Privacy Policy

1.1 Welcome to the Privacy Policy of Sweet Hospitality ("Sweet", "we", "us" or "our"). Sweet Hospitality is a trading name of GCM Hospitality Limited, an Irish registered company with company number 794742.

1.2 We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, share and otherwise process your personal data when you use the Sweet website, mobile application, membership platform, Admin or Partner functionality where applicable, or related services (together, the "Sweet Platform"), apply for or hold a Sweet membership, use Partner Offers, communicate with us, or otherwise interact with Sweet.

1.3 This Privacy Policy also explains your rights under applicable data protection law, including the General Data Protection Regulation ("GDPR") and the Irish Data Protection Act 2018.

1.4 This Privacy Policy should be read alongside our Member Terms & Conditions and any other privacy or data protection notice we may provide when collecting particular information from you.

2.1 The controller responsible for the personal data described in this Privacy Policy is GCM Hospitality Limited, trading as Sweet Hospitality, company number 794742, Glennamuck Road, Carrickmines, Dublin 18, Ireland, D18 K5E9. Email: admin@sweethospitality.ie.

2.2 As data controller, GCM Hospitality Limited determines why and how personal data is processed in connection with the Sweet Platform and our membership services.

2.3 Where a participating hotel, restaurant or other hospitality business (a "Partner") receives personal data in connection with a booking, redemption or hospitality service, that Partner may process your personal data as a separate data controller for its own purposes. Its processing will be subject to its own privacy practices.

3.1 Depending on how you interact with Sweet, we may collect and process the following categories of personal data.

Identity and Account Data may include your name, username, account identifier, profile information, login credentials and other information associated with your Sweet account.

Contact Data may include your email address, telephone number and other contact information you provide.

Professional and Eligibility Data may include your employer, workplace, job title, role, hospitality sector, professional connection to the hospitality industry and information or documents used to verify your eligibility for Sweet membership.

Membership Data may include your membership type, membership status, activation date, renewal status, eligibility status and information relating to your use of your membership.

Subscription Data may include information concerning whether you hold an active monthly or annual subscription, subscription status, renewal status and transaction identifiers or other subscription information made available to us by Apple, Google or another authorised platform. Sweet does not ordinarily receive or store your full payment card details where your membership is purchased through the Apple App Store or Google Play.

Partner and Booking Data may include Partner Offers viewed, saved, requested or used by you; booking requests; booking status; dates and venues; cancellations; No-Shows; redemptions; and information reasonably necessary to administer or investigate the use or misuse of Partner Offers.

Corporate Membership Data may include information received from or confirmed with an employer or sponsoring organisation where your membership is provided as an employee or corporate benefit, such as your name, work email address, eligibility or membership status.

Technical Data may include your IP address, device identifiers, device type, operating system, app version, browser information, login information and other technical information generated when you access the Sweet Platform.

Usage Data may include information about how you use the Sweet Platform, including pages or screens viewed, features used, interactions with Partner Offers, searches, clicks, session information and other usage information.

Communications Data may include communications between you and Sweet, customer support requests, enquiries, complaints, feedback, survey responses and other correspondence.

Marketing and Preference Data may include your preferences concerning marketing communications, notifications and areas of interest.

3.2 We may also create and use aggregated or anonymised information for statistical, analytical, commercial and service-improvement purposes. Information that has been genuinely anonymised so that an individual can no longer be identified is not personal data.

4.1 Sweet does not ordinarily seek to collect special categories of personal data, such as information concerning race or ethnicity, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health information or information concerning a person's sex life or sexual orientation.

4.2 We also do not ordinarily seek information concerning criminal convictions or offences.

4.3 Please do not provide this type of information to Sweet unless it is necessary and we have specifically requested it or there is another lawful reason for doing so.

5.1 We may collect personal data directly from you, including when you create an account, apply for membership, complete your profile, upload information or documents for eligibility verification, contact us, make a booking request, interact with a Partner Offer or communicate with Sweet.

5.2 We may collect information automatically through the Sweet Platform, including through logs, cookies, software development kits, analytics technologies and similar technologies where used and permitted by applicable law.

5.3 We may receive relevant subscription or account information from Apple or Google where necessary to administer your subscription or use of the Sweet application.

5.4 We may receive limited information from employers or sponsoring organisations where your membership is provided as an employee benefit or where information is reasonably required to establish or confirm your eligibility.

5.5 We may receive information from Partners relating to booking requests, confirmations, cancellations, redemptions, No-Shows, misuse of an offer, complaints or other matters relevant to administering the Sweet membership service.

5.6 We may receive information from service providers that assist us with hosting, authentication, storage, communications, security, verification, customer support or other operational functions, and from publicly available or professional sources where reasonably necessary to verify information you have provided or your professional connection to the hospitality industry.

6.1 Providing and administering your membership. We process Identity, Contact, Account, Membership and relevant Professional Data to create and administer your account, provide membership services, maintain your membership and give you access to the Sweet Platform. Lawful basis: performance of our contract with you.

