Privacy Policy

This Privacy Policy explains how Pocket Scout Media Ltd ("we", "us", "our"), a company registered in England and Wales under company number 14872051 with its registered office at 27 Marylebone Lane, Suite 4, London W1U 2NL, collects, uses, discloses and protects personal data when you visit cleverpocketscoutshelvs.lol (the "Site") or correspond with our editorial desk.

We are the data controller for the personal data described in this policy. We take the position that a publication about hospitality should collect as little data as it can reasonably operate with, and this policy reflects that principle rather than merely asserting it.

1. Information we collect

1.1 Information you provide voluntarily

• Contact form submissions: your name, email address, optional telephone number, enquiry category, hotel of interest, intended travel month and the free-text content of your message.
• Email correspondence: any information contained in emails you send to concierge@, editorial@ or [email protected], including attachments.
• Corrections and factual disputes: where you write to challenge published content, we retain your submission and our response as part of our editorial record.

1.2 Information collected automatically

• Technical data: IP address (truncated where our analytics configuration permits), browser type and version, operating system, screen resolution, device category and preferred language.
• Usage data: pages viewed, time on page, scroll depth, referring URL, outbound link clicks to hotel websites, and approximate geographic region derived at country or city level.
• Consent data: the choice you make in our cookie banner, stored in your browser's local storage under the keys cookieConsent, cookieConsentMode, cookieConsentDetail and cookieConsentDate.

1.3 Information we do not collect

We do not collect payment card details, passport or identity document numbers, hotel booking references, or special category data as defined in Article 9 of the UK GDPR. We do not operate a user account system. We do not sell personal data under any definition, including the broad definition used in the California Consumer Privacy Act.

2. Lawful bases for processing

Under Article 6 of the UK GDPR and the EU GDPR we rely on the following lawful bases:

• Consent (Art. 6(1)(a)): for analytics and functional cookies, and for any optional newsletter you actively request.
• Legitimate interests (Art. 6(1)(f)): for responding to enquiries, maintaining the security and integrity of the Site, preventing abuse, and producing aggregate readership statistics. We have carried out a balancing assessment and concluded that these interests do not override your rights and freedoms.
• Legal obligation (Art. 6(1)(c)): for retaining records required by UK company, tax and accounting law.

3. Cookies and similar tracking technologies

The Site uses a small number of cookies and browser storage entries. Strictly necessary items are set without consent because the Site cannot function without them; all others are set only after you have given consent through the banner. A complete, itemised table of every cookie we use — including its name, purpose, provider, type and retention period — is published in our Cookie Policy.

You may withdraw or modify your consent at any time by clearing your browser's local storage for this domain, which will cause the consent banner to reappear on your next visit. Instructions for the major browsers are provided in the Cookie Policy.

4. Third-party processors and recipients

We keep our supply chain deliberately short. The following categories of processor may handle personal data on our behalf, always under a written data processing agreement compliant with Article 28 of the UK GDPR:

• Hosting and content delivery: our web host and CDN provider process server logs including IP addresses for the purposes of delivery, caching and denial-of-service mitigation.
• Privacy-oriented analytics: a cookieless or first-party analytics provider aggregating page views, referrers and outbound clicks. No cross-site profiling is performed.
• Transactional email: a European email service provider that transmits and stores our enquiry correspondence.
• Embedded map services: the map on our Contact page is served by Google Maps. When that frame loads, Google may receive your IP address and set its own cookies under its own privacy policy. We load the frame lazily so that it is requested only when you scroll to it.
• Font delivery: web fonts are requested from Google Fonts; this exposes your IP address to that service for the duration of the request.

We do not permit any processor to use your data for its own marketing, profiling or model-training purposes.

5. International transfers

Our primary infrastructure is located within the United Kingdom and the European Economic Area. Where a processor transfers data outside the UK or EEA, we rely on UK adequacy regulations, the UK International Data Transfer Addendum, or the European Commission's Standard Contractual Clauses, supplemented by technical measures including encryption in transit and at rest.

6. Data retention

Category	Retention period
Contact form and email correspondence	24 months from last contact, then deleted
Corrections and editorial disputes	6 years, as part of our publishing record
Server access logs	30 days, then permanently purged
Aggregated analytics (non-identifying)	26 months
Consent records in local storage	12 months, or until you clear your browser storage
Accounting and statutory records	6 years after the relevant financial year end

7. Your rights

7.1 Under the UK and EU GDPR

• Right of access: obtain confirmation of whether we process your data and a copy of it.
• Right to rectification: have inaccurate data corrected without undue delay.
• Right to erasure: request deletion where the data is no longer necessary, consent is withdrawn, or processing is unlawful.
• Right to restriction: require us to pause processing while a dispute about accuracy or legitimate interests is resolved.
• Right to data portability: receive data you provided in a structured, machine-readable format.
• Right to object: object at any time to processing based on legitimate interests, including profiling.
• Right to withdraw consent: withdraw consent at any time without affecting the lawfulness of prior processing.
• Right to complain: lodge a complaint with the Information Commissioner's Office at ico.org.uk or with your local supervisory authority in the EEA.

7.2 Under the CCPA and CPRA (California residents)

• The right to know what categories of personal information we collect, the sources, the business purpose and the categories of third parties with whom it is shared.
• The right to delete personal information, subject to statutory exceptions.
• The right to correct inaccurate personal information.
• The right to opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined, so no opt-out mechanism is required, but we will honour any Global Privacy Control signal your browser sends.
• The right not to be discriminated against for exercising any of these rights. Our content is identical for all readers regardless of privacy choices.

We respond to verified requests within one calendar month (UK/EU) or forty-five days (California), with a permitted extension where a request is complex. We may ask for information sufficient to verify your identity, but no more than is necessary.

8. Security measures

The Site is served exclusively over HTTPS with modern TLS. Administrative access requires multi-factor authentication and is limited to named individuals on a least-privilege basis. Enquiry correspondence is stored in an encrypted mailbox with access restricted to the editorial desk. We review our dependency chain quarterly and apply security patches promptly. No system is perfectly secure, and we do not claim otherwise; in the event of a personal data breach likely to result in a risk to your rights, we will notify the ICO within 72 hours and inform affected individuals without undue delay where the risk is high.

9. Children

The Site is intended for adults planning or researching luxury travel. We do not knowingly collect personal data from anyone under sixteen. If you believe a child has provided us with personal data, contact our Data Protection Officer and we will delete it.

10. Editorial independence and affiliate disclosure

We do not operate affiliate links, receive booking commission, accept press rates or publish sponsored content. Outbound links to hotel websites are plain links provided for reader convenience. Because of this, we have no commercial incentive to track individual reader behaviour, and our analytics configuration reflects that.

11. Changes to this policy

We review this policy at least annually and whenever our processing changes materially. The "last updated" date at the top of this page always reflects the current version. Where a change materially affects your rights, we will display a prominent notice on the Site for at least thirty days.

12. Data Protection Officer and contact details

Questions, access requests and complaints should be addressed to our Data Protection Officer:

• Data Protection Officer, Pocket Scout Media Ltd
• 27 Marylebone Lane, Suite 4, London W1U 2NL, United Kingdom
• Email: [email protected]
• Telephone: +44 20 7118 6420

If you are dissatisfied with our response, you may escalate to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom.

Read the Cookie Policy   Read the Terms of Service