Privacy Policy
Last updated: 31 October 2026
This Privacy Policy explains how CaptiveWiFi, a division of ClubWizard Ltd ("we", "us", "our"), collects, uses and protects personal data when you use our website at captivewifi.com and our guest WiFi captive portal platform. It applies to visitors to our website, people who contact us or book a demo, venue operators who use our platform, and (on behalf of those venues) guests who connect to WiFi that we power.
1. Who we are
Data Controller: ClubWizard Ltd (trading as CaptiveWiFi)
Registered in England and Wales
Registered address: 26 Fitzroy Square, London, W1T 6ES
ICO Registration: Z8359853
General contact: [email protected]
Data Protection Officer:
[email protected] or +44 20 7248 0001
Write to the Data Protection Officer at the registered address above.
Access your data: captivewifi.com/my-data (WiFi guests)
2. What personal data we collect
If you visit our website
- IP address, device type, operating system and browser (standard server logs)
- Your cookie choice, and, only if you accept analytics, how you use the site (see section 10)
If you contact us, book a demo or use live chat
- Name, email address, venue name, website, number of locations, how you heard about us and what you tell us about your challenges
- The campaign or advertisement you came from (for example UTM tags or an ad click ID), if you arrived from one
- What you have typed into the demo form so far. We save your email address and any other details you have entered as you go, even if you do not press submit, so that we can follow up (see section 4)
- Your meeting details, if you book a call with us, and the content of any messages you send us or type into live chat
If you are a guest connecting to WiFi at a venue that uses CaptiveWiFi
- Name and email address (as provided at WiFi login)
- IP address and approximate geolocation
- Device type, operating system and browser
- WiFi connection timestamps and frequency of visits
- Marketing consent status and opt-in timestamp
- Feedback and survey responses submitted through the platform
You are never required to give us personal data, but we may not be able to provide a service or answer you without it.
3. Lawful basis for processing
| Processing activity | Lawful basis (UK GDPR Article 6) |
|---|---|
| Guest WiFi login data capture with explicit opt-in | Consent (Art. 6(1)(a)) |
| Website analytics cookies (Google Analytics, Microsoft Clarity) | Consent (Art. 6(1)(a)) |
| Keeping a record of your cookie choice | Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f)) |
| Answering enquiries, demo requests and live chat | Taking steps at your request before a contract (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)) |
| Saving partly completed demo forms and following up by email | Legitimate interests (Art. 6(1)(f)): helping people who showed interest to finish their request |
| Operating and improving the CaptiveWiFi platform | Legitimate interests (Art. 6(1)(f)) |
| Communicating with venue operators about their account | Contract performance (Art. 6(1)(b)) |
| Compliance with legal obligations | Legal obligation (Art. 6(1)(c)) |
4. How we use personal data
We use data collected through the CaptiveWiFi platform to:
- Authenticate guests on venue WiFi networks
- Provide venue operators with guest analytics and CRM sync features
- Enrol guests in loyalty programmes they have consented to join
- Send marketing communications where consent has been given (operators manage this via their CRM)
- Improve platform performance and security
We use data from our website and enquiries to:
- Respond to your enquiry, arrange a demo and run our sales and onboarding process
- If you start the demo form and leave without finishing, send you one reminder email about an hour later
- If you complete the demo form, send you a short series of follow-up emails (three) about the product
- Understand how the site is used, but only if you accept analytics
Every email we send includes an unsubscribe link, and we stop as soon as you use it. You can also ask us to stop at any time.
5. Data controller vs. data processor
When a hospitality venue uses CaptiveWiFi, that venue is the data controller (a "business" under US state privacy laws) for its guests' personal data. CaptiveWiFi (ClubWizard Ltd) acts as the data processor (a "service provider"), processing data only on behalf of and under the documented instructions of the venue operator.
Our Data Processing Agreement, incorporated into our Terms of Service, sets out the obligations of each party. For our own website, enquiries and customer accounts, we are the data controller.
6. Data retention
Guest data collected through the WiFi captive portal is retained for as long as the venue operator's account is active, or as otherwise specified in the Data Processing Agreement. Operators may request deletion of guest records at any time via the dashboard or by contacting us.
Website enquiry data (contact form and demo request submissions, including partly completed forms) is deleted automatically 12 months after your last interaction with us. If you unsubscribe from our emails, we keep only your email address on a suppression list so that we never contact you again by mistake. If you become a customer, your details are held separately as part of your account, for the life of the account and the period needed for legal and accounting obligations. Records of your cookie choice are kept for 12 months and then deleted automatically.
