Privacy Policy

The Edinburgh Address Ltd. customer privacy notice

This privacy notice tells you what to expect us to do with your personal information.

Contact details
What information we collect, use, and why
Lawful bases and data protection rights
Where we get personal information from
How long we keep information
Who we share information with
How to complain

Contact details

Email: This email address is being protected from spambots. You need JavaScript enabled to view it.

What information we collect, use, and why

We collect or use the following information to provide services.

Names and contact details
Addresses
Date of birth
Purchase or account history
Payment details (including card or bank information for transfers and direct debits)
Credit reference information
Account information
Information relating to loyalty programmes
Website user information (including user journeys and cookie tracking)
Photographs or video recordings
Call recordings
Records of meetings and decisions
Identification documents
Information relating to compliments or complaints

We also collect or use the following special category information to provide services. This information is subject to additional protection due to its sensitive nature:

We collect or use the following information for the operation of customer accounts and guarantees:

Names and contact details
Addresses
Payment details (including card or bank information for transfers and direct debits)
Purchase history
Account information, including registration details
Information used for security purposes
Marketing preferences

We also collect or use the following special category information for the operation of customer accounts and guarantees. This information is subject to additional protection due to its sensitive nature:

We collect or use the following information to prevent, detect, investigate or prosecute crimes:

Names and contact information
Customer or client accounts and records
Criminal offence data (including Disclosure Barring Service (DBS), Access NI or Disclosure Scotland checks)
Call recordings
Financial transaction information

We also collect or use the following special category information to prevent, detect, investigate or prosecute crimes. This information is subject to additional protection due to its sensitive nature:

We collect or use the following information for research or archiving purposes:

Names and contact details
Addresses
Location data
Call recordings
Purchase or viewing history
IP addresses
Website and app user journey information
Personal information used for administration of research
Personal information used for the purpose of research
Records of consent, where appropriate

We also collect or use the following special category information for research or archiving purposes. This information is subject to additional protection due to its sensitive nature:

We collect or use the following information to comply with legal requirements:

Name
Contact information
Identification documents
Financial transaction information
Criminal offence data (including Disclosure Barring Service (DBS), Access NI or Disclosure Scotland checks)
Any other personal information required to comply with legal obligations
Safeguarding information

We also collect or use the following special category information to comply with legal requirements. This information is subject to additional protection due to its sensitive nature:

We collect or use the following information for recruitment purposes:

Contact details (eg name, address, telephone number or personal email address)
Date of birth
National Insurance number
Copies of passports or other photo ID
Employment history (eg job application, employment references or secondary employment)
Education history (eg qualifications)
Right to work information
Details of any criminal convictions (eg Disclosure Barring Service (DBS), Access NI or Disclosure Scotland checks)

We also collect or use the following special category information for recruitment purposes. This information is subject to additional protection due to its sensitive nature:

We collect or use the following personal information for dealing with queries, complaints or claims:

Names and contact details
Address
Payment details
Account information
Purchase or service history
Call recordings
Witness statements and contact details
Relevant information from previous investigations
Customer or client accounts and records
Financial transaction information
Correspondence

We also collect the following special category information for dealing with queries, complaints or claims. This information is subject to additional protection due to its sensitive nature:

Lawful bases and data protection rights

Lawful bases and data protection rights

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.

Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:

Your right of access - You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. Read more about the right of access.
Your right to rectification - You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. Read more about the right to rectification.
Your right to erasure - You have the right to ask us to delete your personal information. Read more about the right to erasure.
Your right to restriction of processing - You have the right to ask us to limit how we can use your personal information. Read more about the right to restriction of processing.
Your right to object to processing - You have the right to object to the processing of your personal data. Read more about the right to object to processing.
Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you. Read more about the right to data portability.
Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time. Read more about the right to withdraw consent.

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

Our lawful bases for the collection and use of your data

Our lawful bases for collecting or using personal information to provide services and goods are:

Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.
Public task – we have to collect or use your information to carry out a task laid down in law, which the law intends to be performed by an organisation such as ours. All of your data protection rights may apply, except the right to erasure and the right to portability.

Our lawful bases for collecting or using personal information for the operation of customer accounts and guarantees are:

Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.
Public task – we must collect or use your information to carry out a task laid down in law, which the law intends to be performed by an organisation such as ours. All of your data protection rights may apply, except the right to erasure and the right to portability.

