Guest privacy notice

Last updated · 28 October 2026

Who is responsible

ANPM LTD, trading as Síor Collection, is the controller of this information. Our business address is 3 Denmark St Great, Rotunda, Dublin 1, D01 NV63. For privacy questions or requests, contact info@siorcollection.ie.

What we collect

We collect your name, email address, booking reference, stay dates, lead booker’s name, role within the booking, completed acknowledgement and drawn signature. The lead booker lists everyone staying. For children, this includes their age at arrival and the name of their parent or guardian. We may receive booking details from your lead booker or booking service before you complete your own form. Please share this notice with anyone whose details you provide.

We send a code to check access to your email address. The code expires after ten minutes; successful verification allows thirty minutes to complete the form. This confirms access to the address, not your legal identity.

The signed record contains your answers, signature, signing consent, submission time, verified email and verification time, plus the exact agreement and privacy-notice wording and versions. Record identifiers and integrity checks help us detect changes. We also record email-sending attempts, status, message identifiers and error categories. Acceptance by the email service does not prove delivery or that a message was read.

Temporary security records include your email address, protected verification-code and token values, attempt counts, and protected counters derived from email and IP addresses. The application does not retain raw IP addresses or browser fingerprints in signed agreements. Cloudflare separately processes connection and browser information to provide its hosting and security services.

Please do not include medical histories, payment-card details or identity documents in this form.

The registration portal also keeps the booking identifier, property identifier, stay dates, adult count and booking status, with invitation and synchronisation status where used. Booking details may be entered by the owner or supplied through our Lodgify integration. The integration does not retain payment details, door codes or private booking notes.

Why we use it

We use this information to organise your stay, maintain an accurate guest list, apply occupancy and facility age restrictions, supply your agreement copy, keep safety acknowledgements and deal with relevant queries, incidents or claims. Necessary technical records help us protect the service and prevent abusive submissions or email requests.

Where processing is necessary to perform our contract with you, we rely on contractual necessity. For guest administration and safety records outside that contractual relationship, service security and handling claims, we rely on our legitimate interests in operating the accommodation safely and maintaining appropriate records. We balance those interests against your rights, particularly for children. Where a specific law requires retention or disclosure, we rely on that legal obligation.

Signing does not enrol you in marketing. Consent to electronic signing is separate from our legal basis for processing personal information. This registration process does not make solely automated decisions with legal or similarly significant effects, such as cancelling a booking or withholding access to the house.

Who receives it

Access to the forms administration is currently restricted to the owner. Cleaners receive only the lead booker’s name from registration records, not individual signed agreements. The lead booker’s own agreement includes the guest list they provide; other guests cannot browse your individual agreement.

Cloudflare provides forms hosting, the D1 database and security services, including Turnstile. Google Workspace handles verification emails and signed PDF copies from info@siorcollection.ie. Google processes the recipient address, message, attachment and associated email information, and outgoing copies are held in our business mailbox. Your own email provider processes your copy under its arrangements with you.

Lodgify supports booking management and pre-arrival correspondence. Registration invitations are sent through the booking conversation and contain the stay dates and a private registration link. Lodgify and the relevant booking channel process this correspondence. The portal integration does not send individual signed agreements to Lodgify. See Lodgify’s processing terms. Squarespace hosts our main website and its copy of this notice. Where necessary, relevant records may also be shared with insurers, legal advisers, emergency services or public authorities.

Administrative files in our Google Drive safety folder are synchronised to our Synology storage. Access to these copies is controlled separately through our Drive and NAS permissions and limited to authorised people who need it for their work. The portal does not automatically export signed agreements into this folder; any guest records we save there are included in the sync. The Synology folder is also included in our remote backup to Thomas-Krenn storage. We may keep authorised working or recovery copies on company-managed devices.

Storage and international processing

Our forms database is configured within Cloudflare’s European Union jurisdiction. The signed information is stored in that database and used to generate the PDF; email copies are processed separately by Google Workspace. EU database storage does not mean all hosting, security, email or support processing stays within the EU.

Cloudflare and Google use international infrastructure. Their processing terms provide transfer safeguards, including Standard Contractual Clauses and applicable adequacy arrangements. See Cloudflare’s Data Processing Addendum and Google’s Cloud Data Processing Addendum. Contact us for information about the safeguards applicable to your information or a copy of them.

