UpgradeMyNightUpgradeMyNight

Legal

Privacy Policy

This policy explains how UpgradeMyNight Ltd collects, uses and protects personal data in accordance with UK GDPR and the Data Protection Act 2018.

Last updated: April 2026

1. Who we are

The data controller is NCM Technology Ltd, a company registered in England and Wales. You can contact us at [email protected].

UpgradeMyNight is a technology platform that works with hospitality venues to offer pre-arrival upgrades and add-ons to their guests. We may process personal data both as a controller (for our own marketing and operational purposes) and as a processor (when handling guest data on behalf of a venue).

2. What data we collect and why

Website visitors

When you use our website we may collect:

  • Contact form submissions — name, email address, and the content of your message. Used to respond to your enquiry. Legal basis: legitimate interests.
  • Analytics data — pages visited, device type, referral source, approximate location (country/region). Used to understand how the site is used and improve it. Legal basis: consent (via the cookie banner).
  • Live chat interactions — messages sent through the HubSpot chat widget, including your name and email if provided. Legal basis: consent and legitimate interests.

Venue contacts

If you enquire about or use our services as a venue representative, we collect your name, business email, phone number and company information. We use this to deliver our services, communicate with you about your account, and send relevant product updates. Legal basis: contract performance and legitimate interests.

Guests

Where a venue has engaged us to contact their guests, we process the booking and contact information provided by that venue (name, email, phone number, booking date and party details). In this context we act as a data processor on behalf of the venue (the controller). We use this data solely to send pre-arrival upgrade communications and to process any purchases made. Guests should also refer to their venue's own privacy policy.

3. Cookies

We use the following categories of cookies:

Strictly necessary

These cookies are required for the website to function and cannot be switched off. They do not store any personally identifiable information. No consent is required for these.

Analytics cookies

With your consent, we use Google Analytics to collect anonymised data about how visitors use our site (pages viewed, session duration, traffic sources). This data is aggregated and cannot be used to identify you individually. You can opt out at any time by withdrawing consent via the cookie banner or by installing the Google Analytics Opt-out Browser Add-on.

Functional / service cookies

With your consent, we use HubSpot to provide the live chat widget on our website. HubSpot may set cookies to remember your chat session and preferences. For more information see HubSpot's Privacy Policy.

You can manage or withdraw your cookie consent at any time using the banner that appears when you first visit the site. Withdrawing consent will not affect the lawfulness of processing carried out before withdrawal.

4. How we share your data

We do not sell personal data. We share data only with trusted third-party service providers who process it on our behalf under appropriate data processing agreements:

  • Resend — transactional email delivery
  • HubSpot — CRM and live chat (EU data centre)
  • Google Analytics — website analytics
  • Cloudflare — website hosting and security

We may also disclose data where required by law or to protect the rights, property or safety of UpgradeMyNight Ltd, our clients, or others.

5. International transfers

Some of our third-party providers may process data outside the UK. Where this occurs, we ensure appropriate safeguards are in place — such as the UK International Data Transfer Agreement (IDTA) or equivalent adequacy decisions — in accordance with UK GDPR Chapter V.

6. How long we keep your data

  • Contact form enquiries — up to 2 years from last contact, unless you ask us to delete sooner.
  • Venue account data — for the duration of the business relationship, plus up to 6 years for legal and accounting purposes.
  • Guest booking data processed on behalf of venues — as instructed by the venue, typically deleted within 12 months of the event date.
  • Analytics data — retained in aggregated, anonymised form. Raw session data is retained per Google Analytics' default retention settings (up to 14 months).

7. Your rights under UK GDPR

You have the right to:

  • Access — request a copy of the personal data we hold about you.
  • Rectification — ask us to correct inaccurate or incomplete data.
  • Erasure — ask us to delete your data where there is no legitimate reason to continue holding it.
  • Restriction — ask us to restrict processing of your data in certain circumstances.
  • Portability — receive your data in a structured, machine-readable format where processing is based on consent or contract.
  • Object — object to processing based on legitimate interests.
  • Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior lawful processing.

To exercise any of these rights, email us at [email protected]. We will respond within one calendar month.

8. Complaints

If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office (ICO):

We would, however, appreciate the opportunity to address your concern directly before you contact the ICO.

9. Changes to this policy

We may update this policy from time to time. The date at the top of this page reflects the most recent revision. Material changes will be communicated by updating this page and, where appropriate, by email to affected parties.

10. Contact us

For any questions about this policy or how we handle your data: