Last updated: August 26, 2026
Introduction
Midstay is a corporate retreat planning company. Our specialist retreat strategists design and deliver company offsites, team retreats, leadership retreats, and employee celebration trips for organizations around the world, with structured planning frameworks built specifically around business objectives like leadership alignment, culture, and collaboration. Delivering that kind of program well means handling a meaningful amount of personal information – about the people who book with us, the colleagues who travel on the retreats we run, and the visitors who browse midstay.com to research their options.
This Privacy Policy explains what personal information Midstay collects, why we collect it, how we use and protect it, who we share it with, and what rights you have over it. It applies to our website, our retreat planning and consultation process, and the retreats we deliver on behalf of client organizations.
If, after reading this policy, anything is unclear, you can reach our privacy team directly at privacy@midstay.info.
Who This Policy Applies To
This policy covers personal information we collect from:
Prospective and current corporate clients who contact Midstay to plan a retreat, request a proposal, or book our services. Retreat attendees – the employees, managers, and executives of client organizations who take part in a Midstay-organized retreat, whether or not they interacted with us directly. Website visitors who browse midstay.com, subscribe to our retreat-planning newsletter, or use our online booking and consultation tools. Vendors, venue partners, facilitators, and other individuals we work with to deliver retreats.
It does not cover the practices of third-party websites we link to, or of client organizations’ own internal systems once they have received information from us.
What Personal Information Midstay Collects
The information we collect depends on how you interact with us.
Contact and account information. Name, work email address, phone number, job title, and company name, typically provided when you request a proposal or book a call.
Retreat and program information. Details we need to design a program around your team’s goals – team size, preferred destinations or dates, budget range, working styles, desired outcomes (such as leadership alignment or team bonding), and, where relevant to logistics, dietary requirements or accessibility needs for attendees. Much of this is what allows our retreat specialists to move from a generic itinerary to a program that is actually tailored to your organization.
Attendee information. When a client organization books a retreat, its administrator may submit names, emails, dietary or accessibility requirements, travel details, and similar information about the colleagues who will attend. We process this information on the client’s behalf to coordinate venues, transportation, workshops, and on-site logistics.
Payment and billing information. Billing name and address, invoice details, and payment information needed to process transactions. Card and bank details are handled by our payment processing partners; Midstay does not store full card numbers on its own systems.
Communications. Records of your calls, emails, live chat conversations, and consultation notes with our retreat coordinators, kept so that planning stays consistent and nothing gets lost between our operations team, local partners, and your organization.
Technical and usage information. Information collected automatically when you use midstay.com, including IP address, browser and device type, pages viewed, and referral source, gathered through cookies and similar technologies described below.
We do not knowingly collect sensitive categories of personal information (such as health data) beyond what is voluntarily and specifically provided to accommodate dietary or accessibility needs during retreat planning, and we use that information only for that purpose.
How Midstay Collects Information
Most information comes directly from you – when you fill out a proposal request, book a call, sign up for our newsletter, or communicate with our team. Some information comes from your organization, when a client administrator submits attendee details on behalf of colleagues attending a retreat. Some information is collected automatically through cookies and analytics tools when you use our website. And some information may come from our venue, facilitator, and logistics partners in the course of coordinating a retreat – for example, confirmation of a booking.
How Midstay Uses Your Information
We use personal information to:
Design and personalize retreat proposals and itineraries around your team’s size, goals, culture, and working style. Coordinate the logistics of a retreat – venue booking, transportation, workshops, food and beverage, and on-site concierge support – from first consultation through to final wrap-up. Communicate with you about proposals, bookings, itinerary changes, and support requests. Process payments and manage invoicing. Plan for safety and contingencies during international corporate travel and group experiences, including sharing necessary attendee details with venues and local partners. Improve our retreat planning process using feedback, post-event follow-ups, and operational data – the same continuous-improvement loop that feeds our case studies and refined itineraries. Send retreat-planning tips, resources, and updates about our services, where you’re always with the option to unsubscribe. Maintain the security of our website and systems, and prevent fraud or misuse. Comply with legal, tax, and regulatory obligations in Singapore and the jurisdictions where we operate.
Legal Bases for Processing (GDPR/UK GDPR)
For individuals in the European Economic Area and the United Kingdom, we rely on the following legal bases to process personal information: performance of a contract, where processing is necessary to plan and deliver a retreat you or your organization has booked; legitimate interests, where processing helps us run and improve our business in ways that do not override your rights, such as service improvement or fraud prevention; consent, for marketing communications and non-essential cookies, which you can withdraw at any time; and legal obligation, where processing is required to comply with tax, accounting, or other applicable law.
Automated Tools on Our Website
Parts of midstay.com use automated tools to make early-stage retreat planning faster and more self-service. Our retreat cost estimator, for example, generates an automated, non-binding estimate based on the information you provide, such as group size and destination, so you can get a sense of scope before reaching out. These tools are a starting point, not a final word: every estimate is reviewed and finalized by our retreat specialists before any proposal or booking is confirmed. Midstay does not use automated decision-making or profiling that produces legal effects, or similarly significant effects, concerning you.
