Privacy policy
Last updated 28 October 2026
This policy explains what personal information Codero collects, why, and what your rights are. We've kept it in plain English.
Who we are
Codero Ltd is registered in Scotland, company number SC757894. Registered office: 77 Union Place, Brightons, Polmont, FK2 0FG. We are the controller of the personal information described here. ICO registration number: [ICO number].
Questions about your data: email customerservices@codero.co.uk or call 07375 573752.
What we collect
| When | What we collect |
|---|---|
| You request a free audit | Your name, email address, your hotel's website and room count, and which page you came from |
| You join a waitlist | Your email address, hotel name and the services you're interested in |
| You email, phone or meet us | Your name, contact details and whatever you choose to tell us |
| You become a client | Contact and billing details for you and your colleagues, and the information needed to deliver the work |
| You use our website | With your consent only: how you use the site, through analytics and session recording (see our cookie policy) |
We don't collect special category information (such as health data) and we don't buy contact lists.
Why we use it, and our legal basis
- To respond to your audit request or enquiry, and to prepare and send your report. Legal basis: steps you've asked us to take before a contract, and our legitimate interest in responding to people who contact us.
- To deliver services to clients, invoice and keep records. Legal basis: contract, and legal obligation for accounting and tax records.
- To follow up after an audit or enquiry, by email or phone, a small number of times. Legal basis: legitimate interests. You can ask us to stop at any time.
- To tell you about new services you joined a waitlist for. Legal basis: consent, which you can withdraw at any time.
- To understand and improve our website. Legal basis: consent, given through the cookie banner.
- To protect our forms from spam and abuse. Legal basis: legitimate interests.
AI tools
We use AI tools to help with research, first drafts and analysis, for example when preparing an audit. A person checks everything before it's sent to you or published. Where these tools handle personal information, we use business accounts or settings that don't allow the provider to use it to train their models.
Who we share it with
We never sell your information. We share it only with trusted providers who help us run Codero, under contracts that protect it:
- Website hosting and content: Vercel (hosting) and Sanity (content and form records).
- Email: Zoho Mail and Resend (sending form confirmations and notifications).
- Spam protection: Cloudflare Turnstile.
- Notifications: Telegram, used to alert Graeme to new requests.
- Analytics, only with your consent: Google Analytics and Microsoft Clarity.
- AI tools: as described above.
- Professional advisers: our accountant and, if needed, legal advisers.
We may also share information if the law requires it.
Transfers outside the UK
Some of these providers store data outside the UK, including in the United States. Where that happens, we rely on UK adequacy regulations (including the UK-US data bridge where the provider is certified) or the UK's approved transfer agreements.
How long we keep it
- Audit requests and enquiries that don't lead to work: up to 24 months, then deleted.
- Waitlist sign-ups: until the service launches or you unsubscribe, and no longer than 24 months.
- Client records: for the length of the work and six years after, for accounting and legal reasons.
- Analytics data: up to 14 months.
Your rights
You can ask us to give you a copy of your information, correct it, delete it, restrict or object to how we use it, or move it to another provider. Where we rely on consent, you can withdraw it at any time. We'll respond within one month.
If you're unhappy with how we've handled your information, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Information about your guests
When we work for a hotel (for example, replying to reviews or sending post-stay emails), we handle guest information on the hotel's behalf and only on its instructions. The hotel remains responsible for that information, and our terms of business include data protection terms covering it.
Children
Our services are for businesses and are not aimed at anyone under 18.
Changes
We'll update this policy when how we work changes, and change the date at the top.