PRIVACY POLICY

Excelling in Hospitality Ltd

Company No. 15184315

Registered Address: 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ

This Privacy Policy explains how Excelling in Hospitality Ltd ("we", "us", "our") collects, uses, stores and protects personal data in connection with Your Next Level Up programmes, coaching, mentoring, courses, memberships and related services.

This policy is written to meet UK GDPR and Data Protection Act 2018 requirements and reflects best practice used by leading digital education and coaching businesses.

1. WHO WE ARE

We are the data Controller for the purposes of UK data protection law.

If you have any questions about this policy or your data, you can contact us at:

Email: [email protected]

2. PERSONAL DATA WE COLLECT

We may collect and process the following categories of personal data:

• Identity Data: name, business name, job title

• Contact Data: email address, phone number, billing address

• Account & Transaction Data: purchase history, programme enrolment, payment status (note: we do not store full card details)

• Communication Data: emails, messages, WhatsApp communications, voice notes and form submissions

• Technical Data: IP address, device information, browser type, login activity

• Programme Data: onboarding responses, progress notes, feedback and participation records

We only collect data that is necessary, relevant and proportionate for the purposes outlined below.

3. HOW WE COLLECT YOUR DATA

Your personal data may be collected when you:

• Purchase a programme, course, membership or service

• Complete an onboarding or application form

• Communicate with us by email, messaging platforms or social media

• Access our platforms, portals or digital content

• Participate in live or recorded sessions

4. LAWFUL BASIS FOR PROCESSING

Under UK GDPR, we rely on the following lawful bases:

• Performance of a contract – where data is required to deliver services you have purchased

• Legitimate interests – to operate, manage and improve our business, programmes and communications

• Legal obligations – where required for accounting, tax or regulatory purposes

• Consent – where you have explicitly opted in (e.g. marketing communications)

5. HOW WE USE YOUR DATA

We use personal data to:

• Deliver and manage programmes, coaching and services

• Communicate with you about your participation

• Provide support, guidance and programme updates

• Process payments and maintain financial records

• Improve our services, content and user experience

• Maintain platform security and prevent misuse

• Meet legal and regulatory obligations

We do not sell or trade personal data.

6. MARKETING COMMUNICATIONS

You may receive marketing emails where:

• You have opted in; or

• You are an existing customer and the communication relates to similar services

You may unsubscribe at any time using the link in our emails or by contacting us directly.

7. SHARING YOUR DATA

We may share your data only where necessary, including with:

• Payment processors (e.g. Stripe, PayPal)

• Platform providers (e.g. GoHighLevel, email and course platforms)
• Professional advisors (e.g. accountants, legal advisors)

• Contractors or virtual assistants who are bound by confidentiality and data protection obligations

All third parties are required to process data securely and in line with UK GDPR.

8. INTERNATIONAL DATA TRANSFERS

Some service providers or contractors may be located outside the UK.

Where personal data is transferred internationally, we ensure appropriate safeguards are in place, including:

• UK-approved Standard Contractual Clauses (SCCs); or

• Other lawful transfer mechanisms recognised by the UK Information Commissioner’s Office (ICO)

9. DATA SECURITY

We take appropriate technical and organisational measures to protect personal data, including:

• Secure platforms and password protection

• Limited access on a need-to-know basis
• Confidentiality obligations for contractors

• Prompt action in the event of a suspected data breach

10. DATA RETENTION

We retain personal data only for as long as necessary to:

• Deliver services

• Comply with legal, accounting or reporting requirements
• Resolve disputes

When data is no longer required, it is securely deleted or anonymised.

11. YOUR DATA PROTECTION RIGHTS

Under UK GDPR, you have the right to:

• Access your personal data

• Request correction of inaccurate data
• Request erasure of data (where applicable)

• Object to or restrict processing
• Request data portability

• Withdraw consent at any time (where consent applies)

Requests can be made by contacting us at [email protected].

12. COOKIES & TRACKING

Our website and platforms may use cookies or similar technologies to improve functionality and user experience.

You can control cookie preferences through your browser settings.

13. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time.

The latest version will always be available on our website, and material changes will be communicated where appropriate.