Updated: February 2019
Your personal information allows us to provide the products and services you have asked for, as well as enabling us to improve those products and services by understanding your interests and preferences. By understanding what you like (and what you don’t) we are able to personalise your experience, show relevant adverts and improve your stay.
Who we are
GLH Hotels Management (UK) Limited (“we”, “our”, “us”) is the data controller when you provide information to any of our brands, including: Thistle, Thistle Express, Amba Hotels, Every Hotels, Guoman Hotels and Hard Rock Hotel London.
What information do we collect?
When you interact with our products and services, for example when browsing our website or booking a hotel room, we collect information about you and that particular interaction. Generally, this may include your personal data which means personal details from which you can be identified or are identifiable, for example:
- Contact information, and preferences;
- Information about your use of our hotels, and other services when you stay with us;
- Images of you in areas of our hotels covered by CCTV;
- Conversations you have when you call our reservations or sales teams;
- Information about anyone you’re travelling with or meeting, if that information is provided to us; and
- Information about the devices you use to interact with us.
- More sensitive information, for example when you tell us about dietary requirements, disabilities, and religious beliefs;
Where you provide us with sensitive details, for example in relation to requirements you may have regarding accessibility to our hotels, we will only hold this information with your express permission. This information is stored securely with restricted access and handled the greatest respect for your privacy.
Where you provide information to us about other people, you need to make sure you have their permission to do so or that you can speak on their behalf, for example, in the case of children.
When and how we collect your information
We collect information you provide to us directly and indirectly when interacting with our products and services, including when you stay with us. This may include when you:
- Book a room online, over email or on the phone;
- Create, use or manage an online account;
- Sign up to our loyalty programmes;
- Visit our website or use our apps;
- Fill out our online forms or registration cards;
- Visit our hotels or use our hotel services, like room service or gym and spa facilities;
- Visit hotels owned or managed by third parties but with which we share a brand (e.g. Hard Rock hotels);
- Access hotel internet;
- Use our restaurants;
- Use social media login functionality;
- Interact with us in online forums, by email, text, telephone, or on social media;
- Post reviews of your stay or interaction with us;
- Complete our market research/customer surveys; and
- Enter competitions or promotions.
Legal basis for using your information
All organisations need a legal reason to use your personal information, if they don’t have one, they can’t use it. There are a number of legal grounds that enable data processing. It’s quite complicated but below are the most relevant grounds you should be aware of.
With your consent
There are some activities where we process personal information with your consent, for example, where we want to send you marketing messages by email, we would ask your permission first and you could opt-out at any time by clicking on the unsubscribe link on the email or updating your account preferences. We will indicate in the Policy where we rely on consent.
To fulfil a contract
We also process your personal information in order to fulfil a contract we have with you. For example, when you book a stay with us, we will process your information to administer that stay.
For a legitimate interest
Sometimes we may use your information to help achieve our business objectives but only where that activity doesn’t negatively affect your rights. For example, we might use your information to analyse occupancy rates of our hotels and adjust room rates or to send you details of special offers or other information about our hotels. You can object to us relying on our legitimate interest to use your personal data in these ways at any time through your account preferences or by getting in touch with us using the contact details below.
To comply with legal obligations
There may be situations where we need to use your information to comply with legal obligations. For example, we are required by law to keep records of who is in our hotels in case there is an emergency, so we can make sure you’re safe.
