SURE STAY
Privacy & Data Protection Notice (GDPR) — International
This notice explains how Sure Stay (“Sure Stay”, “we”, “us”) collects, uses, shares and protects personal data about hosts, guests and website visitors, and the rights you have. Sure Stay is based in the Republic of the Marshall Islands (“RMI”) and operates internationally. We apply a single, GDPR-standard approach to personal data everywhere we operate, so that visitors from any country receive the same high level of protection.
1. Who we are (data controller)
Sure Stay, Republic of the Marshall Islands. Sure Stay decides how and why your personal data is processed and is the “controller” of that data.
2. Which law applies
This notice is written to the standard of the EU General Data Protection Regulation (Regulation (EU) 2016/679) and the UK GDPR. If you are in the European Economic Area (EEA) or the United Kingdom, those laws give you the rights described below, and we honour them. We also respect Article II of the Constitution of the Marshall Islands and the data-handling principles of the RMI Personal Data Protection Act 2025. Where the GDPR gives you stronger rights than local RMI law, we apply the GDPR standard to you.
3. The personal data we collect
- Identity & contact — name, email, telephone, and any host display name.
- Property — address, listing details, and consents, permits or registration references you provide.
- Financial — nominated payout bank details (held to route your payments).
- Usage & device — how you interact with our website and services, including cookie data.
- Marketing preferences — your consents and choices.
We do not intentionally collect special-category data (such as health, race or religion). Please do not send us such data unless we specifically ask for it.
4. How we use your data, and our lawful bases
Under the GDPR we must have a lawful basis for each use of your personal data. Our bases are:
- Performance of a contract — to provide our services (onboarding, listing distribution, payouts) and to communicate with you about them.
- Legitimate interests — to market, secure and improve our services, and to manage our business, where these interests are not overridden by your rights. You may object at any time.
- Legal obligation — to meet legal, tax, accounting and regulatory duties.
- Consent — for non-essential cookies and certain marketing. You can withdraw consent at any time.
5. Who we share it with
We share personal data with our distribution partners and online agents (to list and market a property), payment providers, and vetted service suppliers who act on our instructions as our processors under written data-processing terms and confidentiality obligations. We may also share data where required by law. We do not sell your personal data.
6. International transfers
We operate across several countries London, Paris, Madrid, Dubai, Tokyo and Beijing and are based in the RMI, so your data may be transferred internationally. Where we transfer personal data out of the EEA or the UK to a country without an adequacy decision, we use an approved safeguard — the European Commission’s Standard Contractual Clauses, and for UK data the UK International Data Transfer Agreement or Addendum — together with additional security measures. We transfer only what is necessary, and you may ask us for a copy of the safeguards we use.
7. How long we keep it
We keep personal data only for as long as needed for the purposes above and to meet legal, tax and accounting requirements, after which we securely delete or anonymise it.
8. Your rights
Subject to the conditions in the GDPR, you have the right to: be informed about our processing; access your data; have inaccurate data corrected; have data erased; restrict processing; data portability; and object to processing (including direct marketing, which you can stop at any time). Where we rely on consent, you may withdraw it at any time without affecting earlier processing. We do not make decisions producing legal or similarly significant effects about you based solely on automated processing. To exercise a right, contact us; we will respond within one month, which we may extend by up to two further months for complex requests, as the GDPR permits. There is no fee for a valid request in most cases.
9. Complaints
We hope to resolve any concern if you contact us first. You also have the right to complain to a data-protection supervisory authority: in the EEA, your local authority; in the UK, the Information Commissioner’s Office (ico.org.uk). The RMI does not currently have a dedicated data-protection regulator; concerns about consumer conduct in the RMI may be raised with the Office of the Attorney-General.
10. Security
We apply appropriate technical and organisational measures — including role-based access, encryption in transit, supplier due-diligence and staff confidentiality — to protect personal data against loss, misuse and unauthorised access, and we maintain a procedure to manage personal-data breaches, including notification where the GDPR requires it.
11. Cookies
See our Cookie Policy for how this site uses cookies.
12. Children
Our services are intended for adults and are not directed to children. We do not knowingly collect personal data from children under 16 (or the minimum age of digital consent in your country). If you believe a child has provided us with data, contact us and we will delete it.
13. Changes and contact
We may update this notice from time to time; the “last updated” date shows the current version. Questions or requests: Sure Stay, Republic of the Marshall Islands.