Privacy policy

This Privacy Policy explains how Centro Network Ltd ("Centro", "we", "us", "our") collects, uses and protects personal information when you:

visit our website at centro.network (the "Website");

use the Centro BackOffice, our administration application for property operators and their staff (the "BackOffice");

use the Centro app, the guest, resident and occupant application available at app.centro.network and on in-room devices (the "App"); and

interact with the servers, APIs, on-site gateways and integrations that power them (together with the BackOffice and the App, the "Platform").

Please read it alongside our Terms of Service.

1. Who we are

Centro Network Ltd is a company registered in Scotland (company number SC812035), with its registered office at 4 Lothian Bank, Eskbank, EH22 3AN, United Kingdom.

For any privacy question or to exercise your rights, contact us at [email protected].

2. Our role: controller or processor

Whether Centro is responsible for your personal information depends on how you interact with us.

When Centro is the controller

We decide how and why your personal information is used, and are responsible for it, when:

you browse the Website, fill in a contact, booking, calculator or newsletter form, or otherwise engage with our sales and marketing;

you are a customer, or a user of the BackOffice, and we manage your account, sign-in, security, contract, billing and support;

you have a Centro sign-in account for the App. When a Property adds you to a stay or you create an account, the Platform creates a sign-in account linked to your email address, which can be used at any Property that uses Centro. We are the controller of that sign-in account (your name, email address, sign-in method and the Properties it is linked to); and

we operate, secure and maintain the Platform itself, for example security logging and fraud prevention.

When Centro is a processor

Hotels, residential buildings, workplaces and other properties ("Properties") use the Platform to provide services to their guests, residents, tenants and staff. For information about your stay or tenancy and the services you use there, the Property is the controller and Centro processes the information on the Property's behalf and only on its instructions.

In that case:

the Property's own privacy notice explains how it uses your information, and you should contact the Property first to exercise your rights;

if you contact us instead, we will pass your request to the relevant Property and help them respond; and

we do not use information we process for a Property for our own purposes. We do not use guest or resident data for advertising, for AI training or for our own analytics.

3. Information we collect through the Website

Contact and enquiry details: name, email address, phone number, your message, and the solution or scenario you are interested in, when you use our contact, "Book a Call" or "Book a Working Session" forms.

Newsletter details: name, email address and the mailing lists you choose (for example our newsletter or Tony Talks).

Value calculator details: email address, the scenario and property profile you modelled, currency and language, when you download a value calculator report.

Technical and campaign information: when you submit a form, we also record your browser type, language, time zone, screen resolution, the page you were on, the referring page and campaign (UTM) tags.

Usage information: pages visited, device type and approximate location derived from your IP address, collected through the technologies described in section 7.

4. Information we process through the Platform

What we process depends on which Centro features a Property has enabled.

4.1 BackOffice users (Property staff and Centro staff)

Account details: name, email address, job title, profile picture, role and permissions, and the Properties you can access.

Sign-in details: your password (stored only in hashed form), email sign-in codes and links, and two-factor authentication settings. If you sign in with Apple, Google or Microsoft, we receive your name, email address and account identifier from that provider.

Security information: last sign-in, last password change, failed sign-in attempts, and your active sessions (device operating system, browser, IP address, approximate location and last activity).

Preferences: language, notification channels and dashboard settings.

Connected services: where your organisation connects Google, Microsoft, Stripe or an email provider to the Platform, we store the account email address and the access tokens or credentials needed to operate that connection. Sensitive credentials are stored encrypted.

Content you create: App layouts, templates, products, media and messages you create or upload. If you use our AI-assisted design tools, the text, website address and media-library images you submit are sent to our AI provider to generate layouts or image descriptions (see section 8). These tools are not used with guest or resident records.

4.2 Guests, residents and occupants

When a Property uses Centro, we may process the following information. Your sign-in account is covered by section 2; everything else here is processed on behalf of the Property.

