Privacy Policy

1. Who we are

Nomad House Club (nomadhouseclub.com) is operated by:

We are the data controller for personal data processed through this website. This policy explains what data we collect, why we collect it, and your rights under UK GDPR and the Data Protection Act 2018.

2. Data we collect and why

2.1 Waitlist applications

When you submit a waitlist application we collect:

• Full name
• Email address
• Country of residence
• Profile type (family, remote worker, retiree, or investor)
• Optional personal message

Legal basis: Legitimate interests — processing your application to decide whether to grant you access to the community.

Retention: Indefinitely for approved applicants (see member data below). Rejected applications are retained for 12 months, then deleted.

2.2 Member profiles

Once admitted, members may provide:

• Name, biography, and profile photo
• Countries of residence
• Profile type
• Property listings (location, photos, availability)

Legal basis: Contract performance — providing the community service you signed up for.

Retention: For as long as your account remains active. Deleted on account removal, except where retention is required by law.

2.3 Private messages

Messages exchanged between members are stored to enable the messaging feature.

Legal basis: Contract performance.

Retention: Retained while both accounts are active. Deleted when either account is removed.

2.4 Authentication data

Authentication is handled by Cloudflare Access using a one-time PIN sent to your email. We do not store passwords. Cloudflare sets an HttpOnly session cookie (CF_Authorization) to maintain your session.

Legal basis: Legitimate interests — securing access to the member platform.

2.5 Server logs and analytics

We use Simple Analytics, a privacy-first analytics service that does not use cookies, does not track individuals, and does not share data with third parties. Only aggregated page-view statistics are collected.

Cloudflare, as our infrastructure provider, may log IP addresses and request metadata as part of their standard DDoS protection and CDN services. This is governed by Cloudflare's Privacy Policy.

Legal basis: Legitimate interests — operating and securing the service.

3. Who we share data with

We do not sell, rent, or trade your personal data. We share data only with the following service providers, under data processing agreements:

4. International transfers

Cloudflare operates globally including within the UK, EEA, and the United States. Transfers to the US are made under Cloudflare's Standard Contractual Clauses and their participation in the UK-US Data Bridge framework. Mailjet is based in the EU (France). All transfers are made with appropriate safeguards.

5. Your rights

Under UK GDPR you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — ask us to delete your data ("right to be forgotten")
• Restriction — ask us to restrict processing of your data
• Portability — receive your data in a structured, machine-readable format
• Object — object to processing based on legitimate interests
• Withdraw consent — where processing is based on consent, you may withdraw it at any time

To exercise any right, email us at hola@nomadhouseclub.com. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

6. Security

All data is stored within Cloudflare's infrastructure, which provides encryption at rest and in transit (TLS 1.3). Access to the member platform is protected by Cloudflare Access with one-time PIN authentication. We apply the principle of least privilege to all internal data access.

7. Children

Nomad House Club is not directed at persons under the age of 18. We do not knowingly collect personal data from children. If you believe a child has submitted data to us, please contact us and we will delete it promptly.

8. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via email to members. The "Last updated" date at the top of this page always reflects the most recent version.

9. Contact

For any privacy-related question or request: