Policies and notices.

Privacy notice

How we use personal information

Grhum Ltd · Version 1.0 · Effective 15 September 2026 · Reviewed annually

1. Who we are

Grhum Ltd ("Grhum", "we", "us") is a company registered in England and Wales under company number 15105703, with its registered office at 3 Sussex House, Stratton Close, Edgware HA8 6PY. We are the controller of the personal information described in this notice for the purposes of the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018. We are registered with the Information Commissioner's Office ("ICO") under registration number ZB841597. Questions about this notice, or requests to exercise your rights, should be sent to info@grhum.co.uk, or by post to the registered office marked "Data protection".

2. Who this notice covers

This notice applies to: (a) clients and prospective clients — the individuals at insurers, loss adjusters, housing providers, local authorities, employers, NHS bodies, staff banks, agencies, productions and other organisations who instruct us or enquire about our services; (b) guests — the people placed into accommodation we arrange, including policyholders, tenants, assignees, crew, clinicians and their households; (c) suppliers and partners — landlords, operators, property managers, referral partners and service partners; (d) website visitors; and (e) job applicants. Where we act on the instructions of a client (for example an insurer that tells us whom to house), we and the client may each be a controller of the guest's information for our respective purposes; we do not act as the client's processor unless a written agreement says so.

3. Information we collect

Clients and suppliers: name, job title, organisation, work contact details, correspondence, instructions and booking history, invoicing and payment details, bank account details for suppliers, and property compliance documentation (gas safety, electrical, fire risk and insurance certificates) which may identify the landlord.

Guests: name, contact details, household composition (including the number and ages of children), the reason for the placement (for example a fire, flood or escape of water at the home address), the address of the property affected, the school, workplace or hospital the placement must be near, vehicle and parking needs, pets, arrival and departure dates, and check-in, welfare-call and support records. Where a guest or a client tells us about accessibility, mobility, care or medical needs so that we can find suitable accommodation, that information may be special category data (health data) under Article 9 UK GDPR; section 5 explains the basis on which we handle it.

Website visitors: the information described in the Cookie policy, form submissions, and technical data such as IP address, browser type and pages viewed.

Job applicants: CV, covering message, contact details, right-to-work information and interview notes.

We do not knowingly collect information from children other than as members of a household being placed, and then only what is needed to house the household suitably (for example the number of bedrooms and the school catchment).

4. Where the information comes from

Most of it comes directly from you, by email, telephone, WhatsApp, our forms or our portals. Guest information usually comes from the instructing client — an insurer, claims handler, loss adjuster, housing officer, employer or production coordinator — and is then confirmed with the guest. Supplier information comes from the landlord or operator and from public registers (Companies House, the Land Registry, local authority licensing registers) and certification bodies.

5. Why we use it and our lawful bases

Purpose	Lawful basis (Article 6 UK GDPR)
Taking a brief, sourcing and contracting accommodation, arranging check-in, housekeeping, welfare calls, guest support, extensions and check-out	Performance of a contract with the client or guest, or steps taken at their request before entering into one (Art. 6(1)(b)); and our legitimate interests in running a placement service properly (Art. 6(1)(f))
Invoicing, credit control, payment of suppliers, accounting and tax	Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) including the Companies Act 2006 and HMRC record-keeping rules
Holding property compliance documentation and evidencing duty of care to clients	Legal obligation and legitimate interests — the safety of guests and the contractual assurance clients require
Recording accessibility, care or medical needs to find suitable accommodation	Art. 6(1)(b) or (f) together with an Article 9 condition: your explicit consent (Art. 9(2)(a)), which you may withdraw at any time; or, where the placement follows an emergency and consent cannot practicably be obtained in time, protection of vital interests (Art. 9(2)(c)), after which we will seek consent
Responding to enquiries and sending service messages about a booking	Contract; legitimate interests
Marketing to business contacts about our services	Legitimate interests (business-to-business marketing), with an opt-out in every message; consent where the Privacy and Electronic Communications Regulations 2003 require it
Preventing fraud, resolving disputes, complaints and legal claims, and complying with insurer, framework and public-sector requirements	Legitimate interests; legal obligation; establishment, exercise or defence of legal claims (Art. 9(2)(f) for any special category data)
Improving the website and our services, and security monitoring	Legitimate interests; consent for non-essential cookies (see Cookie policy)
Recruitment	Steps prior to a contract of employment; legal obligation (right-to-work checks); legitimate interests

Where we rely on legitimate interests we have balanced those interests against your rights and freedoms and concluded that our processing is proportionate. You may object to any processing based on legitimate interests (section 10).

6. Who we share it with

We share personal information only where necessary and only with: (a) the landlords, operators and property managers of the accommodation we place a guest into, limited to what they need to host the guest safely (name, party size, dates, vehicle, pets and any access requirement); (b) the instructing client, to whom we report on the placement, its cost and any welfare matters; (c) service partners such as housekeeping, key-holding, removals and storage companies, again limited to what the task requires; (d) Grhum Travel Solutions and hotel suppliers, where a hotel night is booked to bridge an emergency; (e) our IT, hosting, telephony, messaging (including WhatsApp Business) and payment providers, who act on our documented instructions as processors; (f) our professional advisers, insurers and auditors; (g) regulators, courts and law enforcement where the law requires or permits; and (h) a purchaser or successor of our business, in which event this notice would continue to apply. We do not sell personal information.