Sign-in: name, email address and password (stored only in hashed form), one-time codes or sign-in links sent by email, and Apple or Google sign-in details. You may also access the App through a secure link or QR code issued by the Property for your stay, room or location.

Stay and reservation details: reservation and booking references, arrival and departure dates, room or unit, number of adults and children, and whether you are the booker or primary guest. Where the Property uses a property management system (for example Mews, Apaleo or Oracle Hospitality), we receive your first and last name, email address and, where available, date of birth and contact details from it.

Online check-in and identity documents: where the Property asks you to check in online (for example to meet guest registration laws), we collect your first and last name, email address, date of birth, identity document type, issue and expiry dates, and a photo or scan of your passport, national identity card or driving licence. Document-type recognition runs in your browser; the image is uploaded to the Platform and can be viewed by authorised Property staff to verify your identity. We do not use these images for biometric identification.

Digital keys and access: your door-access permissions, access PIN, digital keys, key cards and wallet passes (Apple Wallet or Google Wallet). To issue them, we share your name, email address and, where provided, mobile phone number with the Property's access-control and intercom providers (for example FlexiPass or 2N). We may receive notice when you use an entry point, for example to show a welcome message.

Room and building information: commands you send to control lighting, climate, blinds and scenes, and room status such as occupancy, motion or presence sensor state, door and lock state, "do not disturb" and "make up room". This information relates to a room but can be linked to your stay.

Orders, bookings and payments: items and services you order or book, bookings of rooms or spaces, the names and email addresses of people you invite, prices, taxes and order status. Payments are handled by Stripe on its secure checkout pages, so we do not receive or store your card details.

Messages, requests and reviews: messages you exchange with the Property and any files you attach, service requests with their descriptions and photos, and ratings and reviews you leave.

Consents and preferences: the terms and consent choices you accept, and your language.

Technical information: IP address, device operating system and browser, session information, device identifiers for in-room panels and kiosks, and request logs, used to deliver and secure the service.

4.3 In-room devices and on-site equipment

Centro gateways, touch panels, kiosks and connected building systems send us hardware identifiers, network addresses (IP and MAC addresses), host names, equipment status and logs. To manage building equipment, our gateways can discover devices on a Property's local network, which may occasionally include personal devices connected to the same network. We use this information only to operate and support the Property's equipment.

4.4 Information from connected third-party systems

A Property may connect third-party systems to the Platform, such as property management systems, calendars (Google or Microsoft), access-control systems, intercoms, audio-visual systems, payment providers and the Property's own authorised API integrations. We exchange information with those systems as configured by the Property, and only as needed to provide the features it has enabled.

5. How and why we use personal information

For each purpose, we set out the legal basis we rely on under UK and EU data protection law.

Responding to enquiries and arranging calls, demos and working sessions: our legitimate interests in responding to people interested in Centro, or steps you ask us to take before entering a contract.

Sending our newsletter and marketing emails: your consent, which you can withdraw at any time using the unsubscribe link or by contacting us.

Following up on value calculator reports with relevant information about Centro: our legitimate interests in developing our business. You can opt out at any time.

Providing, maintaining and supporting the Platform for our customers: performance of our contract with the customer.

Operating Centro sign-in accounts for BackOffice and App users: performance of our contract with you or your organisation, and our legitimate interests in providing secure access.

Managing customer accounts, invoicing and payments: performance of a contract and compliance with legal obligations.

Keeping the Website and Platform secure, preventing fraud and abuse, and troubleshooting: our legitimate interests in operating a safe and reliable service.

Understanding how visitors use the Website so we can improve it: your consent, for non-essential cookies.

Complying with the law, responding to lawful requests and enforcing our terms: compliance with legal obligations and our legitimate interests.

Providing guest, resident and occupant services on behalf of a Property (online check-in and identity document checks, digital keys and door access, room controls, orders, bookings, messaging and service requests): the Property decides the legal basis. This is typically performance of its contract with you, compliance with a legal obligation (such as guest registration laws for identity documents) or its legitimate interests. We act only on its documented instructions.

