Skip to content

Trust and transparency

Privacy notice

This notice describes the site’s current data-minimising approach to consent, browser storage, optional analytics and third-party links.

Draft — not a final legal notice.

This page describes current engineering behaviour, but owner-supplied details and legal review are incomplete. It is excluded from search indexing until every required item is approved.

Outstanding inputs (16)
  • legal controller or owner name
  • controller postal or service address
  • controller country of establishment
  • monitored privacy-rights contact email
  • approved vendor and data-recipient statement
  • legally reviewed lawful-bases statement
  • approved retention schedule for each data purpose
  • confirmed onsite measurement and vendor retention periods
  • confirmed rights-correspondence retention and deletion schedule
  • approved inventory of production measurement vendors
  • approved international-transfer and safeguard information
  • approved data-subject-rights wording
  • approved ICO complaint route
  • qualified legal reviewer name
  • material legal-review date
  • explicit approval to publish the notices as final

Data minimisation

The browser application does not ask for traveller names, email addresses or payment details. If the optional same-origin pricing boundary is enabled, a search can send hotel identifiers, dates and occupancy counts to that endpoint; its production provider, retention and processor terms must be recorded before launch.

Browser storage currently implemented

The site stores lbh-consent-v2 in localStorage with the decision, timestamp, policy version and a 180-day validity date. It stores up to four hotel IDs in lbh-compare until the user clears or changes the comparison. After analytics consent, lbh-analytics-events may hold up to 500 pseudonymous interaction events without a time-based expiry, and lbh-pending-consent-event is a short-lived sessionStorage marker consumed after acceptance.

Optional onsite measurement

After consent, the application can load Vercel Web Analytics and Speed Insights, plus either Google Tag Manager or direct Google Analytics 4 when configured. GTM takes precedence over direct GA4. The final production vendor inventory, tag-container contents, recipient details, international-transfer safeguards and provider retention settings are not confirmed in this repository.

Chosen external destinations

Rejecting optional onsite analytics does not prevent a visitor from choosing an official or affiliate link. On an affiliate click, the browser contacts the configured redirect domain before continuing to Booking.com; those external services can receive ordinary request data and apply their own cookies and privacy terms. The onsite consent choice neither grants nor withdraws consent on those external sites.

Rights correspondence

A rights or takedown report may contain contact details and supporting evidence. The lawful basis, retention period, access controls and deletion process for that correspondence require legal review before a public mailbox is activated.

Details still to be completed

Legal review required: controller identity and address, monitored contacts, vendor and recipient information, lawful bases, retention, transfer safeguards, data-subject rights, the ICO complaint route and the final production measurement inventory must be approved before this notice is final.