FindMeetingRooms Privacy and Personal Data Protection

Updated: February 6, 2026

The modern digital privacy landscape in 2026 has undergone fundamental transformations, shifting from a passive notification model to a paradigm of active user control over their own data. The FindMeetingRooms platform, as a leading global meeting room and conference hall booking service, operates within a complex network of international regulatory requirements that demand not only formal compliance with laws but also deep integration of privacy principles into the service architecture.

1. Fundamental Principles of Data Processing at FindMeetingRooms

FindMeetingRooms's activities are based on the principles of transparency, purpose limitation, and data minimization. Each aspect of information collection is analyzed for its necessity in providing booking services and ensuring user security. The platform views privacy not as a legal burden but as a strategic advantage that builds trust between property owners (Hosts) and renters (Guests).

1.1. Roles and Identification of Parties

In the context of data processing, FindMeetingRooms acts primarily as a Data Controller, determining the purposes and means of processing information for the marketplace's operation. However, in certain scenarios of interaction between Hosts and Guests, the platform may perform the functions of a Processor, acting on behalf of the Host to finalize transactions.

1.2. Legal Bases for Processing

In accordance with Article 6 GDPR and similar provisions in the United Kingdom, FindMeetingRooms uses the following legal bases:

1. Contract Performance: Most operations involving the collection of contact and payment data are necessary to complete a booking.

2. Legitimate Interest: Used for fraud prevention, ensuring network security, and internal administration. In 2026 in the United Kingdom, this list was expanded to include "recognized legitimate interests".

3. Consent: Mandatory for marketing communications, use of non-essential cookies, and processing of special categories of data.

4. Legal Obligation: Data processing to comply with tax law requirements or law enforcement requests.

2. Categories of Personal Data and Methodology of Their Collection

FindMeetingRooms collects information that is critically important for the business property booking niche. This includes not only digital identifiers but also specific logistical data necessary for access to physical objects.

2.1. Data Provided Directly by the User

The registration and booking process requires providing the following blocks of information:

• Contact and Identification Information: Last name, first name, work email address, phone number. For Hosts, the property address and documents confirming ownership or management rights are mandatory.

• Professional Data: Company name, position, industry. This helps personalize offers for corporate clients.

• Financial Details: Billing information, tax identifiers. FindMeetingRooms does not store full credit card data, delegating this to certified payment gateways.

2.2. Automated Collection and Metadata

When interacting with the FindMeetingRooms platform, technical parameters are automatically recorded that are important for diagnostics and compliance with regional laws:

• Technical Identifiers: IP address, browser type, device identifiers.

• Geolocation Data: Precise user location to display the nearest halls (subject to obtaining consent).

• Behavioral Data: Search history, time spent on page, interaction with interface elements.

2.3. Specific Data for the Hall Booking Industry

A distinctive feature of FindMeetingRooms is the collection of information related to physical presence in premises:

• Access Instructions: Door lock codes, key handover protocols, Wi-Fi instructions.

• Visitor Data: Number of event participants and their on-site contact persons.

• Security Records: Information about the Host's use of video surveillance systems in common areas (subject to mandatory disclosure of this information).

3. Data Processing Regime for the European Union (EU GDPR 2026)

As of 2026, the European Union has strengthened transparency requirements and implemented new mechanisms to protect consumer rights in the digital environment. The European Data Protection Board (EDPB) in its 2026 plan identified transparency as a priority area of control.

3.1. Data Subject Rights in the EU

Residents of the EU and EEA have an expanded range of rights that FindMeetingRooms implements through a specialized Privacy Center:

• Right to Transparency and Access (Art. 15): The user has the right to obtain a copy of all their data and detailed information about which third parties it was transferred to, including specific countries outside the EU.

• Right to be Forgotten (Art. 17): The ability to demand complete deletion of data if it is no longer needed for booking purposes or if the user has withdrawn consent.

• Right to Data Portability (Art. 20): Obtaining data in a structured machine-readable format for transfer to another service.

• Protection from Automated Decisions (Art. 22): If FindMeetingRooms uses AI for price ranking or user reliability assessment, the subject has the right to demand human intervention and challenge the result.

3.2. Mandatory "Withdrawal Button" (From June 2026)

According to the Consumer Rights Directive (Directive (EU) 2023/2673), from June 19, 2026, FindMeetingRooms implements a "withdrawal button" functionality for all distance contracts.

