RespondMate ("RespondMate", "we", "us" or "our") respects your privacy and is committed to protecting personal data in line with UK data protection law, including the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 ("PECR").
This policy explains how we handle personal data when you visit our website, communicate with us as a business, or interact with an automated WhatsApp service that we operate on behalf of one of our business clients.
1. Who we are
RespondMate provides automated WhatsApp conversational software and AI booking and concierge services for businesses, including hotels and other hospitality venues. RespondMate is operated as an unincorporated business (sole trader) in the United Kingdom.
Data Controller: Alex Morgan Correspondence address: 10 Example Street, London, EC1A 1AA, United Kingdom Email: contact@respondmate.co.uk Website: https://respondmate.co.uk
2. Our role: controller or processor
Our role under data protection law depends on whose data it is and why we hold it.
| Situation | Our role |
|---|---|
| Business contacts: prospective and current clients | Controller. We decide how and why this data is used for our own business purposes. |
| Guest conversations handled through a client's WhatsApp service | Processor. The client property is the controller and decides why guest data is processed. We act only on its documented instructions. |
3. Personal data we process
A. Business contacts (we are the controller)
We may process:
- Name, job title or professional role
- Professional email address and business telephone number
- Business name and details
- The content of our communications with you
- Account, service, billing and contract information
Where this data comes from. Most information comes directly from you. For prospective clients, we may also obtain professional or business contact details from categories of online and business-related sources, including:
- The prospect's own website
- Publicly listed business directories and mapping services
- Professional networking platforms
- Social media business pages
- Industry publications and events
- Business data, lead-generation or enrichment tools
- Referrals and introductions
- Information the prospect provides to us directly
The particular sources and tools we use may change over time depending on how we identify prospective clients.
We only collect professional or business contact details for prospecting purposes. We do not intentionally collect private personal information unrelated to a person's professional or business role.
We do not buy or rent third-party marketing lists.
Where we obtain prospect information from another source, we process it where we have a lawful basis to do so and provide the transparency information required by applicable data protection law. When we first contact a prospect whose details we obtained from another source, our communication will identify how we obtained their details and provide a link to this Privacy Policy. A prospect can also ask us at any time where we obtained their details by emailing contact@respondmate.co.uk.
For prospecting and direct marketing, we generally rely on legitimate interests as our UK GDPR lawful basis where an appropriate legitimate interests assessment supports this. This does not override the separate requirements of PECR.
PECR rules differ depending on the type of recipient and communication channel. Limited companies and other corporate bodies are generally treated as corporate subscribers. Sole traders and certain partnerships are treated as individual subscribers and have additional protection for electronic marketing such as email, SMS and WhatsApp messages. Where PECR requires consent or another permitted basis for a particular communication, we will comply with those requirements.
For live marketing calls, we will also comply with applicable PECR requirements, including relevant Telephone Preference Service (TPS) and Corporate Telephone Preference Service (CTPS) rules.
If you do not want us to contact you about RespondMate, you can email contact@respondmate.co.uk and ask us to stop. You can also object to the processing of your personal data for direct marketing purposes at any time. We will record your objection or opt-out in a suppression record containing only the information reasonably necessary to ensure that we do not contact you again for direct marketing purposes.
B. Guest data (we are the processor)
When we operate an automated WhatsApp receptionist, concierge or booking agent for a client property, we process the personal data contained in guest conversations, which may include:
- WhatsApp telephone number and, where provided, guest name
- Reservation dates and party size
- Booking and availability information
- Guest questions and enquiry text
- Other information a guest chooses to provide in the conversation
The client property is responsible for telling its guests how their data is used. We process guest data only for the purposes agreed with the client and on its documented instructions, unless the law requires otherwise. We do not use guest data for our own marketing or unrelated purposes.
Sensitive information. The service is not designed to collect special category data. Guests may nonetheless volunteer this kind of information, for example an allergy or a mobility requirement, when making a booking. If they do, we process it only as needed to handle that request, and the client property remains responsible for the lawful basis and other requirements applicable to that processing.
