Privacy Policy
How SPR Software Ltd uses personal data about the people who run agencies on AgentHub.
Version 2026-11-02 · Effective 2026-11-02
This notice explains how SPR Software Ltd, trading as AgentHub ("we", "us"), collects and uses personal data about the people who create and run AgentHub accounts. It is written to meet the UK GDPR and the Data Protection Act 2018.
Who we are
AgentHub is a trading name of SPR Software Ltd, a company registered in England and Wales under company number 12349657, with its registered office at Crown House, 27 Old Gloucester Street, London, WC1N 3AX. We are the controller of the personal data described in this notice. Contact us about privacy at support@agenthub.travel.
Who this notice covers — agencies and travellers
AgentHub is used by travel agencies to look after their clients. Two groups of people are involved, and our role is different for each:
- Agency users — the people who sign up, run an Organisation and use the workspace. We decide how and why their data is used, so we are the controller. This notice is about you.
- Travellers and other agency clients — people whose details an agency enters into, or collects through, the Service (enquiry forms, quotes, passenger details, booking pages, hosted websites). The agency decides how and why that data is used; it is the controller, and we process the data on its instructions as a processor under our Data Processing Addendum. If you are a traveller, your agency's own privacy notice applies, and requests about your data should go to them.
What we collect
- Account details — your name, work email address and a hashed password. We never store the password itself.
- Organisation details — your agency's name, branding, website content and settings. These describe a business; where they include a person's name or contact details, this notice covers them.
- Billing references — the identifiers Stripe gives us for your customer record, subscription and payments, and the invoices and credit purchases on your account. Card details are entered on Stripe's own pages and never reach us. If you take part in the referral scheme, the bank details for payouts are held by Stripe, not by us.
- Technical and security data — the IP address and browser ("user agent") attached to your sessions, the times you sign in, rate-limiting counters keyed to your address and email, and an audit trail of the changes made in your workspace. Error reports sent to our monitoring service are scrubbed of free text and personal data before they leave the server.
- Support correspondence — what you send us when you email support, held in our help-desk service.
- Referral data — if you join through a referral link, the code you used and the organisation it belongs to.
We do not run analytics or advertising trackers. See the Cookie Notice for the cookies we set.
Why we use it, and the lawful basis
| Purpose | Lawful basis |
|---|---|
| Creating and running your account and workspace | Performance of our contract with you |
| Taking payment, managing subscriptions, paying referral commission | Performance of our contract; legal obligation (accounting records) |
| Sending service emails — verification codes, password resets, billing notices, payout statements | Performance of our contract |
| Keeping the service secure: sessions, rate limiting, lockouts, audit trail, error monitoring | Our legitimate interest in protecting the service and its users |
| Answering support requests | Performance of our contract; legitimate interest |
| Complying with law, and establishing or defending legal claims | Legal obligation; legitimate interest |
We do not send marketing email. If we start, we will ask first and you will be able to opt out at any time.
Who we share it with
We use a small number of service providers to run AgentHub: hosting, database, storage, payments, email delivery, error monitoring, uptime monitoring and a help desk. Each acts on our instructions under a written contract. The full list, with where each one holds data and the basis for any transfer outside the UK, is the sub-processor list in the Data Processing Addendum.
We may also disclose data where the law requires it, or to professional advisers, or as part of a sale or reorganisation of our business, including a transfer of the AgentHub business to a company in our group (in which case this notice would continue to apply).
International transfers
Our application and database run in the European Union (Frankfurt). Some of our providers are based in the United States or hold support data there. Where personal data leaves the UK we rely on the UK's adequacy regulations for the EEA, and on the International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or a provider's certification under the UK Extension to the EU-US Data Privacy Framework, as listed per provider in the Data Processing Addendum.
How long we keep it
- Account and organisation data — for as long as your account is open. When you close it we delete or anonymise it within 90 days, apart from what we must keep for the reasons below.
- Billing records — six years from the end of the financial year they relate to, as HMRC requires.
- Security and audit records — sign-in and rate-limiting records for up to 90 days; the workspace audit trail for the life of the account, with the IP address and browser details on its entries removed after 90 days.
- Server request logs — the method, path and status of each request (never the query string), held by our hosting provider for up to 7 days.
- Invitations — deleted when they expire.
- Support correspondence — up to two years after the request is closed.
- Error reports — 90 days.
Security
Data is encrypted in transit and at rest with our providers. Access to production systems is limited to the people who run the service. Passwords are hashed, sessions expire, and sign-in attempts are rate-limited. No system is perfectly secure; if we learn of a breach that affects you we will tell you and the regulator as the law requires.
Your rights
Under the UK GDPR you can ask us to:
- give you a copy of the personal data we hold about you (access);
- correct anything inaccurate (rectification);
- delete it (erasure) — subject to the retention reasons above;
- restrict or object to how we use it, including where we rely on legitimate interests;
- give you your data in a portable format.
You can change your name, email and password from the account settings page. For anything else, email support@agenthub.travel. We will reply within one month.
Children
AgentHub is a business service and is not intended for anyone under 18. We do not knowingly collect data about children from agency users.
Complaints
If you are unhappy with how we handle your data, please tell us first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Changes to this notice
Each version carries an effective date at the top of this page. For a material change we will tell you by email, and you will be asked to accept the new version the next time you sign in.
Contact
support@agenthub.travel · SPR Software Ltd, Crown House, 27 Old Gloucester Street, London, WC1N 3AX.