7. Who we share data with
We do not sell personal data, and we do not share it for advertising across other companies' sites. We share data only with:
- CRM and loyalty platforms that venues have connected (e.g. SevenRooms, Klaviyo, Airship, OpenTable), always under the venue operator's control
- Infrastructure and service providers who process data on our behalf under data processing agreements: hosting (DigitalOcean, in the United Kingdom), email delivery, billing (for example GoCardless and Chargebee), meeting booking (Calendly) and internal team notifications (Slack)
- Google (Analytics) and Microsoft (Clarity), only if you accept analytics
- Our live chat provider (JivoChat), only if you choose to open the chat on our website, to run the conversation you start
- Legal or regulatory authorities where required by law, or to protect our rights, property or safety and those of others
Our staff and service providers with access to personal data are bound by confidentiality obligations.
8. International transfers
Our website and platform are hosted on servers in the United Kingdom. Some of our other providers, including Google, Microsoft, Jivo, Calendly and Slack, may process data outside the United Kingdom, including in the United States. Where we transfer personal data outside the UK, we rely on an adequacy decision (including the UK-US data bridge for certified providers) or on the safeguards UK GDPR requires, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
9. Security
We use technical and organisational measures to protect personal data against loss, misuse and unauthorised access, including access controls, encryption in transit and confidentiality obligations on our staff and providers. No system is completely secure, so please also protect your own devices and passwords.
If a personal data breach is likely to put people at risk, we will notify the Information Commissioner's Office within 72 hours of becoming aware of it, tell affected venue operators without undue delay, and notify individuals directly where the law requires.
10. Cookies
Our website uses one strictly necessary first-party cookie (cw-consent) to remember your cookie choice, and one first-party cookie (cw_visited, 90 days) that shows a "Welcome back" headline when you return to our homepage. cw_visited holds no personal data, is not used for analytics or advertising and is never shared, so it does not depend on your cookie choice. Analytics cookies (Google Analytics 4 and Microsoft Clarity) are off by default and only load after you click "Accept analytics". If you click "No thanks", or make no choice, neither loads and no analytics cookies are set. We do not use marketing or advertising cookies. If you open our live chat, JivoChat sets its own cookies and storage to run the conversation.
If your browser sends a Global Privacy Control signal, we treat analytics as off. You can change or withdraw your choice at any time using "Cookie settings" in the site footer.
To prove that we asked for and recorded your choice, we keep a consent record (time, choice, wording version, a random consent ID and a shortened IP address) for 12 months, then delete it automatically. Our lawful basis is legal obligation and our legitimate interest in demonstrating compliance. The full details, including a list of every cookie, are on our Cookies page.
11. Your rights (UK and EEA)
Under UK GDPR you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request erasure ("right to be forgotten")
- Object to or restrict processing, including direct marketing
- Data portability (where applicable)
- Withdraw consent at any time (where consent is the lawful basis)
If you have used WiFi powered by CaptiveWiFi, you can view the personal data held about you by signing in at our Access your data page.
To exercise any of these rights, email our Data Protection Officer at [email protected] or write to the registered address above. We may ask for information to confirm who you are. We will respond within one month.
If your data was collected through WiFi at a venue, that venue is the controller. Send your request to the venue, or to us and we will pass it on and help them respond.
You also have the right to lodge a complaint with the Information Commissioner's Office: ico.org.uk.
12. Your privacy rights in the United States
This section applies to residents of California and of other US states with consumer privacy laws (such as Virginia, Colorado, Connecticut, Texas and Oregon), to the extent those laws apply to us. Where it conflicts with the rest of this policy for such residents, this section prevails.
Guests at a venue. For guest data collected through WiFi at a venue, we act as the venue's service provider. We process that data only on the venue's instructions and under a written contract, and we do not sell it, share it for cross-context behavioural advertising, or use it for any purpose outside that contract. The venue decides how the data is used, so please send requests about your WiFi guest data to the venue. We will help the venue respond.
Visitors and enquiries on our own website. In the last 12 months we have collected the following categories of personal information: identifiers (name, email address, IP address), internet or network activity (device and, with your consent, site usage), and commercial information you give us when you enquire. We collect it directly from you and from your browser, and we use it for the purposes in section 4. We disclose it to the service providers listed in section 7. We do not sell or share personal information, we do not collect sensitive personal information through our website, and we do not knowingly collect information from children under 16.
Your rights. Where the law applies, you may ask to know what personal information we hold and how we use it, to access or receive a copy of it, to correct it, to delete it, and to opt out of any sale or sharing (which we do not do). If we decline a request, you may appeal by replying to our decision. We will not discriminate against you for using these rights.
How to make a request. WiFi guests can access their data online. For anything else, email [email protected]. We will confirm your identity, and an authorised agent may act for you with your written permission. We will respond within 45 days, and tell you if we need more time. We honour the Global Privacy Control signal as described in section 10.
13. Children
Our website and services are not directed at children under 16, and we do not knowingly collect their personal data through our website. Venues are responsible for how their WiFi service is offered to guests.
14. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be communicated to venue operators via email. The "Last updated" date at the top of this page reflects the most recent revision.
15. Contact
For any privacy-related queries, contact our Data Protection Officer at [email protected], or our team at [email protected]. WiFi guests can also access their data online.