• Mechanism of Action: The user can cancel a hall booking as easily as they made it — using a standardized function in the interface.

• Interface Requirements: The button must be visible throughout the withdrawal period (usually 14 days) and clearly labeled as "Withdraw contract here".

• Confirmation: After using the function, the Guest immediately receives confirmation on a durable medium (email) indicating the exact time and content of the statement.

3.3. Cross-Border Data Transfer Regime

Data transfer from the EU to third countries is carried out exclusively on the basis of adequacy decisions or Standard Contractual Clauses (SCCs). In 2026, FindMeetingRooms uses the updated Data Privacy Framework (DPF) to transfer information to certified partners in the USA.

4. Data Processing Regime for the United Kingdom (UK GDPR & DUAA 2025)

Following the entry into force of the Data (Use and Access) Act 2025 (DUAA), the data protection regime in the United Kingdom demonstrated controlled divergence from EU standards, requiring FindMeetingRooms to adapt internal processes.

4.1. Recognized Legitimate Interests and New Article 6(1)(ea)

Since February 5, 2026, FindMeetingRooms uses the concept of "recognized legitimate interests", which allows processing data for certain purposes without conducting a balancing of interests test.

• Crime Prevention: Detection and investigation of fraud cases in hall rental.

• National and Public Security: Transfer of data to law enforcement agencies in case of a threat to the safety of conference attendees.

• Emergency Situations: Data processing to protect human life and health in critical situations on Hosts' premises.

4.2. Simplification of Access Requests (DSARs)

DUAA 2025 clarified the concept of "manifestly unfounded" requests. FindMeetingRooms now has the right to refuse requests or charge a fee if they are excessive or operation, while adhering to the principle of proportionality defined by ICO.

4.3. Automated Decision Making (ADM) and AI

British legislation has become more lenient towards the use of AI for decision-making, but FindMeetingRooms maintains strict safeguards:

• Notification: Users receive clear notification about the use of algorithms for scoring or predictive analytics.

• Appeal: Any significant decision (for example, refusal to rent due to an automated profile) is subject to human review upon user request.

4.4. Adequacy Status and Data Transfer

The European Commission in December 2025 confirmed the adequacy status of the United Kingdom until 2031. This allows FindMeetingRooms to freely move data between offices in London and Berlin without additional legal barriers, which is critically important for maintaining a unified booking database.

5. Data Processing Regime for the United States (US State Laws 2026)

In the absence of federal law (the APRA bill was not adopted as of 2026), FindMeetingRooms is guided by a mosaic of state laws, where California remains the standard of strictness.

5.1. California: CCPA and CPRA (2026 Updates)

Since January 1, 2026, new provisions regarding automated decision-making technologies (ADMT) and cybersecurity have entered into force.

• Notice Before Using ADMT: FindMeetingRooms provides California residents with a detailed explanation of how AI algorithms are used to select halls or set dynamic prices.

• Right to Opt Out of ADMT: Users can disable automated processing for making significant decisions.

• Cybersecurity Audit: As a platform processing significant volumes of data, FindMeetingRooms undergoes an annual independent security audit, the results of which are available to the CPPA regulator.

• DROP Platform: FindMeetingRooms is integrated with California's data deletion system, allowing users to exercise the right to deletion through a centralized portal.

5.2. Rhode Island: RIDTPPA 2026

Rhode Island law, which came into force on January 1, 2026, requires special transparency from commercial websites.

• Disclosure of Sale Categories: Although FindMeetingRooms does not sell user data in the classical sense, any transfer of information to advertising partners is clearly classified and subject to Opt-Out.

• Quick Consent Withdrawal: At the request of a user from Rhode Island, processing of their data must be stopped within 15 days.

• No Cure Period: Any violation of Rhode Island law can result in immediate fines of up to $10,000 without the possibility to remedy the defect post-factum.

5.3. Indiana and Kentucky

In these states, FindMeetingRooms provides a basic set of rights (access, correction, deletion, portability) and conducts mandatory Data Protection Impact Assessments (DPIA) for high-risk operations such as processing precise geolocation of conference halls.

