Privacy Policy

Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table above.

• International Data Transfers

For transfers of Personal Data from the European Economic Area (EEA) to jurisdictions outside the EEA, we implement appropriate safeguards, including:

• Standard Contractual Clauses: We utilize standard contractual clauses approved by the European Commission, which provide a robust framework for ensuring the protection of your data in compliance with Articles 46 and 49 of the General Data Protection Regulation (GDPR).
• Additional Safeguards: Where necessary, we apply other relevant measures to ensure your Personal Data remains secure and that your privacy rights are maintained.

For detailed information about our data transfer practices and the specific safeguards we use, please contact us through our Privacy Center.

1. Cookie Usage

Our website uses cookies to enhance your browsing experience and personalize content. Cookies are small text files stored on your device, helping us remember your preferences and improving functionality.

• Types of Cookies We Use

Persistent Cookies: Remain on your device to remember preferences for future visits.

Session Cookies: Temporary cookies that expire when you close your browser, enabling essential website functions.

• Purpose of Cookies

Analytics: Tools like Google Analytics and Hotjar help us understand website usage and improve performance. Learn more about these services at Google’s Privacy Policy and Hotjar’s Cookie Policy.

Functionality: Store information like order history and preferences to facilitate website navigation.

• Third-Party Cookies

We may use third-party cookies to enhance website performance and deliver targeted content.

• Managing Cookies

You can manage or disable cookies via your browser settings. Note that this may impact website functionality.

• Your Consent

By using our website, you consent to our use of cookies in line with the UK GDPR and PECR. You can adjust your cookie preferences at any time.

2. Sharing Your Personal Data

When sharing your Personal Data, we ensure that third-party recipients adhere to stringent security measures:

• Within Tulip Hotels Limited: Your data may be shared among affiliated entities to facilitate services and operational efficiency. This includes departments and partners involved in IT, commercial operations, marketing services, medical services (if applicable), and legal services (if applicable).
• With Partner Hotels: We may share your Personal Data with hotels where you have made reservations to support your stay and manage our contractual obligations. This includes handling benefits associated with loyalty programs or guest preferences.
• With Third-Party Service Providers: We engage trusted third parties for various operational purposes, such as customer support, digital services, IT maintenance, and marketing. These providers access only the data necessary for their specific roles, including IT subcontractors, banks, credit card issuers, external legal advisors, dispatch services, and printing companies.
• Compliance and Legal Obligations: Your Personal Data may be disclosed to regulatory, statutory, governmental, or other relevant authorities as required or permitted by law, legal processes, or litigation.

3. Data Protection and Security Measures

At Tulip Hotels Limited, your Personal Data is our top priority. We use a range of security measures to protect your information from unauthorized access, loss, or damage. This includes:

• Physical Security: Secure facilities with restricted access and surveillance.
• Technical Security: Encryption, firewalls, and regular system updates to prevent unauthorized access.
• Organizational Measures: Restricted access to data, employee training, and incident response procedures.

We are dedicated to maintaining the highest standards of data protection to keep your information safe.

• Data Breaches

Despite our best efforts, data breaches can occur. In the event of a data breach, we follow the procedures outlined below to manage and mitigate the impact:

1. Notification: Should a breach affect your personal information, we will notify you as soon as possible. Our notification will include details about the breach, the data affected, and any actions you should take.
2. Scope and Investigation: We will conduct a thorough investigation to determine the extent of the breach, including which data was compromised and how it happened. Our goal is to understand the breach fully and prevent future incidents.
3. Data Security: We will take immediate steps to secure our systems and data. This includes updating our security measures and practices to address any vulnerabilities that were exploited.

• Potential Consequences

A data breach may lead to various consequences, such as identity theft, unauthorized access to accounts, or other misuse of personal data. We will provide guidance on steps to mitigate any risks.

• Your Rights

If your personal information is affected by a data breach, you have the right to:

• Receive timely notification of the breach and its potential impact.
• Access support and advice on protecting yourself from further harm.
• Lodge a complaint with the relevant data protection authority if you believe your data has been mishandled.

