This document outlines the standard Terms and Conditions and regulatory requirements for Hotel Steward, an online hospitality software platform focused on health, safety, and operational compliance.
1. Terms of Service
License Grant: Users are granted a limited, non-exclusive, and revocable license to access the software solely for internal business operations at designated licensed venues.
Account Security: Users are strictly responsible for maintaining the confidentiality of login credentials. Any unauthorized use of passwords must be reported immediately to the provider.
Subscription & Payment: Standard fees typically include non-refundable setup charges and annual license fees payable in advance. Subscriptions are generally non-transferable.
Use Restrictions: Customers may not reverse engineer, copy, or redistribute the software. Integration with third-party systems often requires prior written approval from the provider.
Termination: Providers reserve the right to suspend or terminate access for breaches of terms, with data typically retained for 30 days post-termination before deletion.
2. Industry Regulations (2025 Updates)
European Accessibility Act (EAA): As of June 28, 2025, digital services in the hospitality sector—including booking engines and mobile apps—must comply with new accessibility standards (WCAG 2.1 AA) to serve guests in the EU.
Data Protection (UK GDPR & DUAA 2025): The Data (Use and Access) Act 2025 (UK) introduced "stop the clock" rules for subject access requests and a more permissive framework for automated decision-making.
Security Standards: Software vendors are encouraged to follow the UK's Software Security Code of Practice (published May 2025) to mitigate supply chain attacks.
Operational Compliance:
HACCP: Software must support Hazard Analysis and Critical Control Points logging.
COSHH: Management of Control of Substances Hazardous to Health through digital Safety Data Sheets (SDS) and Standard Operating Procedures (SOP).
Health & Safety Audits: Systems must provide systematic evaluation and tracking of cleaning logs and incident reports.
3. Data Processing & Privacy
Data Ownership: While the service provider hosts the data, the hotel customer remains the "Data Controller" and owns all right and title to customer materials.
Retention Policies: Hotels must establish clear data retention periods; for example, UK serviced accommodation must keep records of guests over 16 for at least 12 months.
Breach Notification: Under GDPR, personal data breaches must be reported to the relevant authority within 72 hours.
Terms of Business & Regulatory Compliance
1. Acceptance of Terms
By accessing or using the Hotel Steward online software, you agree to be bound by these Terms and Conditions. These terms govern the relationship between [Your Company Name] and hospitality providers using our digital management tools.
2. Software License & Use
Access: We grant you a non-exclusive, non-transferable license to use Hotel Steward for managing hotel health, safety, and operational workflows.
Prohibited Acts: Users may not attempt to extract source code, bypass security protocols, or use the software to store unlawful data.
Account Integrity: You are responsible for all activity under your account. We recommend auditing user access monthly via our internal permissions dashboard.
3. 2025 Regulatory Compliance
Hotel Steward is updated to help your venue meet the latest legal requirements:
Digital Accessibility: Our interface is optimized for the European Accessibility Act (EAA) requirements effective as of June 2025.
UK Data Standards: We comply with the Data (Use and Access) Act 2025, streamlining how guest and staff data is shared and accessed for law enforcement and operational efficiency.
Safety Logging: The platform includes automated templates for HACCP (Food Safety) and COSHH (Chemical Safety) to ensure your venue remains compliant with local health inspections.
4. Privacy & Data Handling
Data Controller: The Hotel is the Data Controller; Hotel Steward acts as the Data Processor.
Security: All data is encrypted at rest and in transit. In the event of a breach, we provide automated notification tools to help you meet the 72-hour reporting window required by GDPR.
Retention: In line with UK and EU hospitality laws, guest records are retained for a minimum of 12 months unless otherwise specified by your local jurisdiction.
5. Subscription & Cancellation
Billing: Fees are billed monthly or annually. Failure to pay may result in a "Read-Only" status for your account after a 14-day grace period.
Data Export: Upon cancellation, you have 30 days to export your compliance logs before they are permanently purged from our servers.
6. Core Terms of Service (H&S Focus)
These clauses protect your business from liability while ensuring your software remains a tool for compliance.
Software Purpose & Liability Limitation: "Hotel Steward is a digital record-keeping and monitoring tool designed to assist in compliance with H&S regulations (e.g., HACCP, COSHH).
It is not a substitute for professional health and safety advice. The user acknowledges that while the software tracks tasks, the ultimate legal responsibility for physical safety and regulatory adherence remains with the Hotel/Venue Management."
Accuracy of Manual Inputs: "The accuracy of safety logs (e.g., fridge temperatures, fire door checks) is dependent on user input. Hotel Steward is not liable for regulatory fines or safety incidents resulting from falsified, inaccurate, or missing data entered by the user’s staff."
