GECKO HOSPITALITY – WEBSITE PRIVACY NOTICE
Last updated: January 2024
1. Summary of how we use your data
- Gecko Hospitality UK Ltd (“Gecko Hospitality”, “we”, “us” or “our”) uses your personal data as a data controller for certain purposes including (depending on your relationship with us) to review applications of our potential franchisees (“Franchisees”), to connect Franchisees with our corporate clients (“Clients”), and to provide Clients with workers who apply directly through Gecko or Gecko’s Franchisees (“Candidates”). We may also use your personal data for purposes such as to communicate with you about our services, direct marketing, analytics, and the operation and management of this website (the “Site”) when you use the Site as a (“Website User”).
- In some scenarios we and our Franchisees (if you are a Business Contact, as described further below in Section 2), and certain social media providers, act as “joint controller” of your personal data, meaning we jointly determine the means and purposes of processing your personal data with these parties. Please see the Joint Controllership Statement below for more details.
- Personal data is shared with others including our Franchisees, other Gecko group companies and third party vendors. In some instances, personal data is transferred outside the UK/EEA, including to the US.
- Where we rely on your consent, such as, in some countries and in some circumstances, for direct marketing and for using non-essential cookies and similar online tracking technologies. You can withdraw this consent at any time.
- You also have other data protection rights including the right to object to some of the processing which we carry out.
2. What does this notice cover?
This notice describes how Gecko Hospitality will make use of your personal data processed in connection with the Site.
Please note if you are a Candidate applying through the Site to be considered as a job seeker, then the Candidate Privacy Notice is supplementary to this notice and covers how your personal data is processed by Gecko Hospitality as a data controller specifically in relation to your role as a Candidate. Please refer to the Candidate Privacy Notice rather than this document for details about our processing of your personal data as a Candidate.
If you are a:
- Business Contact (an individual working for one of our Clients, who functions as our main point of contact with the Client) – we will be the data controller of your personal data we process in connection with account creation and your interactions with us.
- Website User (an individual visiting the Site, whether or not you fall into any of the categories above) – we will be the data controller of certain of your personal data when you visit the Site, including if you enter your information in the Site to sign up for direct marketing from Gecko.
- Prospective Franchisee (an individual expressing an interest through the Site in running one of our franchises) - we will be the data controller of your personal data we process when we receive your expression of interest and your interactions with us on the Site. If we decide to take your expression of interest forward, we will provide you with a supplementary Franchisee Privacy Notice which will cover how we process your personal data in connection with any background checks we perform on your application and, if you are successful, to manage of our relationship during the franchise.
This notice also describes your data protection rights, including the right to object to some of the processing which Gecko Hospitality carries out. More information about your rights, and how to exercise them, is set out in the Your choices and rights section below.
3. JOINT CONTROLLERSHIP STATEMENT
3.1 Joint controllership with Franchisees
- We are a Franchisor and so have direct relationships with Franchisees.
- If you are a Business Contact, we and our Franchisees are “joint controllers” for the purposes of applicable data protection laws where we collect and manage your personal data, including your name and email address, for joint marketing campaigns which might be sent out by Franchisees but where we influence the content of the campaigns. This means that in those scenarios, we and the Franchisee are working together to make decisions about why and how your personal data is processed and we are jointly responsible under data protection laws for that processing. You should reach out to the contact details in the applicable Franchisee Privacy Notice (see below) if you want to exercise your data protection rights in respect of this processing.
- In other situations, we and our Franchisees make decisions about how and why we process your personal data separately from each other, and we are each “independent controllers” for this processing. This includes our processing of your personal data for the purposes of any direct contact we make with you.
- For a summary of our Franchisees’ processing, including the processing for which the Franchisees are each an independent controller, please consult their Privacy Notices.
3.2 Joint controllership with some social media companies
- We are also joint controllers where we collect and manage your personal data in the setup and management of certain social media fan pages. For example, where we operate our Facebook Fan Page, we are a Joint Controller with Meta Platforms, Inc..
