Skip to content
Get a quote

Privacy & Cookies Notice

Last updated: November 2026

This notice explains how Hotwireless collects, uses and protects personal data. It is written to the UK GDPR and the Data Protection Act 2018, and the cookies section is written to the Privacy and Electronic Communications Regulations 2003 (PECR).

It covers three things: this website, our sales and support dealings with venues, and the guest Wi-Fi login pages we operate on behalf of venues.

Who we are

Hotspot & Wifi Specialists (Pty) Ltd t/a Hotwireless
Company registration number 2016/437869/07, registered with the Companies and Intellectual Property Commission
Registered office: 22 Belair Drive, Constantia, Cape Town 7806, South Africa

Hotwireless is the trading name of a company registered in South Africa that supplies managed guest Wi-Fi to venues in the United Kingdom. We publish our registered company details because the Electronic Commerce (EC Directive) Regulations 2002 require a provider selling into the UK to give its name, a geographic address and an email address. A UK company is planned; when it is registered, this notice will name it.

Because we offer services to people in the United Kingdom, the UK GDPR applies to what we do with their personal data, wherever we are registered.

Who to contact about your data

Our data protection contact is Russell Ball. Write to sales@hotwireless.co.uk with any request to see, correct or delete your data, to withdraw a consent, or with any privacy complaint. We answer Monday to Friday, 06:00–15:00 GMT (07:00–16:00 BST).

We are not required to appoint a statutory Data Protection Officer and we have not appointed one. That does not change any of your rights below.

Who controls your data: us, or the venue?

This matters, because it decides who you ask. The split is:

  • The venue is the controller for personal data captured at its guest Wi-Fi login — the guest details, the marketing opt-in, the session records for its own network. The venue decides why it is collected and what it is used for. Hotwireless is the processor: we run the login page, store the records and act on the venue's instructions, under a written contract that says so.
  • Hotwireless is the controller for our own data: enquiries made through this website, our correspondence with venue owners and staff, billing records, and the technical logs we keep to run and secure our own platform.

If you are a guest and you want your details from a venue's guest list removed, ask the venue — it is their list. Tell us as well if it is easier, at sales@hotwireless.co.uk, and we will carry it out on the venue's instruction and help them answer you.

What we collect, and why

When you enquire through this website

  • Your name, business name, email address, contact number, venue type and whatever you write in the message box.
  • The website or social page you optionally give us, so we can prepare a demonstration login page before we reply.
  • How you found us, if you choose to answer that optional question, and which page of this site you came to the form from, so we know which of our pages and listings are working.
  • Technical data needed to deliver and protect the form — your IP address, browser and referral source. Your IP address is also used, in hashed form, to rate-limit the form against abuse.

When you connect to guest Wi-Fi we operate

What is collected depends on the package the venue has chosen.

  • On the Basic package you are not asked for any personal details. We record your device identifier (MAC address) and connection metadata — the time you connected, how long the session lasted and how much data it used — so the session can run, the venue's time and bandwidth limits can be applied, and the network can be kept secure.
  • Where the venue has taken the Data Collection package, the login page asks for your name, email address and mobile number before it lets you online, so the venue knows who used its Wi-Fi and, where it also has Guest Insights, can count new against returning visits.
  • Marketing is a separate, unticked box. Signing in to Wi-Fi is not consent to be marketed to, and we do not treat it as consent. If you want to hear from the venue you tick the box; if you do not, you still get online. We store the record of what you were shown and when you ticked it, because PECR requires the venue to be able to evidence consent.
  • We do not inspect the content of your traffic, and we do not sell anyone's details.

Our lawful bases

Under the UK GDPR, every use of personal data needs a lawful basis. Ours are:

  • Contract — to give you the Wi-Fi connection you asked for on the terms shown at the login, and to supply and bill the service a venue has ordered from us.
  • Legitimate interests — to keep the network and the platform secure, to investigate faults and abuse, to answer a business enquiry you sent us, and to keep the records a business needs to keep. We have weighed these against your interests; you can object at any time, and how to do that is below.
  • Consent — for marketing messages by email or SMS, and for non-essential cookies. Consent is asked for separately, it is never pre-ticked, and you can withdraw it at any time without affecting anything we did before you withdrew it.
  • Legal obligation — where a law requires us to keep or hand over a record.

We do not use your data to make automated decisions that produce a legal or similarly significant effect on you, and we do not profile guests.

Marketing, and what PECR means for a venue

PECR governs marketing by email and SMS, and it sits on top of the UK GDPR. The practical point for a venue: a Wi-Fi login is not marketing consent. Consent has to be a separate, affirmative, unticked opt-in, and the venue has to be able to show it was given. Our Data Collection package captures it that way and stores the evidence with the record, which is exactly what an ICO enquiry would ask to see.

