Privacy Policy

Last updated: April 2026 · Version 2.1

1. What We Collect

We collect the minimum data necessary to process your lost item claim: your item description, delivery address, email address (optional), and IP address and user-agent string at time of submission for audit and fraud-prevention purposes. We do not collect payment card details — these are handled exclusively by Stripe.

2. Lawful Basis & Consent

By submitting a claim, you provide explicit consent for the collection and processing of your personal data for the purpose of recovering your lost item. You may withdraw consent at any time by contacting the hotel reception desk, however doing so may prevent completion of your claim. Where consent is withdrawn, all identifiable data will be anonymised within 30 days.

3. How We Use Your Data

Your data is used exclusively to: (a) verify ownership of the claimed item, (b) facilitate return or shipment, (c) process payment via Stripe, and (d) maintain a secure audit trail for legal and compliance purposes. It is never used for marketing, sold to advertisers, or shared with data brokers.

4. Data Sharing

Your delivery address and contact details are shared only with the chosen shipping carrier (DHL, FedEx, UPS, or similar) to facilitate delivery. Hotel staff at the operating property can access your claim details for fulfilment purposes. No data is shared with third parties beyond these operational necessities.

5. Data Retention

Claim records are retained for 24 months from the date of submission for legal and compliance purposes, in line with standard hospitality industry requirements. After this period, all personally identifiable information is permanently anonymised. Item photographs are stored in an access-controlled environment and are deleted alongside the claim record.

6. Your Rights

You have the right to: access a copy of your data, request correction of inaccurate data, request deletion (subject to legal retention obligations), and object to or restrict processing. To exercise these rights, contact the hotel reception desk and provide your dispute reference number (format: DISP-XXXXXXXX). We will respond within 30 days.

7. Security

Item photographs are never exposed to your browser — they are served through a server-side proxy and displayed in blurred form prior to ownership verification. Your claimed description is stored encrypted at rest. All data in transit is protected by TLS 1.2 or higher. Access to claim data is restricted to authorised hotel staff on a need-to-know basis.

8. Contact

For privacy-related enquiries, contact the hotel reception desk directly and reference your dispute reference number (format: DISP-XXXXXXXX). For platform-level data requests, contact TrackIR via the email address listed in your claim confirmation.