Cookies and Similar Technologies
midstay.com uses cookies and similar tracking technologies to keep the site working properly and to understand how visitors use it. We use different categories of cookies: strictly necessary cookies, required for core site functionality and security, which cannot be switched off; functional cookies, which remember preferences such as language or previously entered information; performance and analytics cookies, which help us understand how visitors interact with the site so we can improve it; and advertising cookies, which may be used to measure the effectiveness of our marketing and show relevant content on other platforms.
You can manage or withdraw your cookie preferences at any time through the cookie settings tool on our website, or through your browser settings. Blocking some cookies may affect how parts of the site function. Further detail is available in our separate Cookie Policy.
How Midstay Shares Your Information
Midstay does not sell personal information. We share personal information only where necessary to deliver our services or as required by law, with the following categories of recipients:
Venues, facilitators, activity providers, and local operations partners in our vetted network, who receive the attendee information needed to prepare and run a specific retreat. Payment processors, who handle transaction and billing data on our behalf. Cloud hosting, IT infrastructure, and website analytics providers, who support the systems midstay.com and our internal platforms run on. Customer support and communication tools, such as live chat and email service providers, used to manage client and attendee communications. Professional advisers, including lawyers, auditors, and insurers, where necessary for our business operations. Regulators, courts, or law enforcement authorities, where disclosure is required by law or necessary to protect the rights, property, or safety of Midstay, our clients, or others.
Any third party that processes personal information on our behalf is bound by contractual obligations to keep it confidential and use it only for the purposes we specify.
International Data Transfers
Midstay is headquartered in Singapore and organizes retreats across more than 100 destinations worldwide, which means personal information may be transferred to, stored, and processed in countries other than the one where it was originally collected – including the country where a given retreat takes place. Where we transfer personal information out of the European Economic Area, the United Kingdom, or Switzerland, we rely on recognized safeguards such as Standard Contractual Clauses or equivalent mechanisms to ensure the information continues to receive an appropriate level of protection.
Data Retention
We keep personal information only for as long as it is needed for the purposes it was collected for – typically for the duration of a client relationship or a specific retreat engagement, plus a reasonable period afterward to handle follow-up questions, satisfy accounting and tax requirements, and resolve any disputes. Where information is no longer needed, we securely delete or anonymize it. You can ask us to delete your information sooner by contacting privacy@midstay.info, subject to the exceptions described in the rights section below.
How Midstay Protects Your Information
We apply the same level of care to data security that we apply to on-site retreat safety and contingency planning: layered, practical, and continuously reviewed. This includes encryption of data in transit, access controls that limit who within Midstay and our partner network can view personal information, contractual security requirements for the vendors and hosting providers we rely on, and regular review of our internal practices as our operations grow across new destinations and partners.
No system can guarantee perfect security, and we cannot promise that information you transmit to us will never be accessed by an unauthorized party. If a data breach occurs that is likely to affect your rights, we will notify affected individuals and relevant authorities in line with our legal obligations.
Your Privacy Rights
Depending on where you live, you have rights over the personal information Midstay holds about you. To exercise any of the rights below, contact us at privacy@midstay.info. We may need to verify your identity before responding, and we will respond within the timeframe required by applicable law.
If you are in Singapore (PDPA). You may request access to the personal information we hold about you, ask us to correct inaccurate information, and withdraw any consent you previously gave for us to collect, use, or disclose your information – subject to legal or contractual restrictions. Midstay’s Data Protection team is reachable at privacy@midstay.info.
If you are in the EEA or UK (GDPR/UK GDPR). You have the right to access the personal information we hold about you; request correction of inaccurate or incomplete data; request erasure of your data, subject to certain exceptions; object to processing based on legitimate interests, including for direct marketing; request that we restrict processing in certain circumstances; request a portable copy of the data you provided to us; and withdraw consent at any time where processing is based on consent.
If you are in California (CCPA/CPRA). You have the right to know what personal information we have collected about you and how it has been used and shared; request deletion of your personal information, subject to certain exceptions; correct inaccurate personal information; and opt out of the sale or sharing of personal information – although Midstay does not sell personal information and does not share it for cross-context behavioral advertising. You will not receive discriminatory treatment for exercising any of these rights.
Children’s Privacy
Midstay’s services are designed for businesses and their employees. Our website and services are not directed at children, and we do not knowingly collect personal information from individuals under 16. If you believe a child has provided us with personal information, please contact us at privacy@midstay.info so we can address it.
Third-Party Links
Our website and retreat materials may contain links to third-party websites, such as partner platforms. We are not responsible for the privacy practices or content of those external sites, and we encourage you to review their privacy policies before providing any personal information.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, our services, or the law. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify clients directly. We encourage you to review this policy periodically.
Contact Us
If you have questions about this Privacy Policy or how Midstay handles your personal information, you can reach us at:
MIDSTAY PTE. LTD. UEN (ACRA Registration No.): 202140453Z 160 Robinson Road, #14-04 Singapore Business Federation Centre Singapore 068914
Email: privacy@midstay.info
Website: www.midstay.com