We will only email or message you about Hotwireless if you asked us to or if you enquired about our service. Every marketing message carries an unsubscribe, and unsubscribing takes effect on the next send at the latest.

Who we share it with

  • The suppliers we need in order to run the platform: cloud hosting, captive portal infrastructure, transactional email, SMS delivery, and the hosting and bot-protection service that runs this website. Each is bound by a written contract that limits them to acting on our instructions.
  • Our UK sales representative, who receives website and email enquiries so they can reply to you and arrange a demonstration.
  • WhatsApp (Meta), when you choose to contact us by WhatsApp. Your messages and number then pass through WhatsApp's service under WhatsApp's own terms and privacy policy.
  • The venue whose Wi-Fi you used, where it has taken a package that collects guest details. That list is the venue's.
  • Anyone we are legally required to disclose to — a court order, or a properly made request from a law enforcement body or regulator. We check that a request is lawful before we answer it.

We do not sell, rent or share personal data with marketing partners or data brokers.

Where your data is processed, and transfers outside the UK

Your personal data is processed outside the United Kingdom. We would rather say that plainly than bury it. Our company is registered in South Africa and personal data is processed there, and the cloud and communications services the platform runs on operate in several countries, so guest and customer data may be handled in South Africa and elsewhere.

Your personal data is held and processed by our company in South Africa. Where UK data protection law requires safeguards for a transfer of that data on to another organisation outside the UK, we put those safeguards in place before the transfer happens.

We do not claim that South Africa benefits from a UK adequacy decision, because it does not. We also hold no privacy certification, seal or accreditation, and we make no claim to one. If you ask our data protection contact, we will tell you which categories of processor handle your data and where they are based.

How we protect it

Traffic to our platform is encrypted in transit. Access to guest records is restricted to the people who need it to run the service. Stored data sits inside the security controls of the cloud services we use. No system is perfect, and we will tell you and the ICO if something goes wrong in a way that requires it.

How long we keep it

  • Connection logs (device identifier, session times, data volume): kept while they are needed to run, troubleshoot and secure the service, and for any period a law requires.
  • Guest details captured at a venue login (name, email, mobile number): kept while the venue remains our customer and the consent behind them remains valid. When a venue closes its account we remove its guest list from our systems.
  • Marketing contact data: kept while the consent is live. Withdraw it and we stop, keeping only the minimum record needed to make sure we do not contact you again by mistake.
  • Website, email and WhatsApp enquiries: kept for 24 months from your last contact with us, unless you become a customer. If you do, your details become part of our customer records and are kept for the term of the contract and six years after it ends.
  • Business and accounting records: six years, which is the period UK tax and limitation rules expect.

Cookies

PECR governs cookies and anything else stored on your device. Storage that is strictly necessary to provide the service you asked for does not need your consent; everything else does.

This website sets no analytics or advertising cookies. We do not count you, profile you or pass anything about your visit to an advertising network, and there is no third-party tracker on any page. The only cookie-like storage this site uses is what Cloudflare Turnstile needs to run the spam check on our contact form. It is strictly necessary — it is what tells a person from a bot — and it is used only on the contact page, when the form is shown.

The guest Wi-Fi login page at a venue is separate, and it does set a small number of strictly necessary cookies to keep your session alive and to protect the login against abuse. These cannot be switched off without breaking the login.

You can block or delete cookies in your browser settings at any time. Blocking them may stop the contact form submitting, but it does not stop you reading this website.

If we ever add measurement to this site, we will either use a method that sets nothing on your device and needs no consent, or ask you first — and this notice will say so before it goes live, not afterwards.

Your rights under the UK GDPR

You have the right to:

  • Be informed — which is what this notice is for.
  • Access — ask for a copy of the personal data we hold about you.
  • Rectification — have inaccurate data corrected and incomplete data completed.
  • Erasure — ask us to delete your data where there is no good reason for us to keep it.
  • Restriction — ask us to stop using your data while a dispute about it is sorted out.
  • Data portability — receive the data you gave us in a common machine-readable format, or have it sent to another provider.
  • Object — object to processing based on our legitimate interests, and object to direct marketing at any time, which we always honour.
  • Withdraw consent — at any time, as easily as you gave it.

Write to sales@hotwireless.co.uk. We answer within one calendar month, and we will tell you if a request is complex enough to need longer. Exercising a right costs you nothing.

For data captured at a venue's Wi-Fi login, the venue is the controller — see the split above. Come to us anyway if that is easier and we will route it.

Complaints

Please raise it with us first at sales@hotwireless.co.uk — most things are quicker to fix directly. If you are not satisfied, you have the right to complain to the UK supervisory authority:

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
ico.org.uk/make-a-complaint

Complaining to the ICO does not affect your right to a remedy through the courts.

Changes to this notice

We update this notice from time to time and the current version always sits at this address. Where a change materially affects you, we will say so rather than quietly swap the page.