Last updated 26 August 2026
CSA Hospitality Marketing (“CSA”, “we”, “us”) operates hospitality and wedding-venue marketing services for its clients. This policy explains what information we process, why we process it, how long we keep it, and how to have it deleted. It covers this website and the internal software application we operate on the Meta platform under the name CSA AI OS.
Who this application is for
CSA AI OS is an internal business tool. It is used only by authorised CSA staff to administer advertising accounts, Facebook Pages, and website conversion tracking on behalf of venue clients who have engaged us. It is not a consumer product, it has no public sign-up, and members of the public do not create accounts on it.
Information we process
From CSA staff who use the application
- Meta account identifiers, such as the user ID and display name of the staff member who authorises the application
- Access tokens issued by Meta, used to make requests on the authorised account’s behalf
- The business portfolios, advertising accounts, Pages, and datasets that account is permitted to administer
From client advertising accounts
- Campaign, ad set, and advertisement configuration, including budgets, schedules, audience settings, and creative text and images
- Aggregated performance measurements, such as impressions, reach, clicks, click-through rate, cost per click, and amount spent
- Aggregated conversion counts reported by a client’s Meta dataset, for example the number of pricing-guide downloads or enquiry submissions
From visitors to websites we operate for clients
- Details a visitor chooses to submit through an enquiry or tour-request form, such as name, email address, telephone number, event date, and estimated guest count
- Technical and usage information collected by analytics and advertising tags, such as IP address, browser and device type, pages viewed, referring website, and cookie or pixel identifiers
We do not process special categories of personal data, and we do not knowingly collect information from children under 13.
Why we process it
- To deliver the service our clients have engaged us for. Creating, publishing, adjusting, and reporting on advertising campaigns.
- To measure results. Understanding which advertisements and web pages lead to enquiries, so that budget is directed usefully.
- To pass enquiries to the venue. A form submission is delivered to the venue that the visitor contacted, so they can respond.
- To operate and secure our systems. Diagnosing faults, preventing abuse, and keeping records of what was changed and when.
We do not sell personal information. We do not use it to build profiles for unrelated purposes, and we do not use client data to advertise for any party other than that client.
Who we share it with
- The venue client concerned. Enquiries and reporting are shared with the venue the visitor contacted.
- Meta Platforms. Requests made through the Meta APIs are processed by Meta under its own terms and privacy policy.
- Service providers we rely on to run our websites, email, analytics, and customer-relationship tools, acting on our instructions.
- Where the law requires it, or to establish or defend legal claims.
How long we keep it
- Access tokens are short-lived and are discarded when they expire or when access is revoked.
- Advertising configuration and performance records are retained by Meta according to its own retention periods, and by us for the duration of the client engagement.
- Enquiry details are retained for as long as needed to respond and to keep an accurate record of the enquiry, and are deleted on request.
How to request deletion of your data
You may ask us to delete information we hold about you at any time, and you do not need an account to do so.
- By email. Write to lincoln.allen@csahospitality.com with the subject line Data deletion request. Please tell us the email address or telephone number you used, and the venue you contacted, so we can find your record.
- What happens next. We acknowledge every request within five business days and complete deletion within thirty days, then confirm in writing once it is done.
- Revoking application access. A CSA staff member may remove CSA AI OS at any time from their Meta account under Settings, Business integrations, which immediately ends the application’s access to that account.
You may also use the same address to ask what information we hold about you, to have it corrected, or to object to how it is used. Where a request concerns information held on a client’s behalf, we will pass it to that client and assist them in responding.
Cookies and tracking
Websites we operate for clients use analytics and advertising technologies, including the Meta pixel and Google Analytics, to measure how pages perform and to report whether an advertisement led to an enquiry. Most browsers allow you to refuse or delete cookies through their settings. Refusing them does not prevent you from using the sites or submitting an enquiry.
Security
Access to advertising accounts and enquiry records is limited to staff who need it. Credentials and access tokens are stored so that they are not publicly readable, and are rotated when a member of staff leaves or when we have reason to believe a credential has been exposed.
Changes to this policy
If we change this policy we will revise the date shown at the top of the page. Material changes affecting how enquiry information is handled will also be communicated to the affected clients.
Contact
CSA Hospitality Marketing
Email: lincoln.allen@csahospitality.com
Web: csahospitality.com