Who we are
BrandMatch (gobrandmatch.com) is an invite-only, AI-enhanced marketplace that connects luxury and upscale hotels with consumer brands in health, wellness, lifestyle and related categories. It is set up and operated by White Sky Hospitality and co-created with Chessa Connect.
White Sky Hospitality Limited is the controller of personal data on BrandMatch under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. In this policy, “BrandMatch”, “we”, “us” and “our” mean White Sky Hospitality Limited.
Registered address: 2 Hill Farm Barns, Hill Farm Court, Chinnor, Oxfordshire OX39 4NX, United Kingdom. Registered in England and Wales, company number 06252970. ICO registration number: ZA741324.
For any privacy question or request, email reach@whiteskyhospitality.com.
Chessa Connect, based in Portugal, co-owns and co-created BrandMatch with us and helps deliver partnership services. Where it handles your personal data, it does so within the same framework.
What this policy covers
This policy applies to personal data we handle when you:
- visit gobrandmatch.com, read our resources or use our free tools;
- request an invitation or join our early-access list;
- register for and use the BrandMatch platform as a hotel or brand user, including matchmaking, Brand Fit Reviews, Partnership Roadmaps and the partnership workspace;
- pay for a paid phase, contact us, or receive emails from us;
- use the "Ask BrandMatch" assistant.
BrandMatch is a business-to-business service. Most of what we handle is information about organisations, but the people who represent them – your name, work email, job title and so on – are personal data, and that is what this policy protects.
BrandMatch is not designed to process hotel guests’ personal data. Please do not upload guest lists, booking records or other personal data about third parties to the platform unless we have agreed a specific arrangement with you in writing.
Data we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Invitation and early-access requests | First and last name, work email, organisation, whether you represent a hotel or a brand, and any note you add | You, via our website forms |
| Account data | Name, work email, role, password (stored only in hashed form by our authentication provider), sign-in records | You, when you accept an invitation and register |
| Profile data | Business details about your hotel(s) or brand, plus the contact details of the people named in the profile – names, job titles, work email and phone numbers | You and your colleagues; occasionally public sources such as your own website, which we ask you to review |
| Partnership and collaboration data | Match results, connection requests, Brand Fit Review answers and reports, comments, approvals, documents and baseline figures shared in the partnership workspace | You, the other party to the partnership, and our team |
| Payment data | Billing name, email, billing address, amount and payment status. Card details are entered directly with Stripe and never reach our servers | You and Stripe |
| Communications | Emails and messages you send us, and records of the service emails we send you (for example delivery status) | You and our email provider |
| Assistant and tool inputs | Questions you type into "Ask BrandMatch", and figures you enter into the Business Case Builder or Partnership Map tools | You |
| Technical and usage data | IP address, browser and device type, pages visited, referring site and approximate location (country or city). Analytics data is only collected if you accept analytics cookies | Your device, our hosting provider and, with consent, Google Analytics |
We do not ask for special category data (such as health information) and ask you not to include it in profiles, comments or documents.
How we use it and why
Data protection law requires a lawful basis for each use of personal data. Ours are:
| Purpose | Lawful basis |
|---|---|
| Reviewing invitation requests and deciding who to admit to an invite-only platform | Legitimate interests – curating a high-quality marketplace and responding to your request |
| Creating and running your account, building your profile and providing the platform | Contract – our agreement with you or your organisation; legitimate interests where you act on behalf of an organisation |
| Running AI matchmaking, generating match scores, Brand Fit Reviews and roadmap documents | Contract and legitimate interests – this is the core service you signed up for |
| Facilitating introductions and sharing profile and partnership information with the other party once a connection is agreed | Contract and legitimate interests |
| Taking payments, issuing refunds (including automatic refunds when a counterpart declines a Fit Review invitation) and keeping financial records | Contract; legal obligation for tax and accounting records |
| Sending service emails – invitations, password resets, connection and comment notifications, reminders and receipts | Contract and legitimate interests |
| Sending news about BrandMatch, launch updates and relevant insight to business contacts | Legitimate interests, or consent where the law requires it – you can opt out at any time |
| Measuring how our website is used with Google Analytics | Consent – given through our cookie banner and withdrawable at any time |
| Keeping the platform secure, preventing fraud and misuse, and fixing faults | Legitimate interests |
| Publishing a case study about a partnership | Consent – sought separately from both parties, never a condition of using BrandMatch |
| Complying with the law, handling disputes and defending legal claims | Legal obligation and legitimate interests |
Where we rely on legitimate interests, we have weighed them against your rights and expectations as a business user. You can ask us for details of that assessment.
