Privacy Policy

Privacy & Data Protection Policy

Capital City Stays (“we”, “us”, or “our”) is committed to protecting the privacy and confidentiality of homeowners, clients, and website visitors. This privacy notice explains how we collect and use your data when you interact with us or use this website.

1. Information We Collect

We collect and process the following categories of information:

• Identity & Contact Data: Full name, email address, telephone number, and preferred communication methods.
• Property Data: Property location, Edinburgh neighbourhood, size, bedroom count, current occupancy status, and short-term let licensing details.
• Enquiry & Communication Data: Detailed messages submitted via proposal forms, customer service conversations, and appraisal requests.
• Technical & Usage Data: Internet protocol (IP) address, browser type and version, time zone setting, browser plug-in types, operating system, and platform.

2. How We Collect Your Data

We use different methods to collect data from and about you, including:

• Direct Interactions: You provide your details when filling out our “Request a Proposal” form, emailing us, or telephoning our team.
• Automated Technologies: As you navigate through our site, technical data regarding your equipment and browsing patterns is automatically collected via secure edge infrastructure.

3. Lawful Basis for Processing

Under the UK General Data Protection Regulation (UK GDPR), we only process your personal data where we have a lawful basis:

• Legitimate Interests: To evaluate prospective properties, prepare bespoke management proposals, respond to enquiries, and protect the security of our website.
• Performance of a Contract: To enter into and carry out property management contracts, turnover management, guest support, and owner reporting.
• Legal Obligation: To comply with Edinburgh Council Short-Term Let (STL) regulations, Scottish safety regulations, tax compliance, and statutory record keeping.

4. Third-Party Service Providers & Data Security

We do not sell, rent, or trade your personal information. We partner strictly with vetted enterprise service providers who maintain high security and data protection standards:

• Zoho CPaaS / ZeptoMail (EU Data Center): Transactional email processing and secure routing for website proposal enquiries.
• Cloudflare Inc.: Content Delivery Network (CDN), web application firewall (WAF), and edge security infrastructure.

5. Data Retention

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Enquiries that do not lead to a management agreement are securely deleted after 24 months.

6. Your Legal Rights

Under data protection laws, you have rights including:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request the deletion of your personal data where there is no good reason for us continuing to process it.
• Right to Object & Restrict: Object to processing where we rely on legitimate interests.

To exercise any of these rights, contact us at Contactcapitalstays@gmail.com. You also have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office (ICO).