Privacy Policy

Data Controller: Lovi Pet Hotel Ltd · 97 Brandwood Avenue, Chorlton, Manchester · maria@lovipethotel.co.uk
Last updated: 30 July 2026

1. Who we are

Lovi Pet Hotel Ltd is the data controller for personal data we process across our services. We operate:

  • Lovi Pet Hotel — our pet boarding hotel;
  • Lovi Days — our home-visit pet care service;
  • Lovi Dashboards — our internal management system, used by our staff to manage bookings, pet records, and the delivery of care;
  • our public website, lovipethotel.co.uk, where you can find out about and book our services.

This policy applies to the personal data we process across all of these services and our website.

Use of our applications — including the client booking portal and Lovi Dashboards — is also subject to separate Terms of Use, which you are asked to accept before you can use each one. Those terms govern your use of the service; this Privacy Policy explains how we handle your personal data, and the two should be read together.

2. What personal data we collect

When you create an account and use our services, we may collect:

  • Identity data: your first name and last name
  • Contact data: email address, phone number, home address (your phone number and email may be used to send you booking-related notifications — see Section 3)
  • Pet data: pet names, species, breeds, care requirements, medical or dietary needs you share with us
  • Booking data: dates, services selected, extras, preferences, and notes
  • Payment data: payment method chosen (cash or card) and transaction references — we do not store your card details (these are handled directly by Stripe)
  • Technical data: authentication tokens and session data required to keep you signed in
  • Activity data: an audit record of changes made to your account, your pets, and your bookings — including who made each change and when (see Section 4)
  • Website usage data: when you visit our public website (lovipethotel.co.uk), analytics data about how you use the site, collected via cookies (see Section 11)

3. Why we process your data and our lawful basis

Under UK GDPR, we must have a lawful basis for processing your personal data. We rely on:

  • Creating and managing your account — Contract
  • Providing pet care, boarding (Lovi Pet Hotel), and home-visit (Lovi Days) services — Contract
  • Processing payments and deposits — Contract
  • Sending booking confirmations, reminders, and operational updates by email and WhatsApp — Contract / Legitimate interest
  • Recording pet care plans and consent declarations — Contract / Legitimate interest (animal welfare)
  • Complying with our Animal Activities Licence conditions — Legal obligation
  • Maintaining an audit trail for security and dispute resolution — Legitimate interest
  • Improving our services — Legitimate interest

4. Audit logging

Within our Lovi Dashboards system we keep a forensic log of activity on your account and your pets' records — what was changed, when, and by whom. This covers actions taken in Lovi Dashboards, including both your own actions (e.g. updating your address) and our staff's actions (e.g. accessing your file, recording a visit note). It is used solely for security, dispute resolution, and verifying that the care recorded matches the care delivered.

This audit trail does not extend to actions taken directly in our third-party booking system (Revelation Pets), which keeps its own activity records under its own privacy policy and our data processing agreement with them.

You can see your own activity at the bottom of each page in your Lovi Dashboards account. Staff search and access records (the times our staff opened your file) are visible only to the business owner and are not shown to you on your account pages, but you may request a copy at any time by emailing us.

5. Who we share your data with

We do not sell your data. We share personal data only with the following service providers who process it on our behalf:

  • Supabase Inc. (Ireland, EU) — database hosting and authentication. SOC 2 Type II certified. Data encrypted at rest and in transit.
  • Stripe Inc. (Ireland, EU) — payment processing. Stripe handles your card details directly under their own privacy policy; we only receive a transaction reference.
  • Netlify Inc. (US) — application hosting. Netlify does not store your personal data. Standard contractual clauses apply for UK-to-US data transfer.
  • Revelation Pets — booking and kennel management system used to manage bookings, pet records, and occupancy. Client and pet data are processed under a data processing agreement.
  • Zoho Corporation — email delivery for booking confirmations and service emails.
  • Meta Platforms (WhatsApp Business) — used to send booking-related operational notifications. Sending a notification involves sharing the relevant booking details — which may include client and pet names and a contact phone number — with Meta, which may process this data outside the UK under appropriate safeguards.
  • Website analytics provider — on our public website (lovipethotel.co.uk) we use a third-party analytics service to understand how visitors use the site. This is used only with your consent (via the website cookie banner) and may involve processing data outside the UK.

We may also disclose your data where required by law or to comply with a legal obligation. We do not share your personal data with any third party other than the processors listed above.

6. International data transfers

Your personal data is primarily stored in the EU (Ireland) via Supabase. Some of the processors listed in Section 5 process data outside the UK — including Netlify (US), which hosts the application but does not store personal data; Meta (WhatsApp), which may process notification data outside the UK (including in the US); and our website analytics provider, which may process website usage data outside the UK. Where any processor stores or processes personal data outside the UK, we ensure appropriate safeguards are in place — such as standard contractual clauses or a UK adequacy decision — to protect your data to the same standard as UK GDPR requires.

7. How long we keep your data

  • Pet care records and audit log: kept for 3 years after your account closes (or 3 years after a pet's last visit, whichever is later) — the period required by Manchester City Council under our Animal Activities Licence.
  • Booking and payment records: kept for 6 years, as required by HMRC for our company tax records.
  • Active accounts: while your account remains active, we keep all of the above for as long as the account is in use.

After these periods the records are permanently deleted, except where we are required to retain them longer by a specific legal obligation (for example, an open insurance claim or active legal dispute).

8. How we protect your data

We implement appropriate technical and organisational measures to protect your personal data, including encrypted database connections, row-level security policies restricting access to your own data, secure authentication, and access limited to authorised Lovi Pet Hotel staff.

9. Your rights under UK GDPR

You have the following rights:

  • Access — request a copy of the personal data we hold about you
  • Rectification — ask us to correct inaccurate or incomplete data
  • Restriction — ask us to temporarily stop processing your data
  • Data portability — request your data in a structured, machine-readable format
  • Object — object to processing based on legitimate interest
  • Withdraw consent — where processing is based on consent, withdraw it at any time

Right to erasure (right to be forgotten)

If you have never made a booking with us, you can ask us to delete your account and personal data at any time and we will erase everything within 30 days.

If you have made a booking with us, we are legally required to keep your booking, payment, and pet care records for the retention periods set out in Section 7 (3 years for pet care records under our Animal Activities Licence; 6 years for booking and payment records under HMRC rules). During those periods we cannot fully delete your records. You may still:

  • ask us to stop contacting you (we will keep only the records we are legally required to keep, and lock the account from further use);
  • ask us to correct any incorrect information;
  • ask for a copy of the data we hold about you.

Once the retention period has expired, your records will be automatically deleted.

To exercise any of these rights, email us at maria@lovipethotel.co.uk. We will respond within one month.

10. Complaints

If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

We would appreciate the chance to address your concerns first, so please contact us before approaching the ICO.

11. Cookies

Our booking application (Lovi Dashboards and the client account portal) uses strictly necessary cookies for authentication and session management only. It does not use tracking, advertising, or analytics cookies, so these do not require separate consent under UK GDPR.

Our public website (lovipethotel.co.uk) uses cookies, including analytics cookies that help us understand how visitors use the site. These non-essential cookies are used only with your consent, which you can give or withdraw at any time through the cookie banner on the website. For full details of the cookies we use and your choices, see our Cookie Policy.

12. Children's data

Our services are not directed at children under 16. We do not knowingly collect personal data from anyone under 16 years of age. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

13. Automated decision-making

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.

14. Changes to this policy

We may update this policy from time to time. Any changes will be posted on this page with an updated effective date. We encourage you to review this policy periodically.