Privacy Policy
Effective date: 13 October 2026
1. Who we are
XLY Concierge Limited, trading as Kensington Concierge, is the controller of the personal information described in this policy. We operate a membership-based concierge and lifestyle service and coordinate requests with independent suppliers. We are registered in England and Wales under company number 15955015. Our registered office is Academy House, 11 Dunraven Place, Bridgend, Mid Glamorgan, CF31 1JF. You can contact our Data Protection Lead at info@kensingtonconcierge.co.uk.
2. Scope of this policy
This policy explains how we collect, use, disclose, retain and protect personal information relating to website visitors, prospective members, Members, approved users, guests and other people connected with a concierge request. It applies to our website, membership administration, concierge communications, requests and complaints. Independent suppliers and linked websites may act as separate controllers and publish their own privacy notices.
3. Personal information we collect
| Category | Examples |
|---|---|
| Identity and contact information | Name, title, date of birth where relevant, postal address, email address, telephone number if you choose to provide it, and member reference. |
| Membership information | Selected plan, start and renewal dates, approved users, communication preferences, membership status, invoices and payment status. |
| Request and booking information | Dates, destinations, budgets, guest names, itineraries, reservation details, messages, written confirmations, supplier terms and request history. |
| Preferences | Dining, travel, room, seating, gifting, shopping and communication preferences that you choose to provide. |
| Special-category information | Allergy, health, disability, accessibility, religious or similar information only where relevant to a request and supported by an Article 9 condition, normally separate explicit consent. |
| Identity and travel documents | Passport, identity or travel information only where reasonably necessary for a specific booking and requested through an approved secure method. |
| Guest and approved-user information | Information supplied by a Member or business contact about a guest, family member, employee or other approved user. |
| Website and device information | IP address, device and browser information, pages viewed, timestamps, security logs and strictly necessary cookie information. |
| Communications and complaints | Emails, messages, request notes, complaints, outcomes and records needed for service, security or dispute handling. |
| Marketing information | Marketing preferences, campaign engagement and records of consent, soft opt-in or opt-out. |
We do not need or retain a payment-card security code. Card payments are processed by the selected payment provider under its own terms and privacy information.
4. How we collect information
We collect information directly from you when you browse the website, enquire about membership, join, submit a request, communicate with us, make a payment or complain. We may also receive information from a Member, approved user, guest, employer or family contact; an independent supplier involved in a request; a payment, fraud-prevention or identity-verification provider; or a referral partner where the disclosure is lawful and relevant.
5. When information is required
Information marked as required in a form is needed to respond, administer membership, take payment or coordinate the request. If you do not provide it, we may be unable to open the membership, process the payment or provide the requested support. Preferences and marketing choices are optional. We ask only for information reasonably necessary for the relevant purpose.
6. Why we use information and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Respond to enquiries and take steps before membership | Steps at your request before entering a contract; legitimate interests in responding and keeping an enquiry record. |
| Administer membership, billing and approved users | Performance of contract; legal obligations; legitimate interests in service administration. |
| Handle, research and coordinate concierge requests | Performance of contract; legitimate interests in providing, improving and documenting the service. |
| Share necessary details with selected suppliers | Performance of contract; legitimate interests; separate explicit consent where relevant special-category information is involved. |
| Take payment and prevent fraud | Performance of contract; legitimate interests in preventing misuse and loss; legal obligations. |
| Keep records, resolve complaints and establish legal claims | Legal obligations; legitimate interests in accountability, dispute resolution and legal claims. |
| Protect systems, forms and communications | Legitimate interests in security and fraud prevention; legal obligations. |
| Send necessary membership, request and security communications | Performance of contract; legitimate interests in administering the service. |
| Send electronic marketing | Consent or the applicable PECR soft opt-in, with an opt-out in every message. |
7. Legitimate interests
Where we rely on legitimate interests, those interests include responding to enquiries, coordinating requested services, maintaining service and complaint records, improving operations, protecting Members and systems, preventing fraud and establishing or defending legal claims. We consider the necessity and impact of the processing and do not rely on this basis where your rights and interests override ours.
8. Special-category information
A request may involve health, disability, accessibility, allergy, dietary, religious or other special-category information. We ask for this only when it is relevant and necessary. We identify both an Article 6 lawful basis and an Article 9 condition. In the ordinary concierge workflow, we normally ask for separate explicit consent before using or sharing this information. The request states what information is needed, why it is needed, which supplier may receive it and that consent may be withdrawn. Withdrawal does not affect earlier lawful processing but may prevent us or the supplier from completing the request.
9. Information about other people and children
If you provide information about another person, you must be authorised to do so and should make this policy available to them. Do not provide special-category information about another adult unless it is necessary for the request and you have authority to provide it. Membership is for adults. A Member or other responsible adult may provide information about a child where necessary for a family request and must have parental responsibility or other lawful authority. We do not knowingly accept membership applications directly from children.
