Kulturely Privacy Notice

KULTURELY LTD (company number 16877179), 124–128 City Road, London, England, EC1V 2NX, is the controller of personal information described here. Contact [email protected] for privacy enquiries. You may also complain to the UK Information Commissioner’s Office at ico.org.uk.

Information we use

We may use account and contact details; date of birth, tax identifiers and verification status where required for host eligibility or digital-platform reporting; profile, biography, language and voluntarily supplied cultural identity information; listing and media content; approximate and exact location data; accessibility or dietary information you choose to provide; booking, payment, payout, refund and tax-reporting records; messages, reviews and reports; device, security, log, cookie and analytics data; support communications; and records imported from the former Kulturely WordPress service.

We receive information from you, other booking participants, hosts, Stripe, sign-in providers, location services, fraud and safety tools, and the former Kulturely platform. If we obtain your information indirectly, we provide this notice no later than the first communication or the period required by law.

Why we use it and our lawful bases

• Contract: create accounts; provide search, booking, messaging and support; process payments, refunds and payouts; administer host plans and boosts.
• Legal obligation: accounting, tax and digital-platform reporting; regulatory requests; consumer, data-protection and applicable online-safety duties, including required preservation or reporting of detected illegal content.
• Legitimate interests: keep the marketplace secure; prevent fraud and off-platform payment; assess and moderate content; investigate reports and appeals; improve and measure the service; defend legal claims; and communicate essential service information. We balance these interests against your rights.
• Consent: optional marketing, non-essential cookies, and optional processing where consent is required. Cultural identity information may reveal ethnicity or another special category. Providing it is optional; when Kulturely relies on explicit consent, you can withdraw that consent, although public cultural claims already relied upon for an active listing may need to be removed or re-reviewed.
• Vital interests or legal claims: only where necessary for urgent safety or to establish, exercise or defend legal claims.

We do not sell personal information. Marketing consent is separate from accepting this notice, and every marketing message provides an opt-out.

Sharing and processors

We share only what is reasonably required with booking participants; Stripe for payments, Connect onboarding and fraud controls; IONOS for application, database, backup and infrastructure services; bunny.net for media storage and delivery; Google for location/autocomplete or sign-in where enabled; Brevo for transactional email; monitoring, support and consented analytics providers; professional advisers; insurers; and regulators, courts, law enforcement, the National Crime Agency, Ofcom or HMRC where required.

Hosts receive only the booking and guest information needed to deliver an experience. Exact private addresses are disclosed only at the appropriate booking stage and are not displayed publicly.

Some providers may process information outside the UK. We use an adequacy decision, the UK International Data Transfer Agreement/addendum, or another lawful safeguard as applicable. Provider details and transfer safeguards are available on request.

Retention

• Unbooked pre-booking conversations: 12 months after inactivity.
• Booking conversations: visible for 24 months after the booking ends, then restricted and encrypted until six years after the booking end.
• Reports, disputes and safety cases: six years after closure, or longer where a documented legal hold or applicable online-safety reporting and preservation rule requires it.
• User-deleted messages: 30-day recovery period, then deletion unless legally held.
• Financial, payout, tax and transaction records: six years, or longer if law requires.
• Account and listing records: while the account is active and then only as needed for legal, safety, fraud, tax, suppression or claims purposes.
• Security logs: a proportionate period based on risk; production schedules must document the exact period.
• Backups: deleted information ages out within 90 days under the backup cycle.

We keep a retention schedule and delete, anonymise or restrict information when the applicable period ends.

Cookies and analytics

Strictly necessary cookies support login, security, checkout and preferences. Non-essential analytics, advertising or personalisation cookies are disabled until valid consent is given. You can change your choices at any time. The cookie panel identifies each non-essential technology, provider, purpose and duration.

Ranking and profiling

Kulturely may personalise recommendations and rank experiences using location, preferences, availability and interaction signals. Paid promotion is labelled and remains subordinate to safety and eligibility. These processes do not make decisions with legal or similarly significant effects without meaningful human review where required.

Your rights

Depending on the circumstances, you may request access, correction, deletion, restriction, portability, or object to processing; withdraw consent; and ask for review of a significant automated decision. Direct-marketing objections are honoured. We may retain information where a lawful exemption, legal obligation, safety need or legal claim applies. Contact [email protected]. We normally respond within one month after verifying the request.

Security, children and changes

Kulturely uses access controls, encryption where implemented and appropriate, audit records, backups, monitoring and provider security controls proportionate to risk. No system is completely secure; report concerns promptly. Accounts and hosting are for adults aged 18 or over. An adult may book an experience that expressly permits accompanied children, but children must not create accounts or use Kulturely messaging. We assess whether children are likely to access the service and review that assessment when features or evidence change. We review this notice when processing or law changes and will notify users of material changes.