PACK2GO PRIVACY POLICY
Last updated: [insert date]
This Privacy Policy explains how Pack2Go Travel Ltd collects, uses, shares and protects personal information when you visit our website, create an account, list accommodation, request or make an offer, complete a booking, contact us or otherwise use Pack2Go.
It also explains your privacy rights and how to exercise them.
- Who we are
Pack2Go is operated by:
Pack2Go Travel Ltd Company number: 09914325 Registered office: 9 Mortimer Road, Cardiff, CF11 9JZ
Pack2Go Travel Ltd is the controller of the personal information described in this Privacy Policy, except where another organisation is identified as independently responsible for its own processing.
In this Privacy Policy, “Pack2Go”, “we”, “us” and “our” mean Pack2Go Travel Ltd.
You can contact us about privacy matters at:
Email: hello@pack2go.co.uk Post: Pack2Go Travel Ltd, 9 Mortimer Road, Cardiff, CF11 9JZ
- Who this policy applies to
This Privacy Policy applies to:
people browsing the Pack2Go website; Travellers searching for or booking accommodation; people submitting accommodation requests; Hosts and property managers; people communicating through Pack2Go; newsletter subscribers; people contacting our support team; and representatives of companies or agencies using the Service.
The Service is intended for adults aged 18 or over.
- Personal information we collect
The information we collect depends on how you use Pack2Go.
3.1 Account and profile information
When you register or maintain an Account, we may collect:
your name; email address; telephone number; postal address; profile photograph; login credentials; account type; communication preferences; business or organisation name; your role within an organisation; and Account settings.
We do not receive your password in readable form where it is securely handled by our platform provider.
3.2 Host and property information
If you register or act as a Host, we may collect:
property-owner or manager details; company and trading information; property address and location; Listing descriptions; photographs and videos; accommodation facilities and accessibility information; availability; pricing and cancellation settings; house rules; licences, registrations or insurance details where requested; VAT or tax information; bank-account and payout details; identification and verification information; Booking and payout history; and communications with Travellers and Pack2Go.
Some information about a Host or property may be displayed publicly as part of a Listing. We will not ordinarily display private banking, identity-document or complete residential-address information publicly.
3.3 Traveller and booking information
When you search, request or book a Stay, we may collect:
your name and contact details; destination and property preferences; arrival and departure dates; number of adults, children and infants; children’s ages where relevant to suitability or pricing; accessibility or accommodation requirements you choose to provide; booking and cancellation history; offer and counteroffer information; payment status; billing details; messages exchanged with Hosts; reviews; support enquiries; and information about complaints, refunds, disputes or chargebacks.
Please avoid including unnecessary sensitive personal information in messages or accommodation requests.
3.4 Payment, membership and payout information
When a Traveller pays for a Booking, or a Host purchases a Membership or receives a payout, we may collect:
payment or payout status; transaction reference; amount and currency; payment date; partial payment-card information, such as card type and last four digits; billing name and address; refund and chargeback information; Host Membership plan and renewal date; bank-account or payout information; and identity and verification status.
Payment-card details are provided directly to Stripe or another payment provider. Pack2Go does not ordinarily receive or store complete card numbers or card-security codes.
3.5 Identity and verification information
Pack2Go or Stripe may collect or request information to verify identity or prevent fraud, including:
full legal name; date of birth; residential address; proof of identity; proof of address; company registration details; beneficial-owner or director information; tax information; photograph or identity-document image; and the result or status of verification checks.
Stripe may collect some of this information directly and process it under its own privacy documentation.
3.6 Communications
We may collect information when you:
send or receive messages through Pack2Go; contact us by email, telephone or contact form; respond to a survey; submit a complaint; ask for support; or interact with our social-media accounts.
This may include the content of your communication, related attachments and records of our response.
Messages sent through the platform may be stored and reviewed where reasonably necessary to provide support, investigate complaints, prevent fraud, enforce our Terms or protect Users.
3.7 Reviews and public Content
If you publish a review, profile, Listing or other public Content, we collect and display the information you choose to provide.
Public Content may be visible to other users and may appear in search engines or Pack2Go marketing.
Do not publish personal information that you do not want to be publicly accessible.
3.8 Technical and Usage Data
When you use the website, we may automatically collect:
internet protocol address; browser and device type; operating system; approximate location derived from IP address; pages viewed; links and buttons used; dates and times of access; referring website; session information; cookie and similar-technology identifiers; diagnostic and error information; and information about how you interact with the Service. 3.9 Marketing information
We may collect:
whether you have subscribed to marketing; the type of marketing you wish to receive; your newsletter interaction history; whether an email was delivered, opened or clicked; advertising audience information; referral source; promotional-code use; and your opt-out or consent records. 3.10 Information about other people
A Traveller may provide information about members of their travelling party, such as names, ages or accessibility needs.
The person providing that information must have authority to do so and should make the other person aware of this Privacy Policy where appropriate.
Hosts and Travellers must not upload another person’s identity document or sensitive information unless genuinely necessary and lawful.
- How we obtain personal information
We collect personal information:
directly from you; from your activity on Pack2Go; from another User involved in a request, offer or Booking; from Stripe and other payment providers; from Sharetribe and other platform providers; from identity-verification and fraud-prevention providers; from analytics, advertising and cookie technologies; from publicly available business sources; from referral partners; from social-media platforms when you interact with us; and from professional advisers or authorities where appropriate. 5. How and why we use personal information
UK data protection law requires us to have a lawful basis for using personal information. The basis varies according to the purpose.
5.1 To provide and administer Pack2Go
We use personal information to:
create and manage Accounts; authenticate Users; provide marketplace features; publish and manage Listings; distribute Traveller requests to relevant Hosts; enable offers and counteroffers; facilitate messages; confirm Bookings; manage Host Memberships; provide customer support; send service notifications; and maintain Account records.
Our lawful bases are:
performance of a contract; taking steps at your request before entering a contract; and our legitimate interests in operating and improving the marketplace. 5.2 To facilitate Bookings
We use information to:
display relevant Listings; transmit enquiries and requests; enable Hosts and Travellers to communicate; form and record Booking Contracts; issue Booking Confirmations; provide arrival and contact information; support changes and cancellations; and maintain a record of the transaction.
Our lawful bases are:
performance of a contract; taking steps before entering a contract; and our legitimate interests in administering Pack2Go Bookings. 5.3 To process payments, fees and payouts
We use information to:
collect Traveller payments; collect Host Membership fees; calculate Pack2Go fees; arrange Host payouts; administer refunds; handle failed payments; deal with chargebacks; and maintain financial records.
Our lawful bases are:
performance of a contract; compliance with legal obligations; and our legitimate interests in receiving payment, preventing loss and managing financial transactions. 5.4 To verify Users and prevent fraud
We use information to:
verify identity and business details; detect suspicious activity; prevent unauthorised access; investigate fraudulent or off-platform activity; protect payments; enforce our Terms; protect Users; and maintain marketplace security.
Our lawful bases are:
our legitimate interests in preventing fraud, protecting Users and securing the Service; compliance with legal obligations; and performance of a contract where verification is required to provide the Service. 5.5 To provide support and manage disputes
We may use Booking records, communications, photographs and other evidence to:
answer questions; investigate complaints; facilitate communication; assess refund requests; respond to chargebacks; protect Users; enforce our Terms; and establish, exercise or defend legal claims.
Our lawful bases are:
performance of a contract; our legitimate interests in resolving complaints and protecting the marketplace; compliance with legal obligations; and the establishment, exercise or defence of legal claims. 5.6 To communicate with you
We use your contact details to send:
Account and security notifications; booking and payment confirmations; offer and message alerts; payout notifications; membership-renewal notices; cancellation and refund updates; policy or service changes; support responses; and other messages necessary to provide the Service.
These are service communications rather than marketing. You may not be able to opt out while maintaining an active Account or Booking.
Our lawful bases are:
performance of a contract; compliance with legal obligations; and our legitimate interests in operating the Service. 5.7 To personalise and improve the Service
We may analyse Usage Data, requests and marketplace activity to:
understand how Pack2Go is used; identify popular destinations and features; diagnose technical problems; improve design and usability; test new features; develop relevant Host and Traveller services; and measure business performance.
Our lawful basis is our legitimate interest in operating, understanding and improving Pack2Go.
Where non-essential cookies or similar technologies are involved, we will also seek consent where required.
5.8 To send marketing
Subject to applicable law and your preferences, we may send information about:
Pack2Go deals; new properties; destination inspiration; Host opportunities; platform features; referral offers; promotions; and relevant Pack2Go news.
We may rely on:
your consent; the electronic-marketing “soft opt-in”, where legally available; or legitimate interests for certain business-to-business communications.
You can unsubscribe at any time using the link in the email or by contacting us.
Marketing consent must be freely given, specific, informed and indicated by a positive action; pre-ticked boxes should not be used.
5.9 To advertise Pack2Go
Where you consent to advertising cookies or similar technologies, we may:
measure advertising performance; create advertising audiences; show Pack2Go adverts on other websites and social platforms; limit repeated adverts; and understand whether an advert led to a visit, registration or Booking.
