Privacy Policy: How We Use Your Data

Who we are

Data controller: OF Luxury International Ltd (trading as VIPListed), company no. 17307764, 66 Paul Street, London EC2A 4NA.

What data we collect

We collect personal data in these ways:

Analytics: We use Google Analytics 4 to understand how visitors use this site. This may involve the processing of your IP address and browser metadata. Analytics cookies are only set with your consent (via our cookie banner).
Booking and hospitality requests: When you use a request form on this site we collect what you enter: your name, WhatsApp number, optional email, the venue or event, date, group size (and its make-up for table bookings), budget, occasion and any notes, plus the page you sent it from. A copy is stored on our server and sent to our team by Telegram and email so we can act on it.
Newsletter: If you join our email list we collect your email address, any interests you tick and the page you signed up on. We use it only to send VIPListed news and offers, at most about once a month. Every email has an unsubscribe link, or email us and we will remove you.
Partner listings: When a venue, promoter or organiser applies through our partners form, we collect the business and contact details entered, and any photo uploaded.
WhatsApp messages: When you contact us via WhatsApp, your name, phone number, and message content are processed by Meta (WhatsApp) and seen by our team. We use this information only to respond to your enquiry and facilitate your booking.

Legal basis for processing

Analytics: Consent (UK GDPR Article 6(1)(a)) — analytics only loads if you press Accept on the cookie banner.
Newsletter: Consent (UK GDPR Article 6(1)(a)) — you choose to sign up and can unsubscribe at any time.
Requests and WhatsApp enquiries: Steps at your request before entering into a contract (UK GDPR Article 6(1)(b)) and legitimate interests (UK GDPR Article 6(1)(f)) — we have a legitimate interest in responding to booking enquiries you initiate.
Bookings you make: Performance of a contract (UK GDPR Article 6(1)(b)) — we need your details to arrange, confirm and deliver the booking.
Invoices and payment records: Legal obligation (UK GDPR Article 6(1)(c)) — tax and company law require us to keep them.
Payment disputes and legal claims: Legitimate interests (UK GDPR Article 6(1)(f)) — keeping the evidence of a booking so we can answer a chargeback, complaint or claim.

How long we keep data

WhatsApp conversations are kept for up to 24 months after our last message with you, then deleted from our WhatsApp Business account, unless they are needed for a booking record below. Meta keeps its own copy under its policies. Analytics data is kept for 14 months (Google Analytics’ retention setting).

Newsletter sign-ups are kept until you unsubscribe.

If you make a booking, the booking record, invoice and payment details are kept for 6 years after the end of the financial year in which the booking took place, as tax and company law require, then deleted. Card numbers are never stored by us.

Partner listing applications are kept for up to 24 months after we last dealt with the business, then deleted.

Request-form submissions are kept for up to 24 months so we can handle follow-ups, changes and complaints, then deleted. A pseudonymised (hashed) IP address is stored with each submission to prevent abuse; we do not store the IP address itself.

Third parties

Google Analytics (Google LLC): Web analytics. Google may process data in the USA. Google is certified under the EU-US Data Privacy Framework.
Meta (WhatsApp): Messaging platform. When you message us via WhatsApp, your data is subject to Meta's Privacy Policy and Terms of Service.
Partner promoters: Our vetted promoter partners who fulfil bookings. They are separate data controllers for booking fulfilment purposes.
Venues: Your name and group details are shared with the relevant venue's promoter team solely to confirm your booking.
Hospitality partners: For sport, music, festival and other VIP packages, the details needed to source and confirm your package (name, contact details, event, date and number of guests) are shared with our hospitality partners and the official provider of the package.
Telegram (Telegram Messenger Inc.) and our email provider: Used to deliver request notifications to our team. Data may be processed outside the UK under appropriate safeguards.
Hosting (Hostinger): Stores the website and request records.
Resend: Sends our newsletter and stores the subscriber list. Data may be processed in the United States.
Supabase: Stores help-chat records in the EU (Ireland).

Help chat

If you use the chat on this site, we ask for your name and email so we can answer you and reply by email if you leave. Your messages are answered by an AI assistant (Anthropic’s Claude, reached through OpenRouter; both process messages in the United States) and, if you ask for a person, by our team through Telegram or WhatsApp. Chat records are stored with Supabase in the EU (Ireland) and kept for 12 months, then deleted. Please don’t share passwords or card details in the chat. To see or delete your chat history, email hello@viplisted.com.

Transfers outside the UK

Some of the services above (Google, Meta, Telegram, Resend, OpenRouter and Anthropic) may process data outside the UK, mainly in the United States. Where they do, we rely on UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework for certified US companies, or on the provider’s standard contractual clauses with the UK International Data Transfer Addendum. Email us for more detail on a particular transfer.

Your rights

Under UK GDPR you have the right to: access your personal data; correct inaccurate data; request erasure; restrict processing; object to processing based on legitimate interests, and to any direct marketing at any time; receive the data you gave us in a portable format; withdraw consent at any time where we rely on it (this doesn’t affect processing already done); and lodge a complaint with the ICO (ico.org.uk).

To exercise any of these rights, email hello@viplisted.com.

Cookies

The only non-essential cookies we use are Google Analytics cookies, and they are set only if you press Accept on our cookie banner. They help us understand which pages are popular and how visitors move around the site. If you press Reject, or make no choice, Google Analytics is not loaded at all. You can change your mind at any time with the Cookie settings link at the bottom of every page; choosing Reject removes the analytics cookies.

We also keep a few small preferences in your browser’s local storage, not cookies: your cookie choice, light or dark theme, and whether you have seen our newsletter invitation. These never leave your device.

No other cookies are set by this website.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected in the "Last updated" date above, and if a change affects how we use data you have already given us, we will tell you before it applies.