Last updated: 13 April 2026
Effective date: 13 April 2026
Beautiful Destinations Limited and its group companies ("Beautiful Destinations", "BD", "we", "us", "our") operate the Beautiful Destinations website, social channels, and the Content Operating System (the "COS" or "Platform"), a workflow tool used by BD staff and authorised clients to plan, produce, approve, and publish social media content.
This policy explains what personal data we collect, how we use it, the legal bases for processing, who we share it with, and the rights you have. It applies to visitors of beautifuldestinations.com, subscribers to BD marketing, clients and creators who work with us, and users of the COS.
If you only use our website or receive marketing from us, Sections 1 to 6 and 10 to 14 apply to you. If you use the COS, Sections 7 to 9 also apply.
Beautiful Destinations Limited (registered in England and Wales, company number 09004889, VAT number 189825055) is the data controller for personal data collected through our website, marketing activities, and the COS. You can reach our privacy team at:
Information you give us. Name, email address, company, job title, phone number, country, billing address, and any other information you choose to provide through forms, downloads, event registrations, sales conversations, or contract negotiations.
Information from your use of our website. IP address, device identifiers, browser type, referring URL, pages visited, and dates and times of access. We collect this through cookies and similar technologies. See our Cookie Notice for details.
Information from the COS. Login credentials (including single sign-on identifiers), user profile details, project briefs and documents you upload, comments and approvals, and records of actions you take in the tool (audit logs).
Information from connected social accounts. When you link a Meta, TikTok, YouTube, or LinkedIn account to the COS through OAuth, we receive data that the platform shares with us based on the scopes you approve. Section 7 lists this in detail.
Information from third parties. We may receive data from business partners, lead enrichment providers, credit reference agencies (for client onboarding), and public sources such as company registries.
For the purposes of the CCPA/CPRA, in the 12 months before the date of this policy we have collected the following categories of personal information:
| Category | Collected | Sources | Purpose |
|---|---|---|---|
| Identifiers (name, email, IP, account ID) | Yes | You, your device, third parties | Service, account, marketing |
| Customer records (phone, billing, company) | Yes | You, your employer | Contracting, billing |
| Commercial information (services, project history) | Yes | You, your employer | Service delivery |
| Internet or network activity (browsing, COS actions) | Yes | Your device, cookies | Security, analytics, product |
| Geolocation (coarse, IP-derived) | Yes | Your device | Security, analytics |
| Professional or employment (job title) | Yes | You, employer, enrichment | B2B sales, service |
| Inferences | Yes | Analytics | Marketing, product |
| Audio, electronic, visual (project media) | Yes | You, creators, clients | Project delivery |
| Sensitive personal information | No* | - | *Account credentials only, used as permitted by CCPA §7027(m) |
| Biometric, genetic, health, protected class | No | - | Not collected |
| Education information | No | - | Not collected |
We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under the CPRA.
We do not sell personal data.
BD operates in the UK, the UAE, and the US, and uses service providers located in a number of countries. Where we transfer personal data outside the UK or EEA, we rely on adequacy decisions, the UK International Data Transfer Addendum, the EU Standard Contractual Clauses, or other valid safeguards. Contact privacy@beautifuldestinations.com for a copy of the safeguards we use for a specific transfer.
The COS connects to social platforms through OAuth so that BD staff and authorised client users can draft, schedule, publish, and measure content. You control these connections through your platform account and can revoke them at any time from within the COS or from the platform's own settings.
We only request the minimum scopes needed for the feature you are using. We do not sell data obtained through any platform integration. We do not use platform data to train artificial intelligence models that serve other clients, and we do not use it for advertising. We store access tokens encrypted at rest and refresh them only while your connection is active.
Scopes we may request: pages_show_list, pages_read_engagement, pages_read_user_content, pages_manage_metadata, pages_manage_posts, pages_manage_engagement, instagram_basic, instagram_content_publish, instagram_manage_comments, instagram_manage_insights, business_management, read_insights, ads_read.
What we do with each:
pages_show_list, business_management: list the Pages and Business accounts you manage so you can pick which to connect.pages_read_engagement, pages_read_user_content, instagram_basic: read content you or your organisation have posted and engagement data (likes, comments, reach) for reporting.pages_manage_posts, instagram_content_publish: publish or schedule content you or a client has approved in the COS.pages_manage_metadata, pages_manage_engagement, instagram_manage_comments: update Page settings, respond to comments, and moderate on behalf of the account when you ask us to.instagram_manage_insights, read_insights, ads_read: produce performance reports, audience insights, and (where agreed) ad-spend analysis.We follow Meta's Platform Terms, Developer Policies, and the Limited Use requirements that apply to any restricted data. We retain Meta data only for as long as needed to provide the service, and we delete it when your connection is revoked or when retention limits (see Section 13) are reached.