Administrative copies of signed agreements follow the six-year policy and any relevant preservation hold. Temporary database exports used for recovery are reviewed and removed within thirty days, or sooner when no longer needed, unless a documented preservation need applies. Copies in Drive, Synology and other company-managed locations are checked separately when applying the retention period or a deletion request. File synchronisation does not set a retention period. These checks are manual. Local Synology snapshots are retained for thirty days. Our remote backup uses a rotating limit of sixty versions, which can span several months; this is not a sixty-day expiry. Deleted files may also remain in the NAS recycle bin until separately removed during a retention review. Backup and deleted-item copies must therefore be addressed separately when applying a retention decision. Cloudflare’s recovery window does not determine the expiry of these separate copies.

Each booking has a private registration link for the lead booker to share with the adults in their party. It shows the booking reference and stay dates, limits the number of registrations and expires at the end of checkout day, Irish time. Anyone with the link may use a remaining place, so please share it only with your party. The link does not let guests view another person’s completed agreement.

How long we keep it

We keep the combined registration and signed-agreement record for six years after checkout. This includes the guest details within the agreement, signature and signing evidence. Relevant incidents, complaints, claims, legal obligations or insurer requirements may require a hold beyond that period. Held records are reviewed and retained only while the preservation need continues.

The forms system runs scheduled housekeeping every ten minutes to remove expired records without a hold. Temporary verification entries become eligible for removal after twenty-four hours, and expired abuse-prevention counters are cleared during housekeeping. The verified email and verification time remain part of a completed agreement. Accepted email-delivery jobs become eligible for removal thirty days after acceptance; delivery exceptions are reviewed by the owner, and resolved jobs become eligible for removal thirty days after resolution.

Copies of signed agreements in our mailbox and administrative exports are subject to the same six-year policy and relevant holds, but are managed separately from the application. Our retention policy for verification-code emails is thirty days from sending. The owner checks these messages weekly and removes those approaching the limit. This is a manual mailbox process; the portal’s send-only email permission cannot read or delete mail. These messages are separate from the signed agreement and its verification evidence.

Rotha, our internal administration system, is assigned responsibility for tracking retention reviews. The owner carries out the required manual mailbox and export checks and reviews preservation holds at least annually. ANPM LTD remains responsible for the processing. A review entry does not itself delete a message, document or backup.

We retain routine registration-service audit events for twelve months to investigate security issues and verify changes. These events contain record identifiers, event times, staff-action details and integrity checks, rather than guests’ answers or signatures. Expired events are removed during scheduled housekeeping. Audit events attached to an agreement under a preservation hold are kept while that hold applies. A minimal integrity checkpoint remains to verify the continuing audit history; it does not retain the deleted event details. Signing evidence within a completed agreement follows the separate six-year policy above.

Deleted database records may remain recoverable for up to a further thirty days in Cloudflare D1’s recovery history under our current paid hosting plan. This does not cover separately exported backups. Deleted Gmail messages ordinarily remain in Trash for a further thirty days unless permanently removed earlier. Email deletion also follows Google’s recovery and backend-deletion processes; its processing terms allow up to 180 days after a deletion instruction for data no longer recoverable by us, subject to legal exceptions. Copies in your own mailbox are under your control.

Temporary booking-link records, encrypted link copies and associated automated-invitation records become eligible for removal thirty days after checkout during scheduled housekeeping. This does not delete the booking or its conversation in Lodgify. Booking details within a signed agreement remain subject to the six-year policy.

Your choices and rights

Required fields help us administer your stay and record your acknowledgement. If you cannot provide a detail, cannot use email verification or prefer a paper agreement, contact us to discuss an alternative. Any implications for your booking depend on the terms already agreed and applicable law.

Depending on the circumstances, you may request access, correction, deletion, restriction or a portable copy of your information. You can also object to processing based on legitimate interests. These rights are subject to legal conditions and exceptions.

Contact info@siorcollection.ie to make a request. You may also complain to Ireland’s Data Protection Commission.

Security and visiting our websites

Cloudflare Turnstile processes connection and browser signals, including IP address, to distinguish visitors from automated abuse/bots. Cloudflare also acts as a separate controller when using those signals to improve its bot detection. Its Turnstile Privacy Addendum explains this processing.

The forms application contains no advertising, marketing analytics, session recording or email open/click tracking. Temporary signing tokens are held in the current page’s memory rather than an application cookie or persistent browser storage. Cloudflare may use necessary security cookies; see its Cookie Policy.

This notice covers guest registration and safety acknowledgements.
Our separate website privacy policy covers visits to the Síor website, including the website copy of this notice.