Our lawful bases for collecting or using personal information to prevent, detect, investigate or prosecute crimes are:

Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.
Public task – we have to collect or use your information to carry out a task laid down in law, which the law intends to be performed by an organisation such as ours. All of your data protection rights may apply, except the right to erasure and the right to portability.

Our lawful bases for collecting or using personal information for research or archiving purposes are:

Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.
Public task – we have to collect or use your information to carry out a task laid down in law, which the law intends to be performed by an organisation such as ours. All of your data protection rights may apply, except the right to erasure and the right to portability.

Our lawful bases for collecting or using personal information for legal requirements are:

Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.
Public task – we have to collect or use your information to carry out a task laid down in law, which the law intends to be performed by an organisation such as ours. All of your data protection rights may apply, except the right to erasure and the right to portability.

Our lawful bases for collecting or using personal information for recruitment purposes are:

Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.
Public task – we have to collect or use your information to carry out a task laid down in law, which the law intends to be performed by an organisation such as ours. All of your data protection rights may apply, except the right to erasure and the right to portability.

Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:

Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.
Public task – we have to collect or use your information to carry out a task laid down in law, which the law intends to be performed by an organisation such as ours. All of your data protection rights may apply, except the right to erasure and the right to portability.

Where we get personal information from

Directly from you
Publicly available sources
Market research organisations
Credit reference agencies
Providers of marketing lists and other personal information
Suppliers and service providers
Third parties:

How We Receive Your Information (Third-Party Bookings)

While you may book our services directly, we also receive your personal data via third-party Online Travel Agencies (OTAs) (including but not limited to Booking.com, Expedia, Marriott Bonvoy, Plumb Guide or Airbnb).

Our Relationship: For the purposes of data protection laws, The Edinburgh Address Ltd. and the OTA act as independent data controllers. This means the OTA is responsible for how they handle your data on their platform, and we are responsible for the data once it is transferred to us to fulfill your booking.

Data We Receive: The information shared with us typically includes your name, contact details, payment status, and any specific preferences or requirements related to your travel arrangements.

How We Use It: We process this information to manage your reservation, communicate with you regarding your stay/tour, and comply with our legal and accounting obligations.

Note: We encourage you to review the privacy policy of the OTA you used to understand how they initially collected and processed your information before sharing it with us.

For bookings made via an OTA, the platform may act as the Merchant of Record. In these cases, financial data is managed by the platform according to their own privacy standards, and we receive only the necessary booking and reconciliation data to fulfill your stay.

How long we keep information

We will retain your personal data 5 years after depart date with exception of your ID (see ID policy).

If we have collected your ID securely via Typeform Security at Typeform – Help Center or Google forms (with your consent) we keep your ID for 6 months after check out.

When assessing what retention period is appropriate for your personal data, we take into consideration:

the requirements of our business and the services provided;
any statutory or legal obligations;
the purposes for which we originally collected the personal data;
the lawful grounds on which we based our processing;
the types of personal data we have collected;
the amount and categories of your personal data; and
whether the purpose of the processing could reasonably be fulfilled by other means.

In some circumstances, we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

Truvi - Truvi | Privacy Policy Truvi retain data for 7 years at the time of writing – please refer to Truvi’s privacy policy

Who We Share Your Information With

Truvi - we may (through a trusted third party Truvi) collect identity verification information. At time of booking Truvi will directly ask the lead guest for images of their government issued ID (national ID card, passport or driving license, as permitted by applicable laws) and other authentication information, such as, proof of Address (such as complete copy of a utility statement/bill - i.e. water, gas, electric, TV licence, telephone or Council tax). ID verification offers full protection to home owners and guests by:

Verifying that a government-issued ID submitted by the guest is real Verifying the ID in question belongs to the user making the booking

Verifying that the guest is not under 25 of age Keeping the ID on record, which The Edinburgh Address has recourse to in instances of criminal damage or fraudulent activity

Please note that once you have booked, you will be contacted by Truvi/Know Your Guest directly to verify yourself and process a damage deposit payment or purchase a damage waiver. The damage deposit payment will incur a fee (varies per property – please refer to the listing description for more details). Truvi / Know Your Guest verification must be completed two weeks prior to check-in. Truvi / Know Your Guest do not accept American Express. Please note you should deal with Truvi / Know Your Guest on any disagreement or dispute.

