Mix & Match Stays Ltd is a registered UK data controller. ICO Registration No. ZC114008. We collect only the personal data needed to provide our services, process it on defined lawful bases, and give you full control over it.
Payments are processed by Revolut, a PCI DSS Level 1 certified provider. Your full card number, expiry, and CVV are entered directly into Revolut's hosted form and never reach our servers.
Every supplier we work with has a Data Processing Agreement (DPA) or equivalent contractual safeguards in place. We do not share your data with any party that does not have a documented, necessary role in providing our services.
All card payments are protected by 3-D Secure (Strong Customer Authentication) under PSD2. All connections are encrypted in transit.
All data in transit is protected with TLS 1.2+. All data at rest — booking records, user profiles, payment references — is encrypted with AES-256.
Your full card number, expiry, and CVV are entered directly into Revolut's secure hosted form and never reach our servers. Once payment is authorised, Revolut returns a payment confirmation to us — including the last 4 digits of your card and the authentication result — which we retain solely to support refunds and dispute resolution.
Staff access to customer data is governed by role-based permissions. Only authorised team members can access booking or personal data, and all actions are logged.
We use Google reCAPTCHA Enterprise on account registration and login to protect against automated abuse and credential stuffing attacks.
Your search inputs, itinerary requests, and concierge conversations are never used to train any AI model — by us or by any of our AI providers. Our contracts with all AI providers explicitly prohibit this.
The Trip Planner uses AI to generate multi-day, multi-city hotel itineraries based on your preferences. Itineraries are stored for 15 days and then automatically deleted. Generating an itinerary is free.
Beatrice is our multilingual AI concierge. She answers travel and support questions and is available across the platform. Conversations are not stored beyond the session and are never shared with third parties.
We work only with suppliers who have Data Processing Agreements in place. The table below explains what our suppliers do and what data they handle on our behalf.
Email us and we will respond within 30 days.
You have the right to complain to the Information Commissioner's Office (ICO) at any time.
ICO website: ico.org.uk
Our full Privacy Policy is available at mixmatchstays.com/privacy
Our full FAQ covers everything — from how hotel hopping works to GDPR rights, cancellation policies, and how your payment is protected.
If you discover a security vulnerability in the Mix & Match Stays platform, please contact us directly before any public disclosure. We will acknowledge your report within 24 hours and keep you informed throughout.