- Where Franchisees also assist us with the setup and management of these social media pages, we will also be joint controllers with those Franchisees and the same points as mentioned above regarding our arrangements with Franchisees apply.
- You should contact Meta Platforms, Inc. if you wish to exercise your data protection rights in respect of our Facebook Fan Page. Further information, including how Meta Platforms, Inc. enables you to exercise your data protection rights, and subsequently processes your information as independent data controller can be found in Meta Platforms, Inc.’s Data Privacy Policy.
Where this Privacy Notice describes the processing described above for which we are joint controllers, “we” refers to both us and the relevant joint controller. It also describes the processing for which we are an independent controller. For more information about the joint controllership arrangements we have in place, please reach out to us directly through our contact details below.
4. Personal data we may collect about you
We collect and process personal data about you when you interact with us and our websites. This includes:
| Category | Details |
Types of users of our services
|
|---|---|---|
| Identification Information | Your name, employer (if relevant), username and password in connection with your account or expression of interest in a franchise | Business Contacts Prospective Franchisees |
| Job Opening Information | Information you tell us about relevant job openings including how you heard about us and your additional comments to help us fill the opening | Business Contacts |
| Job Search Information | Information input by you into our job search function in order to find a job opening, including the keywords, location (city), state, and country of interest to you. | Website Users using our job search function (if you apply through the Site as a Candidate, please see the separate Candidate Privacy Notice) |
| Contact Information | Your name and address (or business name and address, for Business Contacts), your email address and phone number | Business Contacts Prospective Franchisees Website Users who have signed up to be contacted by Gecko |
| Business and Chatbot Correspondence | The content of your correspondence with us in the course of enquiring about, and maintaining, our business relationship to the extent it includes personal data. This includes any customer support-related communications through our chatbot, and any logs we keep of these conversations | Business Contacts Prospective Franchisees Website Users who use our chatbot |
| Marketing Information | Your marketing preferences including any consents you have given us | Business Contacts Prospective Franchisees Website Users who have signed up to be contacted by Gecko |
| Site Use Information | Information about your use of Site including how many times you login into your account, when you connect to third party services, and other key events; and any inferences we draw from this information | Business Contacts Prospective Franchisees Website Users |
| Device Information | Technical information related to the browser or device you use to access our Site, including the type of device you use, a unique device identifier (for example, your device's IMEI number, the MAC address of the device's wireless network interface, or the mobile phone number used by the device), your IP address, your mobile network information, your operating system, the type of browser you use, and device time zone setting | Business Contacts Prospective Franchisees Website Users |
Some of the above personal data may be collected through cookies and other tracking technologies. For more information on our use of these technologies, see our Cookie Notice.
Sometimes, we receive information about you from third parties. In particular:
| Data category |
Details | Types of users of our services |
|---|---|---|
| Identification Information | Your name and employer. We may get this directly from your employer | Business Contacts |
| Contact Information | The name and address of your employer; your email address and phone number. We may get this directly from your employer | Business Contacts |
| Social Media Use Information | Information about your use of our social media pages We may get this from social media providers where we have pages, if you have an account with those providers |
Users of our social media pages |
| Publicly available information | We may obtain your name, job role and contact information from your company website, corporate directories or social media | Business Contacts |
5. How do we use this information, and what is the legal basis for this use?
We will only use your personal data for the purposes and legal bases set out below.
Sometimes cookies and other tracking technologies are placed on our Site to process personal data for the below purposes. Please see our Cookie Notice for more details.