Property Owners and Managers/Reservation Teams/Agency: As we act as an agent for the property owners in our portfolio, we share your name and booking details with the relevant owner or their designated property manager. This is for the performance of the contract—allowing them to prepare the home for your arrival, provide access, and ensure your stay meets our quality standards.

Maintenance and Housekeeping Teams: We may share your contact details with our trusted contractors (e.g., plumbers or cleaning teams) if a repair or specific service is required during your stay.

Third-Party Service Providers: This includes our identity verification partner (Truvi), payment processors, and our secure cloud-storage providers.

Our Commitment: We only share the minimum amount of data necessary for these parties to perform their specific tasks. We ensure that all our partners and property owners understand their obligations to keep your data secure and confidential.

Payment Processing & Financial Data Depending on the specific property booked, payments may be collected directly by The Edinburgh Address or by the Property Owner/Manager/Other Agency.

Where we collect payment: We use secure, PCI-DSS compliant third-party processors. We do not store full credit card numbers on our internal systems.

Where the Owner/Manager/Other Agency collects payment: To fulfill your booking, we will securely share your contact information with the Property Owner so they can facilitate payment. In these instances, the Owner acts as an independent data controller for the processing of your financial information.

Security Standards: We require all owners in our portfolio to handle your payment data in accordance with UK GDPR and PCI-DSS security standards. However, we recommend reviewing the individual Owner/Manager/Other Agency's payment terms provided at the time of the transaction.

How to complain

If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details at the top of this privacy notice.

If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.

The ICO’s address:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint

Last updated

04/03/2026

Marketing

We value our community of guests and property owners. To provide a tailored experience, we may use the information provided by previous and current guests, as well as property owners, to share curated updates regarding The Edinburgh Address.

What we share: Our communications include exclusive seasonal offers, the unveiling of new homes within our portfolio, and our bespoke newsletters.

Our approach to contact: We will only contact you for marketing purposes where you have provided your explicit consent or where we have a legitimate interest in providing updates to existing clients who have previously engaged our services.

Your Control & The Right to Object: You have the absolute right to stop us from contacting you for marketing purposes at any time. If you have previously consented to receive these communications, you may withdraw that consent or "opt out" instantly by following the ‘unsubscribe’ link found at the footer of our emails.

Alternatively, you may exercise your right to be removed from our mailing lists by contacting our team directly at This email address is being protected from spambots. You need JavaScript enabled to view it.

Marketing segment last updated 05/03/2026

Remarketing

This website uses the Google AdWords remarketing service to advertise on third party websites (including Google) to previous visitors to our site. It could mean that we advertise to previous visitors who haven’t completed a task on our site, for example using the contact form to make an enquiry or starting the process of making a booking. This could be in the form of an advertisement on the Google search results page, or a site in the Google Display Network. Third-party vendors, including Google, use cookies to serve ads based on someone’s past visits to the www.theedinburghaddress.com website. Of course, any data collected will be used in accordance with our own privacy policy and Google’s privacy policy.

You can set preferences for how Google advertises to you using the Google Ad Preferences page, and if you want to you can opt out of interest-based advertising entirely by cookie settings or permanently using a browser plugin.

Cookie Policy

Our website uses cookies and similar tracking technologies to improve your experience and to help us understand how our site is used.

What are cookies?

Cookies are small text files placed on your device when you visit a website. They are widely used to make websites work more efficiently and to provide information to website owners.

Cookies we use

Cookie / Provider	Purpose	Type	Duration
PHP Sessions	Used for website functionality, including user authentication and session management.	Essential	Session (deleted when you close your browser)
Stripe	Used for secure payment processing. We do not store your credit card details on our servers.	Essential	Session (deleted when you close your browser)
Google Maps	Used for displaying maps and location-based services.	Essential	Session (deleted when you close your browser)
Google Analytics	Tracks website traffic and user behaviour to help us improve our service.	Analytics	Up to 2 years
Google Ads	Measures advertising conversions to help us understand the effectiveness of our campaigns.	Advertising	90 days

Your cookie choices

When you first visit our website, we will ask for your consent before placing any non-essential cookies (analytics and advertising). You can withdraw or change your cookie preferences at any time by clicking the 'Cookie Settings' link in our website footer, or by adjusting your browser settings.

Please note that disabling certain cookies may affect the functionality of our website.

For more information about cookies and how to manage them, please visit www.allaboutcookies.org.