6.2 Verifying membership eligibility. We process Professional, Identity and Contact Data to establish and verify that you have a genuine professional connection to the hospitality or hospitality-related industry and to re-verify eligibility where appropriate. Lawful basis: performance of our contract and our legitimate interests in maintaining Sweet as a verified hospitality-professional membership community.

6.3 Providing Partner Offers and booking functionality. We process Membership, Partner, Booking and Contact Data to display relevant Partner Offers, enable booking requests or redemptions, communicate booking information and otherwise operate Sweet's Partner functionality. Lawful basis: performance of our contract with you and our legitimate interests in operating the Sweet membership platform.

6.4 Managing subscriptions. We process Membership and Subscription Data to identify whether you hold an active subscription and to enable, restrict or restore membership functionality accordingly. Lawful basis: performance of our contract with you. Apple or Google separately processes the underlying App Store or Google Play transaction under its own terms and privacy practices.

6.5 Employer-sponsored memberships. Where membership is provided through an employer or other sponsoring organisation, we may process Identity, Contact, Professional and Membership Data to activate, administer and verify eligibility for that membership. Lawful basis: performance of our contract with you and our legitimate interests in administering the relevant membership programme.

6.6 Preventing misuse, fraud and protecting Partners. We may process account, booking, membership, technical, communications and usage information to identify or investigate suspected account sharing, fraudulent activity, abuse of Partner Offers, repeated No-Shows, improper bookings, security incidents or other breaches of our Member Terms. Lawful basis: our legitimate interests in preventing fraud and misuse and protecting Sweet, its members and Partners.

6.7 Customer service and communications. We process your information to respond to questions, complaints, support requests, booking enquiries and other communications. Lawful basis: performance of our contract, our legitimate interests in providing customer support, and where applicable compliance with legal obligations.

6.8 Operating, securing and improving Sweet. We may analyse Technical and Usage Data to maintain the Sweet Platform, diagnose technical issues, understand how features are used, improve functionality, develop new features, protect our systems and improve the member experience. Lawful basis: our legitimate interests in operating, securing, developing and improving our business and services.

6.9 Marketing. Where permitted by law, we may use Contact, Membership and Preference Data to send you information about Sweet, new Partners, Partner Offers, events, membership benefits and other relevant Sweet services. Where consent is required, we will obtain it. You may opt out of marketing at any time. Opting out does not prevent necessary service communications.

6.10 Legal and regulatory purposes. We may process personal data where necessary to comply with applicable law, respond to lawful requests, establish or defend legal claims, enforce our agreements or protect our legal rights. Lawful basis: compliance with a legal obligation and/or our legitimate interests in protecting our legal rights.

7.1 We may share personal data where reasonably necessary with Partners to process a booking request, administer or verify a Partner Offer, address a booking issue or investigate misuse.

7.2 We may use service providers for cloud hosting, application infrastructure, authentication, secure storage, communications, analytics, customer support, security, fraud prevention and other technology or operational services. Our current technology infrastructure includes Google Firebase for backend functionality supporting the Sweet Platform. Service providers that process personal data on our behalf are subject to appropriate contractual and data protection requirements.

7.3 We may exchange relevant information with Apple or Google where necessary in connection with subscriptions, app distribution or related functionality.

7.4 We may share limited information with employers or sponsoring organisations in the circumstances described in Section 8.

7.5 We may share personal data with professional advisers, including lawyers, accountants, insurers and other advisers, where reasonably necessary.

7.6 We may disclose personal data to government, regulatory, judicial or law-enforcement bodies where disclosure is required or permitted by applicable law.

7.7 We may disclose relevant personal data in connection with a genuine proposed or completed sale, merger, financing, restructuring, investment or transfer of all or part of our business, subject to appropriate confidentiality and data protection safeguards.

7.8 Sweet does not sell your personal data.

8.1 Where your membership is provided through an employer or other sponsoring organisation, we may receive limited information from that organisation to establish, activate or administer your membership.

8.2 We may provide the sponsoring organisation with limited information reasonably necessary to administer the programme, such as whether an allocated membership has been activated or remains eligible.

8.3 We do not ordinarily provide employers with details of individual Partner Offers viewed, searches, personal booking activity, individual redemption history or other detailed information about how an employee uses Sweet, unless this is necessary for a specific purpose, you have been informed, or disclosure is otherwise required or permitted by law.

8.4 We may provide employers with aggregated or anonymised information concerning participation or use of a corporate membership programme where individuals are not identifiable from that information.

9.1 Sweet acts as a membership platform and facilitator of Partner Offers. The underlying hospitality service is generally provided directly by the relevant Partner.

9.2 Where you request, book or redeem a Partner Offer, we may provide the Partner with information reasonably necessary to administer that request or benefit.

9.3 Once a Partner receives personal data for the purpose of supplying its own hospitality service, the Partner may process that information independently in accordance with its own privacy policy and legal obligations.

9.4 Payment for the underlying hotel, restaurant or other Partner service is ordinarily made directly between you and the Partner. Sweet does not ordinarily receive or store the payment-card information you provide directly to a Partner.

10.1 The Sweet website and application may use cookies, software development kits, analytics tools and similar technologies to operate the service, maintain security, remember preferences, understand use of the Sweet Platform and improve our services.