Our lawful bases may include consent and, for limited internal analysis not requiring cookie consent, legitimate interests.
We will not state that we “sell” personal information unless Pack2Go actually carries out activity that legally constitutes a sale under an applicable law.
5.10 To comply with law and protect legal rights
We may use or disclose information to:
meet tax, accounting and company-law requirements; respond to courts, regulators or law-enforcement bodies; protect health and safety; enforce agreements; investigate wrongdoing; maintain legal records; and establish, exercise or defend legal claims.
Our lawful bases are:
compliance with legal obligations; legitimate interests; and where relevant, the establishment, exercise or defence of legal claims. 5.11 Business transfers
We may use and disclose information in connection with a possible or completed:
business sale; merger; investment; financing; reorganisation; acquisition; or transfer of assets.
Our lawful basis is our legitimate interest in managing and developing the business.
Any recipient would be required to protect personal information appropriately.
- Special-category information
Special-category information includes information concerning health, disability, racial or ethnic origin, religion, political opinions, sexual orientation and certain other sensitive matters.
Pack2Go does not generally require this information.
A Traveller may nevertheless choose to provide health, disability or accessibility information to help identify suitable Accommodation.
Where we process special-category information, we will do so only where:
you have given explicit consent; it is necessary to protect vital interests; it is necessary for legal claims; or another condition permitted by law applies.
Please provide only the minimum information necessary.
- Automated decisions and profiling
Pack2Go may use automated systems to:
match Traveller requests with potentially relevant Hosts; filter or rank Listings; detect suspicious activity; identify spam or fraud; personalise content; and measure marketing performance.
These processes do not ordinarily produce legal or similarly significant effects without meaningful human involvement.
If Pack2Go introduces automated decision-making that has a legal or similarly significant effect, we will provide the information and safeguards required by law.
- Who we share personal information with
We share information only where reasonably necessary for the purposes described in this Privacy Policy.
8.1 Hosts and Travellers
When a Traveller enquires, submits an offer or books, relevant information may be shared with the Host, including:
name; contact details; party size; dates; request or offer information; messages; booking details; and information reasonably necessary to provide the Stay.
After a Booking is confirmed, Hosts and Travellers may receive direct contact information needed to manage the Stay.
Hosts are independently responsible for how they use personal information for their own accommodation business and must comply with applicable data-protection law.
8.2 Sharetribe and marketplace technology providers
Pack2Go uses Sharetribe technology to operate marketplace functions.
Sharetribe and related hosting or technical providers may process:
Account information; Listings; messages; Booking information; technical data; and support or platform records.
The exact entities and processing arrangements should be confirmed against Pack2Go’s Sharetribe plan and configuration before publication.
8.3 Stripe and payment providers
We share relevant information with Stripe to:
process payments; verify Hosts; establish connected payment accounts; arrange payouts; prevent fraud; administer refunds; and handle payment disputes.
Stripe may act as our processor for some activities and as an independent controller for others, including certain legal, fraud-prevention and regulatory purposes.
8.4 Communications and email providers
We may share contact and communication information with providers that help us send:
service emails; newsletters; alerts; support messages; and transactional communications.
Insert only providers actually used, for example:
[Mailchimp / Constant Contact / other provider] [transactional email provider used through Sharetribe] 8.5 Analytics and performance providers
Subject to your cookie choices, we may use providers to understand website use and performance.
Insert only tools actually installed, for example:
[Google Analytics] [other analytics provider] 8.6 Advertising and social-media platforms
Where you consent, information may be shared with advertising providers such as:
[Meta] [Google Ads] [Pinterest] [other advertising platforms actually used]
This may include cookie identifiers, website events and audience information.
Pack2Go should not list platforms that are not actually installed or receiving data.
8.7 Identity, security and fraud providers
We may share information with providers assisting with:
identity checks; account security; fraud detection; abuse prevention; and payment-risk assessment. 8.8 Professional advisers
We may disclose information to:
solicitors; accountants; auditors; insurers; banks; and other professional advisers. 8.9 Authorities and legal recipients
We may disclose information where required or reasonably necessary to:
comply with law; respond to a court order; assist regulators or law enforcement; protect safety; investigate fraud; or establish or defend legal rights. 8.10 Business purchasers
Information may be disclosed to prospective or actual purchasers, investors or advisers involved in a business transaction, subject to suitable confidentiality and data-protection safeguards.
- When Hosts and Travellers act as separate controllers
When Pack2Go shares Booking information with a Host so that the Host can provide the Accommodation, the Host may process that information as an independent controller.