The Edinburgh Address Ltd. - Staff/Volunteers Privacy Notice

Registered name: The Edinburgh Address Ltd

We are the controller of your personal data. For more information on controllers and their responsibilities please see our guidance on data protection principles, definitions, and key terms.

This privacy notice tells you what to expect us to do with your personal information when you work for us.

Contact details

Email

This email address is being protected from spambots. You need JavaScript enabled to view it.

What information we collect and use, and why

Staff recruitment, administration and management

We collect or use the following personal information as part of staff recruitment, administration and management:

Contact details (eg name, address, telephone number or personal email address)
Date of birth
National Insurance number
Gender
Photographs (eg staff ID card)
Copies of passports or other photo ID
Copies of proof of address documents (eg bank statements or bills)
Marital status
Next of kin or emergency contact details
Employment history (eg job application, employment references or secondary employment)
Education history (eg qualifications)
Right to work information
Details of any criminal convictions (eg DBS checks)
Political, conflict of interest or gift declarations
Security clearance details (eg basic checks and higher security clearance)
Performance records (eg reviews, disciplinary records, complaints or disciplinary action)
Training history and development needs
Monitoring employees’ IT use
CCTV footage or other recordings

Salaries and pensions

We collect or use the following personal information as part of managing salaries and pensions:

Job role and employment contract (eg start and leave dates, salary, changes to employment contract or working patterns)
Time spent working (eg timesheets or clocking in and out)
Expense, overtime or other payments claimed
Leave (eg sick leave, holidays or special leave)
Maternity, paternity, shared parental and adoption leave and pay
Pension details
Bank account details
Payroll records
Tax status

Staff health and wellbeing

We collect or use the following personal information for managing staff health and wellbeing:

General health and wellbeing information

Sick leave forms or fit notes (eg Statement of Fitness for Work from a GP or hospital)

Accident at work records

Access needs or reasonable adjustments

Protected Characteristics (as defined by the Equality Act and s.75 of the Northern Ireland Act for the purpose of equal opportunities monitoring)

Lawful bases and data protection rights

Your right of access - You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. Read more about the right of access.
Your right to rectification - You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. Read more about the right to rectification.
Your right to erasure - You have the right to ask us to delete your personal information. Read more about the right to erasure.
Your right to restriction of processing - You have the right to ask us to limit how we can use your personal information. Read more about the right to restriction of processing.
Your right to object to processing - You have the right to object to the processing of your personal data. Read more about the right to object to processing.
Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you. Read more about the right to data portability.
Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time. Read more about the right to withdraw consent.

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

Our lawful bases for the collection and use of your data

Our lawful bases for collecting or using personal information as part of staff recruitment, administration and management are:

Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.
Public task – we have to collect or use your information to carry out a task laid down in law, which the law intends to be performed by an organisation such as ours. All of your data protection rights may apply, except the right to erasure and the right to portability.

Our lawful bases for collecting or using personal information as part of managing salaries and pensions are:

Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.

Public task – we have to collect or use your information to carry out a task laid down in law, which the law intends to be performed by an organisation such as ours. All of your data protection rights may apply, except the right to erasure and the right to portability.

Our lawful bases for collecting or using personal information as part of managing staff health and wellbeing are:

Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.
Public task – we have to collect or use your information to carry out a task laid down in law, which the law intends to be performed by an organisation such as ours. All of your data protection rights may apply, except the right to erasure and the right to portability.

Where we get personal information from

We collect your information from the following places:

Directly from you
Employment agency
Schools, colleges, universities or other education organisations
Referees (external or internal)
Security clearance providers
Occupational Health and other health providers
Pension administrators or government departments (eg HMRC and DWP)
Staff benefit providers
Public sources (eg LinkedIn or other websites)

How long we keep information

We keep personal records for 7 years after the employee leaves the company. This ensures compliance with legal, employment regulations, tax, HMRC and Data protection laws.

For more information on how long we store your personal information or the criteria we use to determine this please contact us using the details provided above.

Who we share information with

In some circumstances, we may share information with the following organisations:

HMRC
Employee benefit schemes
Health and benefit suppliers
External auditors
Suppliers and service providers
Professional consultants

Joint data controllers

We have a joint controller relationship with Value Add. We process your personal information with that joint controller for the following reason: We use ValueAdd Ltd. to process PAYE and Pensions.

How to complain