10.2 Some technologies are necessary for the Sweet Platform to function. Others, including certain analytics, advertising or tracking technologies, will only be used where permitted by applicable law and, where required, after obtaining your consent.

10.3 Where required, you will be provided with appropriate cookie or tracking controls.

10.4 Further information may be provided in a separate Cookie Policy or through cookie-management tools made available on the Sweet website.

11.1 Some of our service providers may process personal data outside Ireland or the European Economic Area ("EEA").

11.2 Where personal data is transferred outside the EEA to a country that has not been recognised as providing an adequate level of data protection, we will use an appropriate lawful transfer mechanism where required, such as the European Commission's Standard Contractual Clauses, together with supplementary safeguards where appropriate.

11.3 You may contact us if you would like further information about the safeguards applicable to international transfers of your personal data.

12.1 We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

12.2 Access to personal data is restricted to employees, contractors and service providers who have an appropriate need to access it and who are subject to appropriate confidentiality obligations.

12.3 No internet, mobile application or electronic storage system can be guaranteed to be completely secure. Members are responsible for keeping their account credentials confidential and should notify us promptly if they suspect unauthorised use of their account.

12.4 We maintain procedures for responding to suspected personal data breaches and will notify affected individuals and/or the relevant supervisory authority where required by law.

13.1 We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including providing membership services and satisfying legal, accounting, tax, fraud-prevention, dispute-resolution and reporting requirements.

13.2 Different categories of information may therefore be retained for different periods.

13.3 In determining an appropriate retention period, we consider the nature and sensitivity of the information, the purposes for which it is processed, the risk of harm from unauthorised use or disclosure, applicable legal requirements and whether those purposes can be achieved by other means.

13.4 Where you request deletion of your account, we will delete or anonymise personal data associated with the account except to the extent that retention is necessary or permitted for legal, regulatory, fraud-prevention, security, dispute-resolution or other lawful purposes.

14.1 You may request deletion of your Sweet account and associated personal data through any account deletion functionality made available by Sweet or by contacting admin@sweethospitality.ie.

14.2 Account deletion is separate from cancellation of an Apple App Store or Google Play subscription. If you have an active paid subscription, you may need to cancel that subscription separately through the relevant platform to prevent future renewal charges.

14.3 Following a valid deletion request, we will delete or anonymise personal data associated with your account unless we are required or permitted to retain particular information for a lawful reason.

15.1 Subject to applicable law and any relevant exemptions, you may have the right to access your personal data; rectify inaccurate or incomplete personal data; erase your personal data in certain circumstances; restrict processing in certain circumstances; object to processing based on legitimate interests and to direct marketing; receive certain personal data in a structured, commonly used and machine-readable format or have it transmitted to another controller; and withdraw consent at any time where processing is based on consent.

15.2 These rights are not absolute and may be subject to conditions or exemptions under applicable law.

15.3 To exercise your rights, contact us at admin@sweethospitality.ie. We may request information reasonably necessary to verify your identity before acting on a request.

15.4 You will not ordinarily be required to pay a fee to exercise your rights. We may, however, charge a reasonable fee or refuse to act where permitted by law if a request is manifestly unfounded or excessive.

16.1 Sweet does not currently make decisions about members based solely on automated processing that produce legal effects or similarly significant effects on them.

16.2 We may use automated tools to assist with analytics, security, fraud detection or membership administration, but where applicable we will comply with the requirements of data protection law concerning automated decision-making.

16.3 If our use of automated decision-making materially changes, we will update this Privacy Policy and provide any additional information required by law.

17.1 We may communicate with you about Sweet membership, new Partners, Partner Offers, events and other Sweet services where permitted by applicable law.

17.2 Where consent is required for marketing, we will obtain it before sending the relevant communication.

17.3 You can opt out of marketing at any time by using the unsubscribe mechanism included in the communication, adjusting any available communication preferences or contacting admin@sweethospitality.ie.

17.4 Opting out of marketing does not prevent us from sending communications necessary to administer your account or membership, including booking, security, subscription or important service communications.

18.1 The Sweet Platform may contain links to Partner websites, booking systems or other third-party websites and services.

18.2 Sweet does not control the privacy practices of independent third parties. Where you leave the Sweet Platform or provide information directly to a Partner or other third party, you should review that party's privacy policy.

19.1 We may update this Privacy Policy from time to time to reflect changes to Sweet, our technology, our processing activities or applicable law.

19.2 The current version will be made available through the Sweet Platform and will identify its version and last updated date.

19.3 Where a change materially affects how we process your personal data, we will provide additional notice where required by law.

20.1 If you have a question about this Privacy Policy, our use of your personal data or wish to exercise a data protection right, please contact GCM Hospitality Limited, trading as Sweet Hospitality, company number 794742, Glennamuck Road, Carrickmines, Dublin 18, Ireland, D18 K5E9. Email: admin@sweethospitality.ie.

20.2 You also have the right to lodge a complaint with the Data Protection Commission, Ireland's supervisory authority for data protection. We would welcome the opportunity to address your concerns directly where appropriate.