How we use your personal information
The reason we use your information will often be obvious from the way you interact with us. For example, if you book a room at one of our hotels, we would use that information to administer your stay with us. However, our uses of your information may not always be so obvious. You can find out more below. When you provide your information to us, we may use it to:
|Use of Personal Information||Legal basis for processing (where there is more than one, the exact grounds will depend on the activity - see the section above for an explanation of each)|
|Provide you with the products and services you have requested, including administering your booking, responding to any enquiries, complaints or requests you may have||Consent, Legitimate Interest, Contract|
|To manage our relationship with you||Consent, Legitimate Interest, Contract|
|Allow you to participate in loyalty programmes||Consent, Legitimate Interest, Contract|
|Send you market research surveys and competitions||Consent, Legitimate Interest|
|Tailor our service to your preference, where you tell us about them||Consent, Legitimate Interest, Contract|
|Make decisions about what direct marketing to show you based on how you have interacted with us||Legitimate Interest|
|Improve our products and services online and offline, including our websites and apps||Legitimate Interest|
|Allow you to interact with us online and offline, in forums, on social media and elsewhere||Consent, Legitimate Interest, Contract|
|Monitor the use of our products and services and content||Legitimate Interest, Legal Obligation|
|Verify your identity||Legitimate Interest, Contract|
|Conduct analysis, system testing and statistical research||Legitimate Interest, Legal Obligation|
Comply with legal obligations on us
|Legitimate Interest, Legal Obligation|
|Detect ad blockers and other technologies that affect the services we provide||Consent, Legitimate Interest, Contract|
|Manage our hotels efficiency, including regulating the use of utilities light lighting and heating based on occupancy||Legitimate Interest|
|Send you product or service related communications, service messages||Legal Obligation, Consent, Legitimate Interest, Contract|
|Send you direct marketing, where you have consented||Consent, Legitimate Interest|
|Allow social sharing functionality||Consent, Legitimate Interest, Contract|
|Keep guests safe and ensure the security of our hotels||Legal Obligation, Legitimate Interest|
|Conduct data matching and audience insight activities||Legitimate Interest|
|Detect ad blockers||Legitimate Interest|
|Ensure the acceptable use of our services||Legitimate Interest, Legal Obligation|
|Facilitate payments and credit checks||Legal Obligation, Consent, Legitimate Interest, Contract|
|Facilitate the restructuring or sale of all or part of our business||Legal Obligation, Consent, Legitimate Interest, Contract|
|Investigate and respond to disputes||Consent, Legitimate Interest, Contract|
|Provide you with help and support where it may be required. For example, we contact you to provide assistance if you do not complete the booking process or experience technical difficulties, where we have your contact details||Legitimate Interest, Contract|
How we keep your personal data secure
Technical and organisational measures
We have secure systems and processes in place to ensure the personal information you provide us is kept safe. We store personal information on our secure electronic systems. Your information may be transferred to one of our reputable cloud-based service providers who may store and process this information outside the European Economic Area (EEA). We can assure you that we take all reasonable steps to ensure your data is handled securely under appropriate agreements with our suppliers.
How we store your personal information and how long we keep it for
We will retain your information for as long as necessary for the uses set out in this Policy or while there is a legitimate business reason for doing so. If you ask us to delete your information before this time, we may not be able to do so for technical, legal, regulatory or contractual constraints. For example, where you wish to be suppressed from direct marketing, we would need to retain your information for this purpose.
Where you ask for your account to be closed, we will do this as soon as possible subject to any terms and conditions relating to the account. Your information will be retained in order to comply with legal and regulatory obligations as well as for analysis, to prevent fraud, collect any monies owed, and to resolve disputes.
There may be situations where we use data processors – companies who act on our behalf – to collect your information for us or to use the personal data we pass to them to provide your service. These processors can only use your information in accordance with our instructions and for the purposes in this Policy.
If we provide a service that is dependent on age or residency we have an obligation to verify relevant information. Where relevant we may pass your information to a third party for this purpose.
Our websites and partner websites
Sharing with Hard Rock
Any sharing of your information with Hard Rock will be governed by an appropriate contractual arrangement that ensure the privacy rights of individuals. In particular Hard Rock complies with the EU/US Privacy Shield Framework as set forth by the US Department of Commerce regarding the collection, use and retention of personal data from the EU (and the UK). Hard Rock have certified that they adhere to the Privacy Shield Principles of Notice, Choice, Accountability for Onward Transfer, Security, Data Integrity and Purpose Limitation, Access and Recourse, Enforcement and Liability.
Travel agents and partners
We collect information about you when it is provided to us by third parties. This might include online travel agents, travel websites, and other partners. This could be when you make bookings, review your stay online, or where you interact with anyone who promotes our brands. You should always read the privacy policies of travel companies or other third parties you use, as they will use your information in accordance with their own privacy policies.
When you, or someone on your behalf, make a booking using travel agent, booking platform or other third party to use our services, they may pass us information about your booking, including information about anyone else on that booking. The same would be true where you use a third party to make enquiries about our products or services.
Where you interact with third parties who promote our services for us, these third parties may pass us your information.
When you post comments, reviews, or engage in discussions and polls about our products and services, we may receive this information from the platform you interacted with or from our partners who monitor how our brands are performing.
We may also obtain information about you from our partners and other companies that have your permission to share your information both online and offline, like insight providers.
Sometimes we may want to improve our products and services by getting a better understanding about our customers and their preferences. In these situations we may ask reputable insight providers to provide us information that may identify you. However, this would only be where you have specifically consented to that third party providing your information to us. Where we do receive information about you from other sources, we may combine it with information we already hold about you and use it in accordance with this Policy. We may receive updated information about you from organisations that provide services to you. For example, we might be updated if you move home so that we can keep our records up to date or receive updated bank details to ensure that you can continue to use our products and services. Alternatively, we may be updated if your flight is late, so that we can anticipate your arrival more accurately. Where we engage with credit reference agencies (for example if you were using our hotel facilities for a business event) we would only do this with your explicit consent.
