Privacy Policy

• Processing and managing booking enquiries and confirmed bookings
• Communicating with you about your booking, including status updates, invoices, and receipts
• Sending booking offers to suppliers and processing their responses
• Administering supplier accounts and managing payouts
• Complying with our legal obligations (safeguarding, financial record-keeping)
• Improving the platform and resolving disputes

We will never sell your personal data to third parties. We do not use your data for automated decision-making or profiling.

We only share personal data where necessary. The categories of recipients are:

• Assigned suppliers — we share your name and event details with the supplier assigned to your booking so they can prepare appropriately. We do not share your email or phone number without your consent.
• Supabase (database and file storage) — our platform data is hosted securely in EU-region Supabase infrastructure. Supabase processes data under a data processing agreement.
• Google Workspace — we use Google services for email (Gmail) and internal operations. Google processes data under Google’s GDPR-compliant terms.
• Cloudinary — supplier profile photos are stored via Cloudinary. Images marked as public are accessible on their CDN.
• Payment processors — when payment is accepted, your invoice details are processed securely. We do not store card numbers.

We do not transfer your data outside the UK/EEA except where service providers maintain appropriate safeguards (such as Standard Contractual Clauses or adequacy decisions).

• Booking records — retained for 7 years after the booking date for financial and legal compliance (Companies Act 2006, HMRC requirements)
• Supplier account data — retained while your account is active, plus 2 years after account closure
• Unsuccessful enquiries — deleted or anonymised after 12 months
• DBS status records — retained only as long as required by safeguarding obligations
• Marketing communications — we do not currently send marketing emails; if we introduce this, we will obtain your explicit consent first

You have the following rights regarding your personal data:

• Right of access — to receive a copy of the personal data we hold about you
• Right to rectification — to have inaccurate data corrected
• Right to erasure — to have your data deleted, subject to our legal retention obligations
• Right to restrict processing — to ask us to pause processing your data in certain circumstances
• Right to data portability — to receive your data in a structured, machine-readable format
• Right to object — to object to processing based on legitimate interests
• Rights related to automated decision-making — we do not use automated decision-making

To exercise any of these rights, email admin@temmykeys.com with the subject line “Data Rights Request”. We will respond within one calendar month.

If you believe we have handled your data incorrectly, you have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113. We would, however, appreciate the opportunity to address your concerns first.

We take the security of your personal data seriously. We use industry-standard measures including:

• Encrypted connections (HTTPS/TLS) for all data in transit
• Access controls limiting data access to authorised MWT staff only
• Secure cloud infrastructure with row-level security policies
• No storage of plaintext passwords or full payment card numbers

If you believe there has been a security incident affecting your data, contact us immediately at admin@temmykeys.com.