There are instances where we have a legitimate interest to use your data. Our legitimate interest will vary depending on what we are using your data for, and we explain above what the interest is and how it relates to the processing operations that we are carrying out. For further information on this, please reach out to the contact details below.
| Purpose | Legal Basis | Types of users of our services |
|---|---|---|
| Account Creation & Maintenance – We will collect, use and store your Identification Information and Contact Information to enable you to register and create an account, or a Franchise application, with us. | It is necessary for us to process your personal data in order to perform our contract with you, or to take steps at your request prior to entering into a contract with you Where you are a Business Contact and the relevant contract is with your employer rather than us, processing this data is in our legitimate interest of managing our legal contract with your employer |
Business Contacts |
| Identity Verification – We collect and use your Identification Information to verify your identity each time you log in to your business account. | We have a legitimate interest in ensuring the security of our services and data | Business Contacts |
| Responding to your Job Opening – We collect, use and store your Identification Information, Contact Information and Job Opening Information in order to appropriately respond to your request to fill a job opening, including by passing on this information to Franchisees to assist where required. | Where you are a Business Contact and the relevant contract is with your employer rather than us, processing this data is in our legitimate interest of managing our legal contract with your employer and providing services to them as our Clients. | Business Contacts |
| Displaying the Results of your Job Search – We collect, use your Job Search Information in order to show you job openings which are most relevant to your search, and to enable you to make similar searches more easily in the future. | We have a legitimate interest in ensuring we appropriately fill the job openings requested by our Clients by presenting you with job search results which are the most relevant to you. | Website Users using our job search function (if you apply through the Site as a Candidate, please see the separate Candidate Privacy Notice) |
| Business Communications (including through our chatbot) – We will collect and use your Identification Information, Contact Information, and Business and Chatbot Correspondence to communicate with you in connection with the provision of our services, to respond to enquiries about running a franchise with us, the management of our relationship, and to provide you with customer support. We will also store the Identification Information and Contact Information you submit via the chatbot so that we can get back in touch with you if needed. All responses through our chatbot will be automated. | We have a legitimate interest in managing our business with our Franchisees and facilitating the provision of services to our Clients. | Business Contacts Prospective Franchisees Website Users who use our chatbot |
| Fraud and Security Monitoring – We will use, collect and store your Site Use Information and Device Information to monitor, investigate, prevent and detect fraud, security incidents or other misuse of the Site and our services, in accordance with applicable law. | We have a legitimate interest in preventing and detecting fraud or other wrongdoing, for example which may cause us or other parties loss or injury, or which may constitute criminal acts. | Business Contacts Prospective Franchisees Website Users |
| Direct marketing - We will collect, analyse, use and store your Identification Information and Contact Information to send you direct marketing tailored to your interests via email, text, and telephone in relation to our products and services, or other products and services provided by our Franchisees or our affiliates (including our parent company). Where we conduct joint campaigns with our Franchisees we will be joint controllers in respect of the data processed as described in the Joint Controllership Statement above | Your consent |
Business Contacts Prospective Franchisees Website Users who have signed up to be contacted by Gecko |
| Analytics to maintain and improve our Site and our social media pages - We will collect analyse and store your Site Use Information and Device Information in order to manage and operate our Site, including to keep it updated and relevant, to develop our business and to inform our marketing strategy. If you visit our social media pages we will also analyse your Social Media Information and Device Information to review information about, and improve the performance of, our page. We will be joint controllers with relevant social media providers when we do this as described in the Joint Controllership Statement above | Your consent. Where we are relying on consent as our legal basis, we will not process your personal data for the relevant purposes if you have refused or withdrawn your consent. Where we are not relying on consent as our legal basis, we have a legitimate interest in operating our Site and social media pages and improving their operation. Where we carry out analytics to improve our site and our social media pages through the use of cookies and other tracking technologies, we only do this when we have your consent. Please see our Cookie Notice for more details. |