6. Comparative Analysis of 2026 Requirements

To visualize differences in data protection approaches in key jurisdictions, the following comparative table has been developed.

7. Technical and Organizational Security Measures

FindMeetingRooms implements a multi-level protection system that meets ISO 27001 and SOC 2 requirements.

7.1. Encryption and Anonymization

All personal data, including financial information and booking details, are encrypted using AES-256 protocol at rest and TLS 1.3 during transmission. For analytics and service improvement purposes, FindMeetingRooms uses differential privacy and data aggregation, making it impossible to identify a specific person in statistical information arrays.

7.2. Physical Space Security (Meeting Room Specific)

A unique aspect of FindMeetingRooms is ensuring privacy directly in rented halls:

• Data Erasure: Hosts are required to clean digital whiteboards and log out of accounts on shared screens after each booking.

• Network Segmentation: Wi-Fi in meeting rooms must be physically or logically separated from the building's administrative network.

• Conversation Confidentiality: The platform encourages Hosts to use soundproofing materials and provide information about the privacy level of the premises in the listing description.

• Limitation of Liability Regarding Physical Safety : Although FindMeetingRooms implements safety standards (such as mandatory surface cleaning and network reset) as part of the Host Agreement, the User understands and agrees that the Platform acts as an intermediary. FindMeetingRooms does not exercise direct physical control over the premises in real time and is not responsible for the actions or inactions of Hosts in complying with these protocols. In the event of violations, the Platform undertakes to provide tools for filing complaints, conduct an internal investigation, and apply appropriate measures to the Host (up to and including account suspension).

7.3. Access Management and Training

Only FindMeetingRooms employees whose job responsibilities require it have access to personal data (principle of least privileges). All personnel undergo quarterly training on cyber hygiene and legislative updates.

8. Data Transfer to Third Parties and International Flows

FindMeetingRooms cooperates with a limited circle of partners to ensure platform operation.

8.1. Categories of Data Recipients

8.2. International Transfer Mechanisms

For data transfer to countries without adequacy status, FindMeetingRooms uses:

1. Standard Contractual Clauses (SCCs): EU 2021 updated package.

2. UK IDTA: International Data Transfer Agreement for outbound flows from the United Kingdom.

3. Data Privacy Framework (DPF): For data transfer to certified organizations in the USA.

9. Data Retention Period (Retention Policy)

FindMeetingRooms stores information only for the period necessary to fulfill business purposes or legal obligations.

• Account Data: Stored throughout the user's active period. After account closure, data is anonymized after 30 days, except in cases of legal disputes.

• Booking History and Financial Documents: Stored for up to 7 years in accordance with tax law requirements of most EU countries and the United Kingdom.

• Access and Security Logs: Deleted after 12 months if they are not part of an active investigation.

• Identification Data (ID): If collected for verification, FindMeetingRooms deletes document copies immediately after verification is complete, keeping only a "Verified" mark.

10. Specifics of Children's Data Processing

The FindMeetingRooms platform is designed for professional use by persons aged 18 and over. We do not knowingly collect data from minors. If such information is detected, it is subject to immediate deletion in accordance with COPPA (USA) requirements and relevant GDPR provisions.

11. Changes to the Privacy Policy

Digital regulation is a dynamic process. FindMeetingRooms reserves the right to update this document. In case of significant changes (for example, change of processing purpose or data transfer to a new class of partners), users will receive email notification 30 days before the changes take effect.

12. Contact Information and Supervision

To exercise your rights or obtain clarifications, users can contact our Data Protection Officer (DPO):

• Email: hello@findmeetingrooms.com

• Address (EU): Rosenørns Alle 29, 1970 Frederiksberg, Denmark

• Address (UK): address

You also have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction (for example, ICO in the United Kingdom or the relevant DPA in the EU), but we encourage you to first contact us to resolve any issues peacefully.

13. Applicable law and dispute resolution

All issues relating to this Privacy Policy, as well as any disputes that may arise in connection with the processing of personal data by the Platform, are governed by the substantive law of the Kingdom of Denmark. All disputes that cannot be resolved through negotiation shall be subject to the jurisdiction of the relevant courts in Denmark (in particular, at the place of registration of the Platform owner). This does not deprive users who are EU residents of their right to refer to supervisory authorities in their country of residence in accordance with the provisions of the GDPR.