For example, a Host may need to use Traveller information to:
provide check-in instructions; maintain guest records; comply with local registration rules; manage the Accommodation; issue an invoice; or meet tax or legal requirements.
Pack2Go is not responsible for an independent Host’s privacy practices, although Hosts must comply with our Terms and applicable law.
Travellers may ask the Host how their information will be used.
Similarly, a business Traveller, agency or property manager may act as an independent controller for information it handles for its own purposes.
- International transfers
Some providers may store or access personal information outside the United Kingdom.
Where personal information is transferred to a separate organisation outside the UK and the transfer is restricted under UK GDPR, we will use a lawful transfer mechanism, such as:
UK adequacy regulations; the UK International Data Transfer Agreement; the UK Addendum to approved standard contractual clauses; another approved safeguard; or a permitted exception where appropriate.
We will also carry out any assessment required by law.
UK GDPR transfer rules can apply both when information is sent abroad and when it is made accessible to an organisation outside the UK. Restricted transfers must be covered by adequacy, appropriate safeguards or a valid exception.
You may contact us for further information about safeguards relating to a particular transfer.
- How long we keep personal information
We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, tax, fraud-prevention and dispute-resolution purposes.
Indicative retention periods are set out below.
11.1 Account information
We will normally retain Account information while the Account remains active.
After closure, basic Account and activity records may be retained for up to six years where needed for legal claims, fraud prevention or contractual records.
11.2 Booking and transaction records
Booking, payment, payout, refund, invoice and related financial records may ordinarily be retained for up to six years after the end of the relevant financial year or transaction, or longer where legally required.
11.3 Host Membership records
Membership, billing and cancellation records may be retained for up to six years after the membership or related transaction ends.
11.4 Messages and support records
Messages connected with enquiries, offers, Bookings or disputes may ordinarily be retained for up to six years after the relevant interaction or Stay, particularly where needed to evidence agreements or resolve complaints.
Routine support messages that have no continuing relevance may be deleted sooner.
11.5 Identity-verification information
Pack2Go will retain verification information only for as long as necessary for security, legal and fraud-prevention purposes.
Stripe may retain identity information under its own legal obligations and retention policy.
Where possible, Pack2Go may retain only confirmation that verification was completed rather than copies of identity documents.
11.6 Marketing information
Marketing records may be retained while you remain subscribed.
If you unsubscribe, we may retain limited suppression information, such as your email address and opt-out date, so that we do not contact you again contrary to your preference.
11.7 Cookie and analytics data
Cookie duration and analytics-retention periods will be stated in the Cookie Policy or consent tool.
11.8 Complaints and legal matters
Information relating to a complaint, chargeback, legal claim, fraud concern or regulatory matter may be retained until the issue is resolved and for an appropriate period afterwards.
We may retain information for longer where required by law, a regulator, litigation hold or another legitimate necessity.
- Security
We use appropriate technical and organisational measures designed to protect personal information against:
unauthorised access; loss; misuse; disclosure; alteration; and destruction.
Measures may include:
access controls; password protections; secure hosting; encryption in transit; payment processing through specialist providers; staff and contractor confidentiality; account monitoring; backups; and incident-management procedures.
No internet-based service can guarantee absolute security.
Users are responsible for protecting their passwords and devices and should notify us promptly of suspected unauthorised Account access.
- Cookies and similar technologies
Pack2Go may use cookies, pixels, local storage and similar technologies.
These may include:
13.1 Strictly necessary technologies
These are needed to:
operate the website; maintain security; authenticate Users; remember booking or Account activity; prevent fraud; and provide services requested by the User.
Consent is not ordinarily required where the technology is strictly necessary.
13.2 Preference technologies
These remember choices such as language, display preferences or saved settings.
13.3 Analytics technologies
These help us understand how the Service is used and improve performance.
13.4 Advertising technologies
These may measure campaigns, build audiences or show more relevant advertising on other platforms.
Except where an exemption applies, non-essential cookies or similar technologies will not be set until valid consent has been obtained. Users must receive clear information about their purposes, and consent must be actively given.
You should provide a separate Cookie Policy or cookie-preference panel listing:
each cookie or technology; its provider; its purpose; its duration; and whether it is essential.
Users should be able to withdraw or change consent as easily as they gave it.
- Direct marketing
We may send electronic marketing only where permitted by law.
You can opt out at any time by:
clicking the unsubscribe link in an email; changing available Account preferences; or contacting hello@pack2go.co.uk.
Opting out of marketing will not stop essential service communications relating to your Account, Membership, request, offer, Booking, payment or legal matters.