Business Contacts Prospective Franchisees Website Users |
| Compliance with our Legal Obligations – We will collect, use and store your Identification Information, Contact Information and Business Correspondence to complete our financial reporting and disclosure obligations to our parent company, as well as applicable tax agencies, regulators and law enforcement authorities. | We have various legal obligations under corporate, tax, financial and other legislation in various jurisdictions; complying with such obligations may require us to process your personal data. | Business Contacts |
6. How we share your personal data
We may share your personal data with the following categories of recipients:
| Category of Recipient | Why we share data and legal basis for sharing | Relevant Group(s) |
|---|---|---|
| Franchisees | Gecko passes on certain Identity Information, Contact Information and Job Opening Information of Business Contacts to Franchisees as they have the direct relationships with Candidates. This allows the Franchisee to provide workers to the Clients through connections with the Business Contacts, and to send out marketing campaigns. Where we conduct joint campaigns with our Franchisees we will be joint controllers in respect of the data processed as described in the Joint Controllership Statement above. Legal basis: We have a legitimate interest in managing our business with our Franchisees and facilitating the provision of services to our Clients, |
Business Contacts |
| Other Gecko group companies (including our parent company) | To operate, improve, and develop our services, to operate our business, to communicate with you and/or with you on behalf of the relevant Client and/or to meet our compliance obligations under applicable law. We also share certain Identity Information and Contact Information with our group companies (including our parent company) for them to send their own marketing campaigns as described above. Legal basis: We have a legitimate interest in managing our business with our Franchisees and facilitating the provision of services to our Clients. We also have various legal obligations under corporate, tax, financial and other legislation in various jurisdictions; complying with such obligations may require us to process your personal data. See also information above in Section 5 in relation to the legal basis for our direct marketing activities. |
Business Contacts Prospective Franchisees Website Users |
| Third Party service providers | We employ other companies and individuals to perform functions for us or on our behalf. Examples include social media companies, providers who help us place and target advertising, and providers who conduct Site hosting and maintenance, customer service operations, identity checking, sending postal mail and text/email, processing payments and providing customer service. Legal basis: We have a legitimate interest in operating our business and in engaging third parties to provide us with services that will enable the operation of our business. |
Business Contacts Prospective Franchisees Website Users |
| Law enforcement and fraud prevention agencies | To prevent and detect fraud, security incidents and other misuse of our services, in accordance with applicable law; and where we are under a legal duty to disclose or share your personal data in order to comply with any legal or regulatory obligation or request. Legal basis: See information above in relation to Compliance with Our Legal Obligations and Fraud and Security Monitoring. |
Business Contacts Prospective Franchisees Website Users |
| Prospective Buyer/Seller | In the event that the business is sold or integrated with another business, your details will be disclosed to our advisers and any prospective purchaser’s adviser and will be passed to the new owners of the business. Legal basis: We have a legitimate interest in carrying out the sale of our business or any part(s) of our business and/or in acquiring or merging any part(s) of our business with another business. |
Business Contacts Prospective Franchisees Website Users |
7. Where we transfer your personal data
If you are based in the UK or Ireland, the personal data we process is typically stored within the UK or the EU.
Personal data that we collect from you may be transferred to and stored at a destination outside the UK/European Economic Area (“EEA”).
Where we transfer personal data from the EEA to the UK, we rely on the decision of the European Commission, which has confirmed the UK provides an adequate level of protection for personal data (an “adequacy decision”). You can view this adequacy decision here.
Due to the global nature of our business, your personal data may be disclosed to Group Companies outside of the UK/EEA including, in particular, to the United States. Where these locations do not provide an adequate level of data protection, we ensure appropriate safeguards are in place to protect the transfer of your personal data to these countries.
In the majority of cases, we will rely on data transfer mechanisms (e.g. the EU’s Standard Contractual Clauses (“EU SCCs”), UK International Data Transfer Agreement (IDTA) and/or the UK addendum to the EU SCCs). A copy of the relevant mechanism can be obtained for review on request by getting in touch with our contact details below.
8. Your choices and rights
You have the right to object to the processing of your personal data in certain circumstances, as described in more detail below.