Further Information on how we use your information
We sometimes use your information for reasons that we think you might want a bit more detail on, so to help we have added more information to these below.
Profiling and preferences
We sometimes make decisions about what your interests are based on the way that you interact with us and the information we hold about you, this is called profiling. For example, if you regularly stay at a particular hotel or frequently choose a specific room or pillow type, then we might use this information improve your experience by pre-selecting certain features of your stay for you, so you don’t need to. Understanding your preferences and personalising your experience in this way allows us to deliver the very best service possible.
Do not track signals or browser/device settings. Our websites are not designed to respond to “do not track” signals or browser/device settings.
In addition to sending you information about the products and services you use (product communications) and in-life communications while you stay with us, where we have your permission or where we are relying on our legitimate interest, we may send you direct marketing communications about our and our affiliates' products, services, events and offers. This will include marketing relating to all our hotel brands: Thistle, Thistle Express, Amba Hotels, Every Hotels, Guoman Hotels and Hard Rock Hotel London.
If you are a customer or prospective customer of Hard Rock Hotel London, then where we have your permission, we will share your information with Hard Rock Café International (USA) Inc., and its affiliates (including in the UK, Hard Rock International Limited) for their marketing and promotional purposes.
Direct marketing communications may be sent by post, email, telephone, SMS and MMS, through social media (such as Whatsapp, Instagram, Twitter, and Facebook), messages including push notifications to your mobile devices, and via other electronic means such as when you visit our websites or use our apps. This may also include any websites and apps of our partners who are in our advertising networks.
We may send you direct marketing while you have an ongoing relationship with us and for a reasonable time after you have used one of our products or services where we feel we have a legitimate interest.
You will be able to opt-out of direct marketing by following the instructions in the communications you receive or changing your device settings. Alternatively, where you have an account with us, you will be able to log-in and change your marketing preferences.
Product related communications and “in-life” updates
We may use your information to send you newsletters, bulletins, and other “in-life” communications (about your stay), and triggered communications where you make changes to your account or other information about products and services you have signed up for.
For example, we may send you email or text messages about an upcoming stay with us in order to help you plan your visit and give you the best experience possible. You’ll be able to opt-out of these.
Service communications will be sent to you regarding products and services you interact with. These are important messages relating to the products and services we provide to you.
Data matching and audience insights
Sometimes we may compare our customer database with our commercial customers or partners databases either directly with each other or by using an independent third party. This helps us understand if customers are on both databases, and allows us to plan joint marketing activities, and promotions. Additionally, we may match databases for business planning/continuity purposes.
We may use marketing permissions we hold to contact those customers for promotions that relate to data matching exercises.
We will only share personal information for data matching purposes where we have an agreement in place with the commercial customer or partner. This ensures that they comply with their data protection obligations, protect the information we share and limit the use of any shared information.
We may provide commercial customers and partners with information about the effectiveness of campaigns they run and well as the potential reach of future campaigns by providing aggregated reports of customer segments. This is called audience insights and helps us plan promotions and other marketing campaigns. Your personal information is not shared for this activity. You have the right to object to us processing your information this way, known as profiling. If you would like to opt-out of profiling, you can do this in your account preferences or by contacting us using the details below, where this feature is available.
Analysis and product development
We may use your information to improve the products and services we offer. For example, we may look at the preferences our guests have when they stay with us to offer more relevant personalisation to customers.
Detecting ad blockers
When you visit our websites we may check (by using script, code, cookies or other technical means) if you are using ad-blocker or other privacy tools. If we do detect one of these tools, we may ask you or ask your browser to ask you, if you would give us permission to ignore those settings and continue to serve adverts and/or collect your information using cookies and similar technologies.
Information about your device and use of ad blockers may be stored or associated with your device and used to reinsert adverts and to understand how ad blockers and other privacy tools are being used by our visitors.
Linked services, third party sites and content
Our website may, from time to time, contain links to other websites which are outside of our control and are not covered by this Policy. We do not accept any responsibility or liability for other sites’ privacy policies. If you access other websites using the links provided, please check their policies before submitting any personal information.
Payments and credit checks
Your information may be used to take payment for products and services and may be used to verify credit details related to payments.
Disclosures required by law
Your information will be disclosed where we are obliged by law to do so. We may also disclose your information where we are allowed by law to protect or enforce our rights or the rights of others and for the detection and prevention of crimes, such as fraud.