We do not use personal information for automated decision-making that has legal or similarly significant effects on you.

6. Who we share personal information with

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

We share personal information only with:

service providers (sub-processors) that host, operate and support our services on our behalf, under contracts that require them to protect it and use it only on our instructions (see section 8);

Properties you interact with through the App, and the third-party systems they have connected to the Platform, where needed to provide the service you requested;

professional advisers such as lawyers, accountants and auditors;

authorities, where required by law or to protect the rights, property or safety of Centro, our customers or others; and

a buyer or successor in the event of a merger, acquisition or sale of all or part of our business, subject to this Policy.

7. Cookies and similar technologies

Essential cookies and storage

These keep the Website, BackOffice and App working and do not require consent:

Website: remembers your cookie choice (centro:consent) and, for the current browser tab, the section of the site you started from.

BackOffice: sign-in session, security and sign-in flow cookies (next-auth.session-token, next-auth.csrf-token, next-auth.callback-url, next-auth.pkce.code_verifier) and your language (NEXT_LOCALE). The sign-in session lasts up to 24 hours.

BackOffice and App sign-in: a secure refreshToken cookie keeps you signed in for up to 30 days.

App: your browser's local storage (or your device's secure storage on mobile) holds your sign-in session, a random device identifier for in-room panels, and your language.

The BackOffice and App contain no analytics, advertising or tracking technologies.

Analytics on the Website (with your consent)

We use HubSpot to understand which pages visitors find useful. HubSpot tracking only loads after you click Accept on our cookie banner. HubSpot may set cookies such as __hstc, hubspotutk, __hssc and __hssrc.

We also use Vercel Web Analytics, which measures page views using anonymous, aggregated data and does not use cookies.

Embedded content

Some Website pages include videos from YouTube, which may set its own cookies when you play a video.

Your choices

You can change your choice at any time using the Cookie Preferences link in the Website footer, and you can block or delete cookies in your browser settings. Blocking essential cookies may stop the BackOffice or App from working.

8. Our service providers

We use the following categories of service providers. We can provide an up-to-date list on request.

Platform hosting: Hetzner Online GmbH (Germany). Servers, databases, file storage (including identity document images) and logs.

Logging and monitoring: Hetzner Online GmbH (Germany) . Application and security logs.

Website hosting and analytics: Hetzner Online GmbH (Germany). Website delivery and cookieless analytics.

Website content management: Hetzner Online GmbH (Germany). Website content and value calculator enquiries.

CRM, forms and Website analytics: HubSpot, Inc. (EU data centre; United States company). Enquiries, sales contacts and Website analytics (with consent).

Newsletter: MailBluster EU . Newsletter subscribers.

Email delivery: Amazon Web Services SES, or the email provider a Property chooses. Sign-in codes, password resets, invitations and notifications.

Payments: Stripe (Ireland and United States). Payment processing for Properties, on Stripe-hosted checkout pages.

Translation: DeepL SE (Germany). Translation of BackOffice templates and interface text.

Sign-in, calendars and wallet passes: Apple, Google and Microsoft. Sign in with Apple, Google and Microsoft; Google and Microsoft calendar connections; Apple Wallet (including Apple push notifications) and Google Wallet passes.

Content delivery: jsDelivr. Delivers the document-recognition software used during online check-in (receives your IP address).

Integrations a Property chooses to connect:

property management systems such as Mews, Apaleo and Oracle Hospitality;

access-control and intercom providers such as FlexiPass (Italy) and 2N;

building, audio-visual and signage systems such as Crestron, BrightSign and ChromeOS kiosks.

9. International transfers

Our Platform is hosted in Germany, in the European Economic Area. Centro is based in the United Kingdom, and some of our service providers are based in, or access data from, other countries, including the United States.

Where personal information is transferred out of the UK or EEA to a country without an adequacy decision, we use appropriate safeguards. These include the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, or the provider's certification under the EU–US Data Privacy Framework and its UK Extension. You can ask us for more information about these safeguards.

