Privacy Policy

1. Who We Are

This Privacy Policy explains how Birch Stays Ltd ("Birch Stays", "we", "us", "our") collects, uses, shares and protects personal data in connection with the Birch Stays Owner Portal at owner.birchstays.com and its integration with Intuit QuickBooks Online (together, the "Service"). Birch Stays Ltd is the data controller for personal data processed through the Service. We are committed to processing personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. What This Policy Covers

This policy covers personal data processed when you:

• use the Owner Portal as a property owner whose property is managed by Birch Stays;
• use the Service as an employee or contractor of Birch Stays in the course of operating the business;
• connect a QuickBooks Online company file to the Service via Intuit’s authorised API.

3. Data We Process

Through the Service we process the following categories of data:

3.1 Account & contact data

Names, email addresses, phone numbers, business names and roles of authorised users of the Owner Portal and individuals at Birch Stays. This data is collected when accounts are created and updated by Birch Stays.

3.2 Accounting data from quickbooks

When a QuickBooks company file is connected to the Service, we access accounting records relevant to the properties Birch Stays manages, including:

• transactions, invoices, bills, journal entries, payments and refunds;
• customer and vendor records (which may contain individual names and contact details);
• account balances, financial reports and supporting metadata;
• chart of accounts, classes, locations and tags used for reporting. The data we read or write is limited to the connected QuickBooks company file authorised by Birch Stays and is used for the purposes described in section 4.

3.3 Property and booking data

Data relating to properties under management, including bookings, guest names (only where required for reconciliation), check-in and check-out dates, gross revenue, fees, commissions and cleaning/maintenance records.

3.4 Usage and technical data

IP address, browser type, device information, pages viewed and actions taken within the Owner Portal. Used to operate the Service securely and to improve it.

4. How We Use Your Data

We use personal data to:

• operate the Owner Portal and provide property management services to owners under our management agreement;
• produce owner statements, financial reports and dashboards that owners view through the Service;
• reconcile bookings, payments, owner expenses and commission across QuickBooks, the booking systems we use, and the Owner Portal;
• create and update entries in QuickBooks on behalf of Birch Stays where the user has authorised this;
• maintain accurate accounting records and comply with our legal, tax and regulatory obligations;
• communicate with you about your account, the Service, and material changes to either;
• detect, investigate and prevent fraud, unauthorised access and misuse of the Service.

5. Lawful Bases

We rely on the following lawful bases under UK GDPR Article 6:

• Contract — where processing is necessary to perform our property management agreement with you or to take steps at your request before entering into one.
• Legitimate interests — to operate, maintain, secure and improve the Service; to communicate with users; and to protect against fraud and misuse. Where we rely on legitimate interests we balance these against your rights.
• Legal obligation — where we are required to retain or disclose records to comply with UK accounting, tax, anti-money-laundering or other legal duties.
• Consent — in the limited cases where we ask for it (for example, optional communications); you may withdraw consent at any time without affecting the lawfulness of earlier processing.

6. Who We Share Your Data With

We share personal data only as set out below.

6.1 Property owners

Where you are a property owner using the Service, we share accounting and operational data relating to your property with you through the Owner Portal. We do not share one owner’s data with another owner.

6.2 Birch stays personnel

Authorised employees and contractors of Birch Stays Ltd access data where necessary to perform their role (for example, the accounts team, account managers and operations staff). Access is controlled on a need-to-know basis.

6.3 Service providers (data processors)

We use trusted third-party processors to deliver the Service. Each is bound by a data processing agreement and may only process data on our documented instructions:

Intuit QuickBooks Online — accounting platform we read from and

write to via the official API.

Hosting Cloud infrastructure on which the Owner Portal runs.

Database Storage of operational and analytics data used by the Owner

Portal.

VR Platform Property management platform that pushes owner statement

journals to QuickBooks.

Hostfully Booking management platform from which booking data is

synced.

Stripe Payment processor for direct bookings.

Email & comms Sending transactional emails, statements and notifications.

6.4 Professional advisers and authorities

Accountants, auditors, legal advisers and regulators where required for the operation of Birch Stays or to meet a legal obligation.

6.5 Sale or restructure

In the event of a sale, merger or restructure of Birch Stays Ltd, data may be transferred to the acquiring entity under appropriate confidentiality obligations.

WE D O N O T S E L L Y O U R DA T A

Birch Stays does not sell personal data to third parties. We do not use QuickBooks data for advertising and we do not use it to train third-party AI models.

7. International Transfers

Some of our service providers (notably Intuit) are based outside the UK. Where personal data is transferred outside the UK we ensure an appropriate safeguard is in place, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or transfers to a country recognised by the UK government as providing adequate protection.

8. Data Retention

We retain personal data only for as long as needed for the purposes set out in this policy and to meet our legal obligations:

• Accounting records (including QuickBooks data we have written or read) are retained for at least six years after the end of the relevant financial year, in line with UK tax and company-law requirements.
• Owner portal account data is retained for the duration of the management agreement plus a reasonable period afterwards for record-keeping.
• Technical and usage logs are typically retained for up to twelve months.

9. Your Rights

Subject to certain conditions, you have the following rights under UK GDPR:

• the right to access personal data we hold about you;
• the right to rectification of inaccurate or incomplete data;
• the right to erasure ("right to be forgotten") in defined circumstances;
• the right to restrict or object to processing;
• the right to data portability for data you have provided to us;
• the right to withdraw consent where we rely on it;
• the right to lodge a complaint with the Information Commissioner’s Office (ico.org.uk). To exercise any of these rights, contact us using the details in section 12. We may need to verify your identity before responding. Some rights are subject to legal exceptions, particularly where data must be retained for tax or accounting purposes.

10. Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, audit logging and supplier due-diligence. No system is completely secure; if you believe your account has been compromised, contact us immediately at hello@birchstays.com.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The most current version is always available at owner.birchstays.com. Where changes are material we will provide reasonable notice (for example by email or via the Owner Portal) before they take effect.

12. Contact & Data Controller

Birch Stays Ltd is the data controller for personal data processed through the Service. Contact us at:

Entity Birch Stays Ltd

Email hello@birchstays.com

Portal owner.birchstays.com

Regulator Information Commissioner’s Office — ico.org.uk