7. International transfers

Our systems are hosted in the United Kingdom and the European Economic Area. Some providers (for example Meta for WhatsApp Business, Google for analytics, translation and fonts, and Microsoft for Clarity) may process information in the United States or elsewhere. Where information leaves the UK we rely on the UK Extension to the EU–US Data Privacy Framework, an adequacy regulation made under the Data Protection Act 2018, or the International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, with a transfer risk assessment on file. Guests placed in the Republic of Ireland are hosted by Irish operators; that transfer is covered by the UK's adequacy regulations for the EEA. A copy of the relevant safeguard can be requested from info@grhum.co.uk.

8. How long we keep it

Booking, placement and invoicing records: seven years from the end of the financial year in which the stay ended, to meet tax and limitation-period requirements. Welfare and incident records: seven years, or longer where a claim is notified. Property compliance documentation: for the life of our agreement with the supplier and seven years after. Enquiries that do not become bookings: twelve months. Marketing contact details: until you opt out, and reviewed every twenty-four months. Recruitment files for unsuccessful candidates: six months after the decision unless you ask us to keep your details for future roles. Website logs: up to twelve months. Special category data is deleted as soon as the placement it relates to has ended and no claim, complaint or welfare obligation remains, unless one of the longer periods above applies to the record it sits in, in which case it is minimised.

9. Security

We hold Cyber Essentials certification and are working towards Cyber Essentials Plus and ISO 9001. Access to our CRM is role-based and logged, data is encrypted in transit and at rest, and staff receive data protection training on joining and annually. If a personal data breach occurs that is likely to result in a risk to you, we will notify the ICO within 72 hours and inform you without undue delay where the law requires.

10. Your rights

You have the right to: access the personal information we hold about you; have it rectified if inaccurate; have it erased in certain circumstances; restrict its processing; object to processing based on legitimate interests or for direct marketing (an objection to direct marketing is always upheld); receive a copy of information you provided to us in a portable format; and withdraw consent at any time where consent is the basis we rely on, without affecting the lawfulness of processing before withdrawal. We do not make decisions about you by solely automated means that have legal or similarly significant effects. To exercise any right, email info@grhum.co.uk. We respond within one month, extendable by two further months for complex requests, and do not charge a fee unless a request is manifestly unfounded or excessive. We may ask you to verify your identity first.

11. Complaints

If you are unhappy with how we have handled your information, please tell us first so that we can put it right. You also have the right to lodge a complaint with the Information Commissioner's Office at ico.org.uk, Wycliffe House, Water Lane, Wilmslow SK9 5AF, telephone 0303 123 1113. Guests resident in the Republic of Ireland may also complain to the Data Protection Commission.

12. Changes

We review this notice at least annually and whenever our processing changes materially. The version and effective date appear at the top. Material changes affecting guests or clients with live bookings will be notified directly.

Cookie policy

Cookies and similar technologies

Grhum Ltd · Version 1.0 · Effective 15 September 2026

1. What this policy covers

Cookies are small text files placed on your device by a website. This policy also covers similar technologies — local storage, pixels and third-party scripts — that the Site uses. It is issued under regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR") and should be read with our Privacy notice.

2. Strictly necessary

These are required for the Site to work and do not need your consent. They include: the browser's local storage used to remember display preferences you choose on this Site (type pairing, colour scheme and interface language) and a draft brief you have started but not sent; session identifiers for the client, supplier, employee and guest portals; and security cookies that protect forms and sign-in from abuse. They hold no advertising identifiers and are not shared.

3. Functional

Set only when you use the feature: Google Translate sets a googtrans cookie recording your chosen language when you translate the Site, and loads Google's translation script; map tiles from CARTO and OpenStreetMap are requested when a map is displayed, which discloses your IP address to those providers; Google Fonts are requested when a page loads, which likewise discloses your IP address to Google. Choosing English again removes the translation cookie.

4. Analytics (consent required)

With your consent we use Google Tag Manager, Google Analytics 4 and Microsoft Clarity to understand how the Site is used — pages viewed, journeys, scroll depth, and anonymised session recordings in the case of Clarity. IP addresses are truncated or masked, Google Signals and advertising features are disabled, and no analytics tag fires until you accept via the cookie banner. Google Analytics cookies (_ga, _ga_*) persist for up to 13 months; Clarity cookies (_clck, _clsk) for up to 12 months. You can withdraw consent at any time from the "Cookie settings" link in the footer, which resets the banner.

5. Marketing

The Site does not currently set advertising or retargeting cookies. If that changes we will update this policy and ask for your consent first.

6. Managing cookies

You can block or delete cookies through your browser settings; the strictly necessary items above will then be re-created as needed and some features (portals, saved preferences) may not work. Instructions for common browsers are available at aboutcookies.org.uk. Google's opt-out add-on is available at tools.google.com/dlpage/gaoptout.

7. Third-party sites

grhum.com and the social, review and messaging platforms we link to set their own cookies under their own policies. This policy does not cover them.