You also have the following rights:
| Right | Summary |
|---|---|
| The right of access |
Enables you to receive a copy of your personal data |
| The right to rectification | Enables you to correct any inaccurate or incomplete personal data we hold about you |
| The right to erasure |
Enables you to ask us to delete your personal data in certain circumstances |
| The right to restrict processing | Enables you to ask us to restrict the processing of your personal data in certain circumstances |
| The right to object |
Enables you to object to us processing your personal data on the basis of our legitimate interests (or those of a third party), including processing for direct marketing purposes or profiling for purposes of direct marketing, or where we are performing a task in the public interest - your objection will be upheld, and we will cease processing your personal data, unless the processing is based on compelling legitimate grounds or is needed for the exercise or defence of legal claims that may be brought by or against us. |
| The right to data portability | Enables you to request us to transmit personal data that you have provided to us, to a third party without hindrance, or to give you a copy of it so that you can transmit it to a third party, where technically feasible |
These rights may be limited, for example if fulfilling your request would reveal personal data about another person, or if you ask us to delete information which we are required by law or have compelling legitimate interests to keep.
We do not carry out any solely automated decision-making processes.
If you wish to exercise any of these rights, please contact us at the contact details set out below. If you have unresolved concerns, you have the right to complain to a data protection authority in the country that you reside in or, the country of your place of work or the country where the alleged infringement took place. In the UK, this will be the Information Commissioner, the contact details for which can be found here. In Ireland, this will be the Data Protection Commission, the contact details for which can be found at How to contact us | Data Protection Commission. For all other EU/ EEA jurisdictions, a full list of data protection authority contact details can be found here.
Wherever we rely on your consent, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. If you want to withdraw your consent to our processing of personal data collected via cookies and other tracking technologies, you can do so through our . For more information see our Cookie notice.
You have a right to opt-out of direct marketing, or profiling we carry out for direct marketing, at any time. You can do this by following the instructions in any direct marketing communication you receive from us where this is an electronic message, or using the contact details set out below.
9. Will provision of your personal data be mandatory?
For processing related to Account Creation & Maintenance, Identity Verification, Business Communications, Fraud and Security Monitoring or Compliance with our Legal Obligations, as all described in Section 5, the provision of certain information is mandatory: if relevant data is not provided, then we may not be able to provide you with access to or use of the relevant sections of the Site, or respond to your application for a job opening to be processed or to start a franchise with us. The provision of all other information is optional.
10. How long we retain your personal data
We retain your personal data for no longer than is necessary for the purposes for which it is processed, and more particularly:
- Where we process personal data for Account Creation & Maintenance purposes as described above in Section 5, we do this for as long as you are an active user of our Site and for 6 years after this.
- Where we process personal data for Direct Marketing purposes as described above in Section 5, we process the data until you ask us to stop and for a short period of 30 days after this (to allow us to implement your requests). We also keep a record of the fact that you have asked us not to send you direct marketing or to process your data on an indefinite basis so that we can respect your request in future.
- Where we process personal data for Analytics purposes (to improve our services) as described above in Section 5, we retain it for 3-6 months.
- Where we process personal data for Business Communications purposes as described above at Section 5,including any Business and Chatbot Correspondence logs, we retain it for 3-6 months.
- Where we process personal data for Fraud and Security Monitoring purposes, as described above at Section 5, we retain it for 3-6 months.
- Where we collect personal data through cookies or other tracking technologies, we retain it for 3-6 months. For more information see our Cookie Notice.
- Where we process personal data in connection Responding to your Job Opening or otherwise in connection with provision of services to a Client who is your employer, we keep the data for 7 years from your last interaction with us.
- Where you have searched for a job opening using our job search functionality, we do not retain your Job Search Information for longer than your browser session.
11. Updates to this Privacy Notice
We reserve the right to update this Privacy Notice at any time, and we will provide you with a new Privacy Notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal data.
12. Contact us
If you have questions about this Privacy Notice or wish to contact us for any reason in relation to our personal data processing, please contact us at privacy@geckohospitality.com.
To comply with the General Data Protection Regulation (2016/679) we have appointed a European representative. If you wish to contact them, their details are as follows:
Bird & Bird GDPR Representative Services SRL
Avenue Louise 235
1050 Bruxelles
Belgium