reason to — an unresolved deposit, an obligation under tax or housing law, or a legal claim. When none of those apply, it is deleted.

Please raise it with us first — most concerns are quicker to fix directly. If you are still not satisfied, you have the right to complain to a data protection supervisory authority.

• In Ireland and the wider EEA — the Data Protection Commission (dataprotection.ie).
• In the United Kingdom — the Information Commissioner's Office (ico.org.uk).

Complaining to a regulator does not affect any other right you have.