Interoperability Standards (2025 Requirement): "In accordance with Section 121 of the Data (Use and Access) Act 2025, this software complies with statutory information standards for digital health and safety systems to ensure data can be shared seamlessly with regulatory bodies if required."
7. Privacy Policy Clauses (Data Focus)
Health and safety software often handles "Special Category Data" (e.g., staff accident reports or allergy information), which requires stricter protections.
Lawful Basis for Special Category Data: "We process sensitive health information (e.g., staff injury reports, first aid logs) under Article 9(2)(b) of the UK GDPR for the purposes of performing obligations in the field of employment and social protection law."
Recognised Legitimate Interests (2025): "We may process personal data without explicit consent under the Recognised Legitimate Interest (RLI) framework of 2025 for specific safeguarding purposes and responding to workplace emergencies."
Automated Decision-Making Safeguards: "Our software does not use solely automated processing to make legal or significant decisions regarding staff health or safety unless explicit consent is provided or it is in the substantial public interest. Users have the right to request human intervention for any AI-assisted scheduling or risk assessment."
Retention of Safety Records: "Accident reports and COSHH assessments are retained for a minimum of 3 years (or longer if required by the Limitation Act 1980) to meet legal defense requirements against personal injury claims."
8. Operational Compliance Checklist for 2025
Item Requirement
SAR "Stop the Clock" Update your internal procedures to allow pausing the 30-day response window if you need more information to fulfill a data request.
Mandatory Complaints Ensure your software has a clearly visible "Data Protection Complaint" form; you must acknowledge receipt within 30 days per the 2025 Act.
Vulnerability Reporting Manufacturers of critical H&S software must now report significant cyber threats and incidents to the relevant authority (e.g., ICO or Ofcom) within strict new timelines.
Audit Trails Maintain unalterable digital signatures on all safety checks to prove to inspectors (HSE) that logs were completed in real-time.
Hotel Steward SaaS Agreement (2025 Framework)
1. Services and Scope
Grant of License: The Supplier grants the Customer a non-exclusive right to access the Hotel Steward platform for digital health and safety (H&S) logging, risk management, and compliance tracking.
Interoperability Standards: Pursuant to Section 121 of the DUAA 2025, the Supplier warrants that the software meets statutory information standards for health and care IT systems, enabling secure data sharing with regulatory bodies like the HSE or CQC if required.
2. Data Processing & Security
Data Controller Status: The Customer remains the Data Controller for all H&S logs and staff/guest data.
DUAA 2025 Compliance:
SAR "Stop the Clock": The Supplier provides tools to "pause" Subject Access Request timelines when the Customer requires further clarification, as codified in the 2025 Act.
Reasonable Search: Compliance reporting is designed to facilitate "reasonable and proportionate" data searches.
Security: Data is encrypted using AES-256 standards. The Supplier shall notify the Customer of any breach within 72 hours.
3. Liability & Health and Safety
Input Responsibility: The Supplier is not liable for safety incidents arising from inaccurate or falsified data entered by the Customer’s staff (e.g., fraudulent temperature logs) [Tailored Clause].
Mental Health Priority: In line with 2025 HSE clarifications, the platform includes modules for tracking psychological safety and workplace stress alongside physical hazards.
4. Termination and Data Portability
Switching Rights: In accordance with the EU Data Act (Sept 2025) (where applicable to cross-border services), the Customer has the right to terminate with 2 months' notice and receive data in a structured, interoperable format.
Legal Disclaimer for Hotel Steward
1. General Information Only
The information, templates, and compliance logs provided by Hotel Steward are for general informational purposes only. While our platform is designed to assist with record-keeping for HACCP, COSHH, and other safety protocols, it does not constitute professional legal, medical, or health and safety advice.
2. No Guarantee of Compliance
Use of this software does not automatically guarantee compliance with local, national, or international health and safety laws. The ultimate responsibility for maintaining a safe environment and adhering to physical safety standards remains with the Customer (the Hotel/Venue Management).
3. Accuracy of Data
The Supplier is not responsible for any errors or omissions in the content or for any actions taken based on data entered by the Customer's users. We disclaim all liability for safety incidents or regulatory penalties resulting from:
Inaccurate, incomplete, or falsified manual data entry.
Failure to perform physical checks represented in the digital logs.
System interruptions or data loss beyond the Supplier’s reasonable control.
4. "As Is" Basis
The service is provided "as is" and "as available" with no warranties, express or implied, including merchantability or fitness for a purpose.
5. Limitation of Liability
The Supplier is not liable for incidental, indirect, or consequential damages like lost profits or business interruption due to software use. UK law maintains liability for death or personal injury caused by the Supplier's negligence.