If you post or send offensive or inappropriate content anywhere on or to any of our websites or apps, or otherwise engage in disruptive behaviour on any of our websites or apps, we may use the information that is available to us about you to stop such behaviour. This may involve responding to or informing relevant third parties and law enforcement agencies about the content and your behaviour.
When you complete our registration forms or use our services, we may transfer your information to our group companies, partners and processors - companies that carry out activities on our behalf, only on our instructions –outside the European Economic Area (EEA) to countries that may not have data protection rules that provide the same level of protection to your personal information as countries in the EEA. However, we will only transfer your information if we have appropriate measures in place to ensure the protection of your information in accordance with applicable data protection legislation. (For example, model contract clauses or Privacy Shield in the case of the USA)
When you give us information about other individuals, you confirm that you have authority to act for them and have made them aware of the potential transfer of their information outside the EEA.
Training and quality
If you call contact us by phone or on chat the conversation may be recorded and listened to for training and quality purposes.
Social media login
Our websites and apps provide plug-ins to social media websites, including Facebook, Twitter, Google, Yahoo and LinkedIn.
If you make use of, or log-in to, the social media features on our websites or apps, we may (depending on your privacy settings) access, use and store information about you, including, but not limited to: your name, e-mail address, gender, location, profile, picture, contacts, and any other information you have chosen to make available.
How we share your personal information
Where you provide your information to us we share it with our group companies and affiliates, advertising networks and partners, commercial partners (including but not limited to owners of hotel businesses we manage or to whom we have licensed a brand and/or hotel system or from whom we have licensed a brand), and sharing with our suppliers.
What sharing takes place will depend on the activity that your information is being used for. Your information will only be shared and used in accordance with this Policy and where an agreement is in place to ensure that your information is protected. We won’t sell your personal information without your consent or share it with other organisations for their own marketing purposes, unless you have consented to such sharing.
We will share your information within our group of hotels (as named above) for administrative purposes such as managing bookings and guest stays, processing special requests, managing our loyalty programmes, special offers and competitions as well as making sure information is accurate, up to date and to enable business planning and continuity. These hotels will also carry out direct marketing activities as outlined in the section headed "Direct Marketing" above.
Sharing with advertising partners
When you visit our websites or apps we may pass information about you and any devices you are using to our advertising network partners to enable them to deliver relevant adverts and tell advertisers that adverts have been delivered and seen.
Sale of our business
If we restructure or sell all or part of our business or business operations, we may transfer your information as part of that activity, including, but not limited to, where we transfer or cease to manage (or license the use of a brand at) a hotel. Where this is the case your information will be used in accordance with this Policy unless you are notified otherwise.
Access and Control
Updating your information
Please ensure you keep your information up to date by logging into your account and modifying it. Alternatively, you can tell us when you check-in that your information has changed and we will update it for you.
Controlling direct marketing
You can change your mind about receiving direct marketing from us or change your preferences by logging into your account, if you have one, opting-out in any marketing or product communication you have received from us or emailing us using the contact details below.
Requesting copies of your information
You may request a copy of your personal information which we may hold about you by getting in touch with us using the contact details below. You may also ask us to correct any inaccuracies in your personal information. This right may be restricted by law where disclosing information may result in the personal information of other individuals being disclosed and it would be unreasonable to do so.
Where we may rely on consent to use your information, you have the right to withdraw that consent for that processing activity at any time by logging into your account, if you have one, opting-out in any marketing or product communication you have received from us or emailing us using the contact details below. However, we may have the right to rely on an alternative legal basis for the processing activity so that we are able to provide you with the product or service you have requested and, in that case, will inform you of that.
You may have the right to object, erase, or restrict our processing of your information - for example, where we process your personal information because this is in our legitimate interests, you may object to this. We will carefully consider your request as there may be circumstances which require us to, or allow us to, continue processing your data.
Complaining to the regulator
If you have any comments, concerns or complaints about our uses of your information we would ask that you contact us first, so that we can try and resolve any matter. However, where we are unable to help, you are able to complain to the Information Commissioner’s Office in the United Kingdom or the data protection regulator in your country of residence, who will be able to liaise with the UK Information Commissioner in the UK. Details for the UK Information Commissioner can be found at https://ico.org.uk/
From time to time we may make changes to this Policy. This might be in relation to changes in the law, best practice, changes to the services we provide or collection and use of your personal information. We will always display clearly when the Policy was last updated and where appropriate, notify you of any relevant changes.
If you would like to get in touch with us, please contact
By Email: firstname.lastname@example.org
By Post: The Data Protection Officer,
glh Hotels Management (UK) Limited,
110 Central Street, London EC1V 8AJ