AI matchmaking
BrandMatch uses large language models provided by Anthropic (Claude) to analyse hotel and brand profiles, score commercial compatibility, generate opportunity analyses, power the Brand Fit Review and draft partnership documents. The “Ask BrandMatch” assistant also uses Claude, and may look up published articles from White Sky Hospitality’s knowledge base to answer your question.
- Profiles are analysed for business fit. The relevant profile content, which can include named contacts, is sent to Anthropic for processing.
- Under its commercial terms, Anthropic does not use data sent through its API to train its models.
- Match scores and AI-generated reports are recommendations. They do not, on their own, produce legal or similarly significant effects on you: admission, introductions and paid-phase decisions involve our team and the parties themselves.
- Questions typed into "Ask BrandMatch" are not saved to your account. Please do not include personal or confidential information in them.
If you would like a person to review an AI-generated outcome that affects you, contact us.
International transfers
Some of our providers are based in, or access data from, countries outside the UK and European Economic Area, mainly the United States. Where that happens we rely on one of the following safeguards:
- UK adequacy regulations or an EU adequacy decision (this covers transfers to the EEA, including to Chessa Connect in Portugal);
- the UK Extension to the EU–US Data Privacy Framework, where the recipient is certified;
- the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, with supplementary measures where needed.
Contact us for more information about the safeguard used for a particular provider.
How long we keep it
| Data | Retention period |
|---|---|
| Invitation requests that do not proceed | 12 months from the request |
| Early-access list | Until you unsubscribe, or 12 months after public launch, whichever is sooner |
| Account and profile data | While your account is active, then deleted or anonymised within 12 months of closure |
| Partnership records – reports, comments, approvals and documents | For the life of the partnership and 6 years afterwards, as both parties may rely on them |
| Payment, refund and invoice records | 6 years from the end of the financial year they relate to (UK tax law) |
| Correspondence with us | Up to 2 years after our last contact, unless linked to a partnership or claim |
| Server and security logs | Typically no more than 30 days, unless needed to investigate an incident |
| Google Analytics data | 14 months, then automatically deleted by Google |
Where we no longer need data, we delete it or anonymise it so that it can no longer identify you.
Security
We use encryption in transit (HTTPS), encryption at rest through our hosting providers, row-level security so each user can only reach their own and their partnership’s records, role-based access for our team, and server-side handling of privileged credentials. No system is completely secure, so if we become aware of a breach that is likely to affect you, we will tell you and the relevant regulator where the law requires us to.
Your rights
Depending on where you are and the basis we rely on, you have the right to:
- access a copy of the personal data we hold about you;
- have inaccurate data corrected or incomplete data completed;
- have your data erased;
- restrict how we use your data;
- object to processing based on legitimate interests, and to direct marketing at any time;
- receive data you gave us in a portable, machine-readable format;
- withdraw consent at any time, without affecting processing that took place before;
- not be subject to decisions based solely on automated processing that significantly affect you.
To exercise any of these rights, email reach@whiteskyhospitality.com. We may need to verify your identity. We will respond within one month, which can be extended by up to two further months for complex requests – we will tell you if so. There is normally no fee.
If you are based outside the UK and EEA, for example in the Middle East or South Asia, local laws may give you further rights. We will honour requests in line with the law that applies to you.
Updates and marketing
We may email business contacts with BrandMatch news, launch updates and commercial insight relevant to hotel and brand partnerships. Every such email includes an unsubscribe link, or you can email us to opt out. Service emails about your account and partnerships are not marketing and will continue while your account is active.
Changes to this policy
We will update this policy as BrandMatch evolves – for example, when we add a new provider or feature. The date at the top shows the latest version. If a change materially affects how we use your data, we will tell registered users by email or in the platform before it takes effect.
Contact and complaints
Questions, requests or concerns about privacy go to reach@whiteskyhospitality.com. Please mark your message “BrandMatch privacy”.
If you are unhappy with how we have handled your data, please raise it with us first so we can put it right. You also have the right to complain to the UK Information Commissioner’s Office (ico.org.uk, 0303 123 1113) or, if you are in the EEA, to the data protection authority in the country where you live or work.
BrandMatch is a business service for professionals and is not intended for anyone under 18.