Privacy and Cookie Notice

Last Updated 01/11/2026

1. Who we are

Dragon Serviced Rentals Ltd trading as StayServiced (“StayServiced”, “we”, “us” or “our”) provides serviced accommodation and property management services in the United Kingdom.

This notice explains how we handle personal information about website visitors, guests, prospective guests, property owners and business contacts.

Company number: 11894869
Registered office: 188 Carlisle St, Cardiff, CF24 2PH
Privacy contact: privacy@m.stayserviced.com
Website: stayserviced.com

We are the data controller and decide why and how we use personal information. Where we process information solely on a property owner’s instructions, the owner is the controller and their privacy information also applies.

We handle information in accordance with applicable UK data protection law, including the UK GDPR, the Data Protection Act 2018, as amended, and the Privacy and Electronic Communications Regulations.

2. Information we collect

Depending on your relationship with us, we collect:

Names, addresses, email addresses and telephone numbers.
Booking details, guest names, stay dates, requests and check-in information.
Identification documents and verification outcomes.
Property details, management instructions and agreements.
Billing details, payment references, invoices, deposits, refunds and transaction records.
Messages, telephone recordings, feedback and complaints.
CCTV video and audio, access information and noise-monitoring records, as described below.
IP addresses, browser and device information, website activity and cookie identifiers.

We receive information directly from you and from booking platforms, property owners, service providers and people arranging accommodation on your behalf, such as employers, agents or lead guests. Information is also collected through our website and disclosed property systems.

If you provide information about someone else, please ensure you are authorised to do so and share this notice with them.

If you provide health or disability information for an accommodation request, we use only what is necessary to address that request. Where we rely on explicit consent to process this information, we obtain it separately.

3. How and why we use information

Purpose Lawful basis

Responding to enquiries and arranging services you request.
Taking steps before entering a contract, or legitimate interests in responding where you act for another person

Managing bookings, stays, payments and property management services.
Performance of our contract with you, or legitimate interests in delivering services where another person is the contracting party

Checking identity and preventing fraud.
Legitimate interests in protecting guests, property owners and our business

Providing secure property access.
Contractual necessity where applicable, or legitimate interests in managing authorised access

Recording calls, handling complaints and resolving disputes.
Legitimate interests in maintaining accurate records and protecting legal rights

Property security and addressing excessive noise.
Legitimate interests in protecting people and property and respecting neighbours’ quiet enjoyment, subject to necessity and proportionality

Accounting, taxation and other applicable legal requirements.
Legal obligation

Website security and operation.
Legitimate interests in maintaining secure, effective services

Optional website analytics.
Consent where required

Email marketing.
Consent, or legitimate interests where marketing is otherwise permitted by law

Where we rely on legitimate interests, we assess the need for the processing against its effect on your rights and reasonable expectations. You may contact us for further information or object to that processing.

Where information is necessary to provide a service or comply with a legal requirement, we explain this when requesting it.

Without necessary information, we may be unable to accept a booking or fulfil your request.

We do not make decisions producing legal or similarly significant effects based solely on automated processing.

4. Guest checks and telephone recordings

Identity checks: We use Enso Connect to facilitate guest identification checks and hold identification documents submitted during check-in. Our process does not use selfies or facial recognition. We limit access to identification information to authorised people and providers who need it.

Telephone recordings: Calls to and from StayServiced are recorded through Air Landline to maintain an accurate record of enquiries, instructions and service issues and help resolve complaints or disputes.

Air Landline normally deletes recordings automatically after 30 days. Where a recording is downloaded for a specific issue, we retain it only while necessary for that purpose and any applicable legal requirements. You may communicate with us in writing instead.

5. CCTV, smart locks and noise monitoring

CCTV

Most properties have motion-activated CCTV covering designated shared areas outside private apartments, such as entrance lobbies and common internal corridors.

When activated by movement, cameras record both video and audio, which may capture conversations within microphone range. The monitored areas and presence of recording are disclosed in the relevant property information before booking.

CCTV is used for property security and investigating incidents. Access to recordings is restricted, and relevant information may be shared where necessary with insurers, professional advisers or authorities.

No CCTV cameras or devices record conversations inside your private apartment.

Where another organisation controls a building’s CCTV, its privacy information applies. Contact us for details of the responsible operator.

SMART LOCKS

At properties using Nuki smart locks, we provide the guest’s name and stay dates to arrange a time-limited access PIN. We may use relevant access records to assist guests, manage authorised access, and investigate security incidents.

NOISE MONITORING

Some properties use Minut noise monitoring devices to measure decibel sound levels and generate excessive-noise alerts. These devices do not record conversations or store audio recordings.

We provide Minut with the guest’s name and stay dates. Measurements and alerts linked to an identifiable stay are treated as personal information.

The relevant property information identifies noise monitoring where installed.