10. Who we share information with
We may share information with hotels, restaurants, transport providers, airlines, venues, event organisers, retailers and other independent suppliers selected for a request; website hosting, business email, secure form, CRM, payment, security and IT service providers acting for us; professional advisers, insurers, auditors and authorities where required or permitted by law; and a buyer or successor in connection with a genuine corporate transaction. We share only information reasonably required for the relevant purpose and apply contractual and access controls where appropriate.
11. Independent suppliers
A supplier normally decides independently how it uses information for its booking or service and may therefore be a separate controller. Its own privacy notice may apply. We identify the supplier where reasonably practicable, but you should review the supplier’s privacy information before providing additional information directly to it. Kensington Concierge is not responsible for a supplier’s independent processing, but we remain responsible for our own disclosures and supplier selection processes.
12. Payments
Membership fees are processed through the selected payment provider. We may receive transaction references, payment status, billing contact details and limited fraud-screening information, but we do not need to receive or retain the full card security code. Supplier charges are separate from membership fees and may be paid directly to the supplier or reimbursed to us only after written approval. The relevant payment provider or supplier may act as a separate controller for payment and compliance purposes.
13. International transfers
Concierge requests may involve suppliers outside the United Kingdom, and some technology providers may process information in other countries. Where we are responsible for initiating a restricted transfer, we use an applicable UK adequacy regulation or an appropriate safeguard such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Where required, we complete a transfer risk assessment and apply additional measures. A lawful exception is used only where the legal conditions are met. You may contact us for information about the safeguard relevant to your information.
14. Retention
| Record | Retention period |
|---|---|
| Enquiries that do not become memberships | Up to 24 months after the last meaningful contact. |
| Membership, invoice and contract records | During membership and normally for six years after it ends. |
| Request and booking records | Normally for six years after closure where needed for service records, complaints or legal claims. |
| Saved preferences | While membership is active and for up to 12 months afterwards, unless deleted sooner or needed for an open request. |
| Special-category request details | For the request and only as long as reasonably necessary. A retained preference requires a continuing valid Article 9 condition. |
| Identity or travel-document copies | Delete after the verification or booking need ends, normally within 90 days, unless law or a live dispute requires longer. |
| Complaints and legal claims | Normally for six years after closure, and longer only where reasonably required for an active claim or legal hold. |
| Marketing records | Until opt-out, plus a minimal suppression record retained to respect the opt-out. |
| Security and website logs | Normally for up to 12 months, and longer only where needed to investigate an incident or legal claim. |
We may retain information for longer where law requires it, a court or regulator requires preservation, or a documented legal hold applies. We delete or anonymise information when the applicable period ends and no exception remains.
15. Security
We use organisational and technical measures designed to protect personal information against accidental or unlawful loss, misuse, alteration, disclosure or access. Access is limited according to role and need. We use protected forms, access controls, appropriate supplier contracts, logging and deletion procedures. No internet transmission or storage system can be guaranteed completely secure. Do not send passwords, full payment-card details, identity documents or travel-document copies through ordinary email or messaging. We provide an approved secure method where such documents are genuinely necessary.
16. Your rights
Depending on the circumstances, you may have rights to access your personal information, correct inaccurate information, request erasure or restriction, object to certain processing, receive portable information, withdraw consent and complain about our use of personal information. You also have an absolute right to object to direct marketing. These rights may be subject to legal conditions and exemptions.
To exercise a right, email info@kensingtonconcierge.co.uk. We may request information reasonably needed to verify identity or clarify the request. We do not normally charge a fee. We respond within the period required by data protection law and explain any lawful extension, refusal or exemption.
17. Marketing
You can opt out of marketing at any time using the unsubscribe method in the message or by contacting us. Opting out of marketing does not stop necessary membership, booking, security or service communications. We keep a minimal suppression record so that we can respect the opt-out.
18. Cookies and similar technologies
The first website release uses only strictly necessary cookies and similar technologies required to operate and secure the website and protect its forms. It does not use analytics, live-chat, advertising or marketing technologies. Our Cookies Policy identifies the technologies used, their provider, purpose and duration.
19. Automated decisions
We do not use personal information to make solely automated decisions that have legal or similarly significant effects on Members. If this changes, we will update this policy and provide the information, safeguards and rights required by law before introducing the processing.
20. Data protection complaints
If you believe we have not complied with data protection law, email info@kensingtonconcierge.co.uk with the subject Data Protection Complaint or use the privacy route on our Complaints page. You do not need to quote the law. We acknowledge a data protection complaint within 30 days, take appropriate steps to investigate without undue delay, keep you informed and explain the outcome and any action taken.
You may also complain to the Information Commissioner’s Office. We recommend giving us an opportunity to address the issue first, but this does not affect your right to contact the ICO. Information about making a complaint is available at ico.org.uk.
21. Changes to this policy
We may update this policy when our services, suppliers, systems or legal obligations change. We publish the new version and effective date on this page. Where a change materially affects how we use information, we provide an additional notice where required.
22. Contact
XLY Concierge Limited trading as Kensington Concierge
Company number 15955015
Academy House, 11 Dunraven Place, Bridgend, Mid Glamorgan, CF31 1JF