Scopes we may request: user.info.basic, user.info.profile, user.info.stats, video.list, video.upload, video.publish, video.insights (where available).
What we do with each:
user.info.basic, user.info.profile: show whose account is connected and display profile basics inside the COS.user.info.stats, video.insights: produce performance reports for content posted to the connected account.video.list: list videos you or your organisation have posted so they can be reviewed and reported on.video.upload, video.publish: upload and publish content you or a client has approved in the COS.We follow TikTok's Developer Terms of Service, Platform Guidelines, and Data Use rules. Data obtained through TikTok is used only to deliver the features above and is not shared with any third party except the service providers listed in Section 5.
Scopes we may request: https://www.googleapis.com/auth/youtube.readonly, https://www.googleapis.com/auth/youtube.upload, https://www.googleapis.com/auth/youtube, https://www.googleapis.com/auth/youtube.force-ssl, https://www.googleapis.com/auth/yt-analytics.readonly, https://www.googleapis.com/auth/yt-analytics-monetary.readonly.
What we do with each:
youtube.readonly: list channels, playlists, and videos so you can pick what to manage.youtube.upload: upload videos that you or a client has approved in the COS.youtube, youtube.force-ssl: update video metadata, manage playlists, and moderate comments when you ask us to.yt-analytics.readonly, yt-analytics-monetary.readonly: produce performance and (where agreed) revenue reports for the connected channel.Google API disclosure. The COS's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to train generalised artificial intelligence or machine learning models. You can revoke the COS's access at any time through your Google Account security settings.
Scopes we may request: openid, profile, email, w_member_social, r_organization_social, w_organization_social, rw_organization_admin, r_ads, r_ads_reporting, r_organization_admin (where your organisation has granted these).
What we do with each:
openid, profile, email: sign you in and show which account is connected.w_member_social: publish posts to your personal LinkedIn feed when you or a client has approved them in the COS.r_organization_social, w_organization_social, rw_organization_admin, r_organization_admin: read and publish content and manage settings for Company Pages you administer.r_ads, r_ads_reporting: produce reporting on paid LinkedIn activity, where agreed.We follow LinkedIn's API Terms of Use and Marketing Developer Platform rules.
We apply technical and organisational measures appropriate to the risks of our processing, including role-based access control, encryption in transit and at rest, multi-factor authentication, and least-privilege rules for BD staff.
We use strictly necessary cookies to run the site and the COS. We use analytics and marketing cookies only with your consent. Our Cookie Notice lists the cookies we set, their purpose, duration, and how to change your choices.
European Union and United Kingdom (GDPR / UK GDPR). All rights listed above apply. Contact privacy@beautifuldestinations.com.
California (CCPA / CPRA). You have the right to:
To exercise these rights email privacy@beautifuldestinations.com with "California request" in the subject line, or use the links in our website footer. We verify requests using the email on file and, where needed, one additional piece of information that matches our records.
Authorised agents. A consumer may use an authorised agent to submit a request. The agent must provide a written, signed permission from the consumer, and we may contact the consumer to confirm identity and permission.
Other US states (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon). Rights comparable to those above apply. Use the same contact route.
Brazil (LGPD). You have rights of confirmation, access, correction, anonymisation, deletion, portability, and withdrawal of consent. Our Brazil contact is privacy@beautifuldestinations.com.
Canada (PIPEDA). You can access and correct your personal data, and withdraw consent subject to legal or contractual limits.
Asia-Pacific (including Singapore PDPA, Australia Privacy Act, Japan APPI, Hong Kong PDPO). We comply with the local laws that apply. Contact privacy@beautifuldestinations.com.
Middle East (including UAE PDPL, KSA PDPL). We comply with the local laws that apply. Contact privacy@beautifuldestinations.com.
Other regions. Contact us for guidance on rights in your country.
Our Services are not directed at children. We do not knowingly collect personal data from children under 16 in the EEA and UK, or under 13 in the US. If you believe a child has given us personal data, email privacy@beautifuldestinations.com and we will delete it.
We do not use solely automated decision-making that produces legal or similarly significant effects. Where AI features in the COS suggest creators, draft briefs, or flag content, a human reviews the output before it affects you. You can ask for human review of any decision by emailing privacy@beautifuldestinations.com.
We apply technical and organisational measures appropriate to the risks of our processing, including encryption in transit and at rest, multi-factor authentication, role-based access, logging, and regular testing. If a personal data breach is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours of becoming aware and will notify affected individuals without undue delay where the risk is high.
We update this policy when our services, the law, or platform rules change. The "Last updated" date at the top shows the most recent version. Material changes will be notified by email to active account holders and posted on beautifuldestinations.com. Prior versions are available on request.
For any privacy question, request, or complaint, email privacy@beautifuldestinations.com or write to Beautiful Destinations Limited, 107 Cheapside, London EC2V 6DN, United Kingdom.