6. Sharing information and overseas processing

We share information only where necessary for a lawful purpose.

Our providers include:

Wix and IONOS: website, domain and communications services, as applicable.
Hostaway: booking and property management.
Enso Connect: guest check-in and identification checks.
Stripe: payment processing.
Air Landline: telephone services and call recordings.
Nuki: smart-lock access management.
Minut: noise monitoring.
Google Analytics: website analytics.

We also share necessary information with property owners, booking platforms, cleaning and maintenance providers, professional advisers, insurers and authorities where lawful and necessary.

Providers acting on our instructions are subject to appropriate contractual protections. Some organisations, including payment providers and booking platforms, act as independent controllers for particular activities and have their own privacy notices.

Although our accommodation services operate in the UK, providers may process information outside the UK, including in Europe and the United States.

Where a restricted international transfer occurs, we use an applicable UK adequacy arrangement or appropriate safeguards, such as the UK International Data Transfer Agreement or UK Addendum, with assessments and additional measures where required.

7. How long we keep information

We retain personal information only for as long as necessary for its purpose, taking account of legal requirements, the sensitivity of the information and any unresolved matters.

Our retention criteria are:

Booking and property management records: for the relationship and the period reasonably needed afterwards to address payments, complaints and legal claims, taking account of applicable limitation periods.
Accounting and tax records: normally six years from the end of the relevant company financial year, or longer where legally required.
Identification documents: while necessary to complete and evidence the identity check and address a specific fraud concern or dispute. We assess full document copies separately from basic verification outcomes and accounting records.
Telephone recordings: normally 30 days within Air Landline. Downloaded recordings are retained only where needed for a specific purpose.
CCTV recordings: for the shortest period reasonably needed to identify and investigate incidents. Relevant extracts may be preserved for an active investigation, insurance matter or legal claim.
Smart-lock and noise-monitoring records: while necessary to provide access, manage the stay and investigate relevant incidents.
Enquiries and correspondence: while needed to respond, provide a service or address a related issue.
Health or accessibility information: while necessary to fulfil the request or address a related unresolved matter.
Marketing records: while there is a valid basis for marketing and continued retention remains justified. Limited suppression records are kept where needed to respect opt-outs.
Website analytics: according to the applicable service settings and the period necessary for website measurement and improvement.

Independent controllers, such as Stripe, may retain information separately to meet their own legal obligations.

We review continued retention and securely delete or irreversibly anonymise information when it is no longer required. We may keep relevant information longer to meet a specific legal obligation or address an unresolved claim.

8. Cookies and website analytics

Our Wix website uses cookies and similar technologies to support security and website functionality. We also use Google Analytics to understand website use and improve our services.

Where consent is required, optional technologies must not be used unless you consent. Accepting this privacy notice or continuing to browse does not constitute consent.

Cookie choices can be managed through the website’s cookie-consent controls where provided. Browser settings also allow cookies to be blocked or deleted, although blocking essential cookies may affect functionality. Deleting cookies does not automatically erase information previously collected.

Details of the technologies used, their providers, purposes and durations are provided through our cookie information and settings. For further information, contact privacy@m.stayserviced.com.

Separately operated booking platforms and other linked websites have their own privacy and cookie information.

9. Email marketing

We may send emails about StayServiced accommodation, offers and property management services where you have consented or where the law otherwise permits.

For individuals, we use the existing-customer “soft opt-in” only where we obtained your email address directly during a sale or negotiations for a sale, the emails concern our own similar services, and you were offered an opt-out both when your details were collected and in every subsequent marketing email.

You can unsubscribe at any time using the link in a marketing email or by contacting privacy@m.stayserviced.com.

Opting out does not stop necessary booking, payment or service communications.

10. Security and your rights

We use appropriate technical and organisational measures to protect personal information and restrict access to authorised people and providers.

Subject to applicable conditions and exemptions, you may:

Request access to your personal information.
Ask us to correct inaccurate or incomplete information.
Request erasure or restriction of processing.
Object to processing based on legitimate interests.
Request portability of certain information.
Withdraw consent where processing relies on it.

You have an absolute right to object to direct marketing, including related profiling.

Contact privacy@m.stayserviced.com to exercise your rights. We may request proportionate information to verify your identity or clarify your request.

Requests are normally free, and we normally respond within one month, subject to lawful extensions or adjustments. We explain any applicable restriction, refusal or extension.

11. Complaints and changes

If you have a privacy concern, email privacy@m.stayserviced.com or write to our registered office.

We acknowledge data protection complaints within 30 days, investigate without undue delay and explain the outcome.

You may also complain to the Information Commissioner’s Office:

ico.org.uk/make-a-complaint

We update this notice when our practices or legal requirements change. The date above identifies the latest version. We provide additional information or obtain fresh consent where required.