Privacy notice.
Last updated: October 2026. This notice describes how Clydebridge Software Ltd ("LodgingMods") processes personal data submitted through lodgingmods.com and the client console, in accordance with the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations.
1. Data controller
Clydebridge Software Ltd, 7 West Nile Street, Glasgow G1 2PR, Scotland, United Kingdom, Company No. 15102839, registered in Scotland (Companies House, Edinburgh). ICO registration ZA917604. Contact: [email protected], +44 141 628 0719.
2. Data we collect
From operators (controller-side): name, work email, company name, phone, module licensing history, support correspondence, invoices and payments.
From operators' PMS systems (processor-side): only the records a given module needs to perform its documented function — reservations, rates, availability, guest contact details where a module involves guest communication. Scope is listed on the module's own page.
Website analytics: aggregate, cookie-free (visitor counts via server-side log sampling); no cross-site tracking.
3. Lawful basis
- Performance of a contract (UK GDPR Art. 6(1)(b)) — for provisioning and running the modules you licensed.
- Legal obligation (Art. 6(1)(c)) — for VAT invoicing and HMRC record-keeping.
- Legitimate interest (Art. 6(1)(f)) — for abuse prevention on the client console and for improving the connectors; balanced against the minimal data we hold.
4. Retention
- Invoices and VAT records: 7 years (statutory).
- Support correspondence: 24 months after case closure.
- Scoped API credentials: deleted within 30 days of module cancellation, confirmed by email.
- Module-side guest data (where applicable): deleted within 30 days of module cancellation per the DPA.
- Server logs: 14 days for abuse response, longer only for an open security incident.
5. Recipients and processors
We use the following sub-processors, all under UK-GDPR-compliant data processing agreements with Standard Contractual Clauses where applicable:
- AWS (eu-west-2, London) — infrastructure hosting and KMS-managed credential encryption.
- Postmark — transactional email for the client console and module notifications.
- Stripe — card and bank-transfer payment processing (we never see full card data).
- FreshBooks — invoicing and VAT records.
No data is shared with advertising networks, analytics-for-marketing vendors, or data brokers. We do not sell data.
6. International transfers
Primary infrastructure runs in the UK (AWS eu-west-2). The sub-processors above may transfer limited data to the US under the UK extension to the EU-US Data Privacy Framework and, where applicable, under Standard Contractual Clauses supplemented by our transfer risk assessment.
7. Your rights
Access, rectification, erasure, restriction, portability and objection — exercised by email to [email protected]. We respond within 30 days (extendable by two months for complex requests under Art. 12(3) UK GDPR). You may lodge a complaint with the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, UK, or via ico.org.uk.
8. Cookies
Only a single strictly necessary cookie that records your cookie-banner choice, and a client-side localStorage entry for the basket contents. No tracking cookies, no third-party cookies, no advertising cookies. See the cookies notice.
9. Changes
Material changes to this notice are announced on this page at least 15 days before they take effect, and emailed to active customers.