4. How we use personal data and our lawful bases
Where we are the controller, we rely on the following lawful bases:
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries and communicating with prospective clients | Legitimate interests (running and promoting our business) |
| Business-to-business marketing to professional contacts | Legitimate interests, subject to PECR rules on corporate and individual subscribers |
| Setting up, providing and supporting our services for clients | Contract |
| Managing accounts, subscriptions and invoices | Contract; legal obligation (tax and accounting records) |
| Security, fraud prevention and preventing misuse of our services | Legitimate interests |
| Improving the reliability and performance of our services | Legitimate interests |
| Any use for which we ask for your specific consent | Consent (which you may withdraw at any time) |
Where we act as a processor, the client property determines the lawful basis for processing guest data. Our processing on its behalf includes operating the WhatsApp service, generating replies, handling booking requests, syncing bookings with the client's calendar where configured, and providing technical support.
5. Business-to-business communications
We may contact professional or business contacts about RespondMate and our services.
Where we use personal data for direct marketing, we rely on legitimate interests as our UK GDPR lawful basis where appropriate, but we also comply with PECR and any applicable rules governing the particular recipient and communication channel.
For electronic marketing, including email, SMS and WhatsApp messages, the rules differ depending on whether the recipient is a corporate subscriber or an individual subscriber. Sole traders and certain partnerships are treated as individual subscribers and have additional protection under PECR.
For live marketing calls, we comply with the applicable TPS and CTPS requirements.
If you do not want to receive marketing from us, you can email contact@respondmate.co.uk or object directly to the processing. We will maintain a suppression record so that we can respect your request and avoid contacting you again for direct marketing purposes.
6. Who we share data with
We use trusted third-party providers to run RespondMate and deliver services to our clients.
- Meta Platforms. We use the WhatsApp Business Platform, provided by Meta Platforms Ireland Limited and/or Meta Platforms, Inc. and their affiliates. Guest messages pass through Meta's systems so that WhatsApp messaging can work. Meta handles WhatsApp data under its own terms and policies.
- Cloud and database infrastructure providers. We use secure hosting, database and infrastructure providers, located in the UK and/or European Economic Area (EEA) where appropriate, to host our systems and store data.
- AI model provider. Guest message text is sent to an AI model provider so the service can generate replies. The provider used for each client, and the terms that apply, are set out in that client's service agreement or discussed with the client directly before go-live. We do not use guest conversations to train AI models. We engage AI providers on terms that restrict them from using guest data for their own purposes, including model training.
- Google. Where a client connects its calendar, we use Google LLC and Google Calendar to check availability and create, update or cancel bookings on the client's instructions.
Where we act as a processor, these providers are engaged as authorised subprocessors in line with our client agreements and data protection law. Clients can ask us for the current list of subprocessors that apply to their service. We do not sell personal data.
7. International transfers
Some of our providers, including Meta, Google and AI model providers, may process personal data outside the UK, including in the United States. Where this happens we ensure the transfer is lawful, using one of the following:
- The UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge") for certified US recipients
- The UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses
- Another mechanism permitted under UK data protection law
You can contact us for more information about the safeguards that apply.
8. Data security
We use appropriate technical and organisational measures to protect personal data against accidental or unlawful loss, destruction, alteration, unauthorised disclosure or access. These include access controls, authentication, encryption where appropriate, restricted administrative access and secure infrastructure. No internet-based service is completely secure, and we cannot guarantee absolute security.
If a personal data breach affects guest data we process for a client, we will notify that client without undue delay so that it can meet its own obligations.
9. How long we keep data
We aim to keep personal data only for as long as reasonably necessary for the purpose for which it was collected. We review our retention practices periodically and delete or irreversibly anonymise personal data when the applicable retention period expires, unless we have a lawful reason to retain it for longer.
Unless a different period is agreed in writing, our defaults are:
| Data | Default retention | Reason |
|---|---|---|
| Prospective clients who never respond | 6 months after the last outreach attempt | A short period limits retention of inactive prospect records while allowing a reasonable period for ordinary outreach. |
| Prospective clients who respond but do not become clients | 12 months after the last meaningful contact | A genuine business conversation may reasonably require follow-up, while 12 months provides a defined backstop for inactive prospects. |
| Marketing opt-out records | For as long as needed to honour the opt-out | We need a minimal suppression record to ensure we do not contact the person again. |
| Former clients: contact and contract records | 6 years from the end of the contract | This provides a defined backstop for handling disputes and establishing, exercising or defending contractual legal claims. |
| Billing, invoicing and accounting records | 6 years | This supports applicable tax, accounting and record-keeping requirements. |
| Guest conversation data processed for a client | The client's documented instructions take priority. If no instruction is given, 30 days after the conversation ends. | The client controls the retention purpose. The 30-day default is deliberately short because booking conversations generally do not need to remain identifiable long after the interaction. |
| Guest data after termination of a client's service | The client's instructions take priority. If no instruction is given, 30 days after termination. | This provides a short default period for returning or deleting data while allowing the client to specify a different period where needed. |
Prospect records are reviewed as part of our retention process at least every 12 months. We take reasonable steps to apply the retention periods above and to delete or irreversibly anonymise records when they expire. These periods are operational standards rather than a promise that every individual record will be deleted at an exact time.
Clients can request shorter or longer guest-data retention periods in their service agreement or other written instructions, subject to applicable data protection requirements and technical feasibility.
We may keep data for longer where needed to resolve a dispute, enforce an agreement, establish, exercise or defend legal claims, or comply with the law.
10. Your rights
You have the following rights under UK data protection law, depending on the circumstances:
- Access: to receive a copy of the personal data we hold about you
- Rectification: to have inaccurate or incomplete data corrected
- Erasure: to have your data deleted in certain circumstances
- Restriction: to limit how we use your data in certain circumstances
- Objection: to object to processing based on legitimate interests and to any direct marketing
- Portability: to receive certain data in a portable format
- Withdrawal of consent: where processing is based on consent
- Automated decisions: rights relating to decisions made solely by automated means that have legal or similarly significant effects (see section 11)
To exercise a right, email contact@respondmate.co.uk. We will respond within one month, which we may extend by up to two further months for complex or numerous requests, and we will tell you if we do. Requests are normally free of charge. We may ask you to verify your identity before acting, and we may charge a reasonable fee or refuse a request that is manifestly unfounded or excessive.
If your data was processed by us only on behalf of a client property, we may pass your request to that client as the controller and help it to respond.
11. Automated processing and AI
Our service uses artificial intelligence to generate replies to guest messages and to help with booking-related tasks. Guests are told that they are communicating with an automated assistant. AI-generated responses may occasionally be inaccurate, so clients are encouraged to keep human oversight of bookings and important requests.
RespondMate does not use guest conversations to make decisions about individuals for unrelated purposes. If a client configures the service in a way that produces legal or similarly significant effects on individuals, the client is responsible for the appropriate lawful basis and safeguards, including human review.
12. Data Processing Agreement
Where we process guest data for a client, the processing is governed by a Data Processing Agreement (or equivalent data processing terms) within the client's service agreement. It sets out the subject matter, duration and purpose of the processing, the types of data involved, our security commitments, our subprocessors and each party's obligations under UK GDPR. It forms part of our Terms of Service.
13. Cookies and website technologies
Our website uses only cookies and similar technologies that are strictly necessary for it to work. If we introduce analytics or other non-essential cookies, we will ask for your consent first and update this policy.
14. Changes to this policy
We may update this policy from time to time. The latest version is always published on this page with its effective date. If we make material changes we will take reasonable steps to tell affected clients.
15. Complaints
If you have a concern about how we have handled your personal data, please contact us first at contact@respondmate.co.uk.
We will acknowledge your complaint within 30 days, investigate it, and keep you informed of the outcome without undue delay.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator:
https://ico.org.uk/make-a-complaint/
16. Contact
RespondMate Alex Morgan 10 Example Street London EC1A 1AA United Kingdom
Email: contact@respondmate.co.uk Website: https://respondmate.co.uk