We may use limited information to ensure that an opt-out continues to be respected.
PECR applies to electronic marketing and cookies alongside UK GDPR.
- Your data-protection rights
Depending on the circumstances, you may have the right to:
15.1 Access
Ask whether we process your personal information and request a copy.
15.2 Correction
Ask us to correct incomplete or inaccurate information.
15.3 Erasure
Ask us to delete personal information where there is no lawful reason to continue retaining it.
This right is not absolute. We may retain information needed for legal, contractual, fraud-prevention or dispute purposes.
15.4 Restriction
Ask us to restrict the use of your information in certain circumstances.
15.5 Objection
Object to processing based on legitimate interests.
We may continue processing where we have compelling legitimate grounds or need the information for legal claims.
You have an absolute right to object to direct marketing.
15.6 Data portability
Request certain information you provided in a structured, commonly used and machine-readable format where processing is automated and based on consent or contract.
15.7 Withdraw consent
Withdraw consent at any time where processing is based on consent.
Withdrawal does not affect processing already carried out lawfully.
15.8 Rights relating to automated decision-making
Ask for information or human intervention where a legally significant decision has been made solely by automated means and the relevant legal conditions apply.
15.9 Complain
Complain to the Information Commissioner’s Office.
We would appreciate the opportunity to address your concern first, but you do not need to contact us before approaching the ICO.
- Exercising your rights
To exercise a privacy right, contact:
hello@pack2go.co.uk
Please describe your request clearly.
We may ask for information needed to verify your identity. This is to prevent personal information being disclosed to the wrong person.
We will respond within the period required by applicable law, ordinarily within one month. We may extend that period where permitted for a complex or numerous request and will explain if this applies.
We do not normally charge a fee. A reasonable fee may be charged, or a request refused, where legally permitted because it is manifestly unfounded or excessive.
- Children’s information
Pack2Go Accounts and Bookings are intended for people aged 18 or over.
Travellers may provide limited information about children in their travelling party, such as:
age; number of children; sleeping requirements; or relevant accommodation needs.
We use this information only as reasonably necessary to identify suitable Accommodation, calculate occupancy, administer the Booking or meet a disclosed requirement.
We do not knowingly permit children to create Accounts or independently use the marketplace.
If you believe a child has provided personal information directly to us without appropriate authority, please contact us.
- Third-party websites and services
Pack2Go may contain links to Host websites, social-media platforms or other third-party services.
Those organisations have their own privacy policies, and Pack2Go is not responsible for their independent processing.
Users should review the relevant privacy information before providing personal data to another organisation.
- Changes to this Privacy Policy
We may update this Privacy Policy to reflect:
changes to Pack2Go; new providers or features; changes in law; regulatory guidance; or changes to how we use information.
The current version will be published on the website with the revised “Last updated” date.
Where a change is significant, we may provide an additional notice by email or through the Service.
- Contact and complaints
For questions, concerns or requests relating to privacy, contact:
Pack2Go Travel Ltd 9 Mortimer Road Cardiff CF11 9JZ
Email: hello@pack2go.co.uk
You can also complain to the UK supervisory authority:
Information Commissioner’s Office
The ICO’s current contact and complaint information is available through its official website.
Items to confirm before publishing
This draft should not be put live until you confirm the exact provider list. The current template names numerous tools, but it is unclear whether Pack2Go genuinely uses all of them.
Please confirm:
Email marketing: Mailchimp, Constant Contact or another provider? Analytics: Google Analytics, Sharetribe analytics or another tool? Advertising: Meta Pixel, Google Ads, Pinterest or none at launch? Customer support: ordinary email, Intercom, Zendesk, Tawk or another system? Social login: will users actually be able to sign in with Google, Facebook or Apple? Cookie-management platform: which consent banner or tool will the developer install? Sharetribe setup: hosted marketplace or custom application, and whether any additional hosting provider is involved. Identity verification: Stripe only, or another verification provider as well? Transactional email: confirm whether Sharetribe uses SendGrid, another provider or a configured external service for your marketplace. Overseas properties: whether Hosts will be asked to collect passport details or statutory guest-registration information through Pack2Go. I recommend they do not upload passports into Pack2Go unless absolutely required.
I would also remove the long California section unless Pack2Go deliberately targets California residents and has confirmed that the relevant thresholds or obligations apply. The current statement that Pack2Go may have “sold” personal information is particularly unsuitable unless factually and legally accurate.
Finally, this Privacy Policy needs to agree with the live cookie banner and the technologies actually firing on the website. A polished policy saying analytics requires consent will not be sufficient if the site loads analytics or advertising trackers before the visitor chooses.