Last updated: 3-Feb-22
The Inn Collection Group consists of Galava Topco Limited, a company registered in England & Wales under company number 13257598, and Vindolanda Topco Limited, a company registered in England & Wales under company number 11402737, together with their subsidiary companies. A list of Inn Collection Group companies may be found here.
Inn Collection Bidco Ltd is the lead controller for the Inn Collection Group. Inn Collection Bidco Ltd is registered in England & Wales under company number 08635387. Its ICO registration number is ZA131740.
The Inn Collection Group has appointed a Data Privacy Manager (DPM) to oversee compliance with data protection law. If you have any questions about this privacy notice or how we handle your personal information, please contact the DPM. Our contact details are at the end of this privacy notice.
THE TYPE OF PERSONAL INFORMATION WE COLLECT
We currently collect and process the following information:
- Personal identifiers, contacts and characteristics (for example, name and contact details)
- Guest information and any Government-mandated contact tracing data, if you stay in or visit one of our inns
- Your CV and application, if you apply for a job with us.
HOW WE GET THE PERSONAL INFORMATION AND WHY WE HAVE IT
Some of the personal information we process is provided to us directly by you for one of the following reasons:
- You visit one of our inns or book into one of our inns through our website or by calling or writing to us
- You sign up to our mailing list
- You contact us or interact with us, for example on social media or through our website
- You apply for a job with us.
We also receive personal information indirectly, from the following sources in the following scenarios:
- From booking channels and online travel agents, if you book into one of our inns through them
- From the lead guest, your employer or other third party (for example a tour operator), if they book you into one of our inns or provide us with your contact tracing data
- From your referees, if we take up references you provide in your job application
- From social media channels, who enable us to advertise to users of their platforms, and third party providers on our site (for example Google Analytics provides us with statistics about our site).
We use the information that you have given us in order to:
- Allow you to stay in or visit one of our inns, and provide you with accommodation and/or food
- Send you offers and updates, if you sign up to our mailing list; we track whether our emails are opened and whether links in emails are clicked on
- Answer your queries, if you interact with us
- Process your job application, if you apply for a job with us
- Manage our relationship with you; this includes keeping accounts and records
- Assist with the Government’s contact tracing efforts and COVID-specific law and guidance during the pandemic
- Conduct other legitimate business; for example to ensure a secure and safe environment in our inns, we may record CCTV for health and safety reasons and to prevent and detect crime; we may process personal information for network and information security purposes or fraud prevention/detection; we may analyse data and run statistical reports in order to grow and improve our business.
We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
Please note that we may process your personal information without your knowledge or consent, where this is required or permitted by law.
We may share this information with:
- Other companies in the Inn Collection Group, for intra-group administration reasons
- Our suppliers, so we can provide services to you
- If you booked into an inn through a booking channel or online travel agent, we will confirm the booking and the fact you stayed at our inn with that booking channel or online travel agent for payment purposes
- Public health authorities, in the case of any contact tracing data we collect
- Another business and its advisers, in connection with a merger or acquisition with or by them.
Under the UK General Data Protection Regulation (UK GDPR), the lawful bases we rely on for processing this information are:
- Your consent. You are able to remove your consent at any time. You can do this by contacting the DPM (details below) or unsubscribing from our mailing list.
- We have a contractual obligation.
- We have a legal obligation.
- We have a legitimate interest, as described in this privacy notice
We may process special categories of personal information (such as health data) in the following circumstances:
- In limited circumstances, with your explicit written consent.
- Where we need to carry out our legal obligations as an employer.
Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already made the information public.
HOW WE STORE YOUR PERSONAL INFORMATION
Your information is securely stored in our guest, marketing or job application systems as applicable.
We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
We keep guest data for 7 years after your last visit. We will then dispose of your information by securely deleting your data.
We keep job applicant data with the personnel file if you become an employee or for 6 months if we do not accept your application.
We keep CCTV footage for approximately 30 days.
We keep contact tracing data for 21 days.
If you register on our site, we keep your data until such time as you choose to delete your account. Your details are stored so that you do not need to re-register when you come back to the site. You can change your registration preferences and email address at any time by clicking the manage preferences link in your registration confirmation email and check/uncheck the options available. If you are no longer interested in receiving our email newsletter and offers and wish to be removed from our database, click on the ‘Unsubscribe’ link on the same page or at the bottom of any of our e-newsletters that you have received.
We operate in the UK. If and where our suppliers store your personal information outside the UK, we will check their laws are essentially equivalent, and if not that they take appropriate steps to protect it or to ensure any exception is justified.
YOUR DATA PROTECTION RIGHTS
Under data protection law, you have rights including:
Your right of access – You have the right to ask us for copies of your personal information.
Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.
Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.
Your right to object to processing – You have the right to object to the processing of your personal information in certain circumstances.
Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.
You are not required to pay any charge for exercising your rights (see further below). If you make a request, we have one month to respond to you.
Please contact the DPM (details below) if you wish to make a request.
No fee usually required
You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
What we may need from you
We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.
It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your relationship with us.
HOW TO CONTACT US OR COMPLAIN
Please see https://www.inncollectiongroup.com/contact-us/ for our contact details.
If you have any queries or concerns about our use of your personal information, you can contact or make a complaint to the DPM.
You can also complain to the ICO if you are unhappy with how we have used your data.
The ICO’s address:
Information Commissioner’s Office
Helpline number: 0303 123 1113
ICO website: https://ico.org.uk