10. How long we keep personal information

We keep personal information only for as long as we need it for the purposes described in this Policy, and then delete or anonymise it.

System, security and application logs: 1 month.

Enquiries and sales leads: 2 years after last contact.

Newsletter subscriptions: until you unsubscribe, after which we keep a suppression record so we don't email you again.

Customer account and contract records: the term of the contract plus 6 years for legal and tax purposes.

BackOffice user accounts: until deactivated by the customer or the end of the contract.

Centro sign-in accounts for the App: until you ask us to delete the account, or after 24 months of inactivity.

Identity document images from online check-in: deleted 30 days after check-out unless the Property must keep them longer by law.

Other guest and resident data processed for a Property: as instructed by the Property, and deleted or returned at the end of our agreement with it.

11. How we protect personal information

We use technical and organisational measures appropriate to the risk, including:

encryption of data in transit;

hashed passwords and encrypted storage of sensitive credentials;

two-factor authentication and account lockout for BackOffice sign-in;

access controls based on the principle of least privilege, and separation of each customer's data;

certificate-based authentication for on-site gateways; and

monitoring, logging and regular updates to our systems.

No system is completely secure, but we work to protect your information and will notify you and the relevant authorities of a personal data breach where the law requires it.

12. Your rights

UK and EEA

Subject to certain conditions, you have the right to:

access the personal information we hold about you;

correct inaccurate or incomplete information;

erase your information;

restrict or object to our processing, including objecting at any time to direct marketing;

data portability; and

withdraw consent at any time, where we rely on consent. This does not affect processing already carried out.

United States

Depending on the state you live in (for example California, Colorado, Connecticut, Virginia or Utah), you may have the right to:

know what personal information we collect, use and disclose;

access, correct and delete it;

obtain a portable copy; and

opt out of the sale or sharing of personal information or its use for targeted advertising.

We do not sell or share personal information as those terms are defined in US state privacy laws, and we do not use sensitive personal information to infer characteristics about you. We will not discriminate against you for exercising your rights. You can use an authorised agent to submit a request on your behalf.

Other countries

If you live elsewhere, including Brazil, Canada, Australia or elsewhere in Latin America, you may have similar rights under local law. We will honour requests in line with the law that applies to you.

How to exercise your rights

Email [email protected], including if you want us to delete your Centro sign-in account. We may need to verify your identity before acting on a request. We aim to respond within one month, or within the period required by your local law. If your request concerns information we process for a Property, we will forward it to that Property.

13. Complaints

If you are unhappy with how we have handled your personal information, please contact us first so we can try to resolve it. You also have the right to complain to a data protection authority:

in the UK, the Information Commissioner's Office (ICO): ico.org.uk, 0303 123 1113;

in the EEA, the supervisory authority in the country where you live or work; or

elsewhere, your local data protection or consumer protection authority.

14. Children

Our Website and BackOffice are not intended for children under 16, and we do not knowingly collect personal information from children through them.

App accounts and online check-in are intended for adults. A Property may record the number of children in a booking and, where local registration laws require it, details of accompanying minors. That information is provided by the booking adult or the Property, and is processed on the Property's behalf and under its responsibility.

If you believe we hold a child's information without appropriate authorisation, contact us at [email protected] and we will work with the relevant Property to delete it.

15. Third-party links and integrations

The Website and Platform may link to, or connect with, third-party websites and services (for example a Property's own systems, payment pages, calendar services or wallet apps). Their own privacy policies apply, and we are not responsible for their practices.

16. Changes to this Policy

We may update this Policy from time to time. We will post the updated version on this page with a new "Last updated" date and, where changes are significant, tell you by other appropriate means.

17. Contact us

Centro Network Ltd

4 Lothian Bank, Eskbank, EH22 3AN, United Kingdom

Registered in Scotland, company number SC812035

Email: [email protected]