4. How We Protect Your Personal Data

We are committed to safeguarding your Personal Data with rigorous security measures. Here’s how we protect your information:

• Security Protocols: We use industry-standard security measures to ensure your data remains confidential and intact. This includes secure protocols for data transmission over untrusted networks.
• Restricted Access: Only authorized personnel and service providers who need access for legitimate business purposes can view your Personal Data.
• Ongoing Protection: We implement comprehensive security practices to guard against unauthorized access, use, modification, and disclosure.
• Physical Security: Our facilities use secure filing cabinets and other industry-standard measures to protect physical records.

Despite these efforts, it’s important to note that due to the global nature of the Internet, absolute security cannot be guaranteed.

5. Data Collection and Processing

At Tulip Hotels Limited, we are committed to maintaining transparency in our data collection and processing practices. Here’s how we manage your Personal Data:

• Purpose Limitation: We collect and process Personal Data solely for specific, well-defined purposes outlined in this policy. This ensures that data collection is relevant and adequate for our operational needs.
• Data Collection Practices: We gather only the Personal Data necessary for our activities, and we implement measures to maintain its accuracy and ensure it is kept current.
• Data Retention: Personal Data is retained only for the duration necessary to fulfill its intended purpose and in accordance with applicable legal and regulatory requirements.
• Your Rights: You have the right to access, amend, correct, or request the deletion of your Personal Data. For any inquiries or to exercise these rights, please contact us at [email protected].

By adhering to these principles, we aim to ensure that your data is handled with the utmost care and in compliance with relevant laws and regulations.

6. How Long Do We Keep Your Personal Data?

At Tulip Hotels Limited, we retain your personal data only for as long as necessary to fulfil the purposes outlined in our “List of Personal Data Processing Activities.” After our contractual relationship ends, we retain your data only if required or permitted by law. Our retention periods are guided by:

• Purpose of Processing: Data is retained solely for the duration necessary to fulfil the specific purpose for which it was collected.
• Legal and Regulatory Requirements: Adherence to applicable laws and regulations, including those related to tax, accounting, and legal obligations.
• Ongoing Relationships: Data related to active memberships, marketing preferences, or website interactions is retained as long as the relationship remains active.
• Your Requests: We honor specific requests for data deletion in accordance with applicable laws.
• Legitimate Interests: We may retain data to manage our rights and defend against claims.

• Retention Periods for Different Types of Data
• Reservation Data: Data related to reservations and transactions is retained for [e.g., 5 years] to comply with legal and regulatory requirements and to manage any potential disputes or follow-up communications.

• Marketing Lists: Personal data collected for marketing purposes is kept for [e.g., 2 years] from the date of collection. Upon unsubscribing from our marketing communications, your data will be promptly removed from our marketing lists.
• Account Information: Data linked to user accounts, including login details and preferences, is retained for as long as your account remains active. If you close your account, we will delete your data after [e.g., 1 month], unless a longer retention is required for legal or compliance reasons.

When your personal data is no longer needed, we ensure it is securely deleted or anonymized to protect your privacy.

7. Children’s Privacy

• Commitment to Protecting Children’s Data

At Tulip Hotels Limited, we prioritize the protection of children’s personal data. We do not knowingly collect personal data from individuals under 16 without parental consent.

• Data Collection and Use

Consent Requirement: We obtain explicit parental consent before collecting or processing data from children under 16.

Purpose and Use: Data collected from children is used only for providing our services and is not shared with third parties without parental consent.

• Parental Rights and Actions

Access and Control: Parents and guardians have the right to access, correct, or request deletion of their child’s data. Contact us at [contact information] to exercise these rights.

Report Issues: If you suspect your child’s data has been collected without consent, please inform us immediately so we can take appropriate action.

• Contact Us

For questions or concerns regarding children’s privacy, please reach out to us at [email protected].

8. What Are Your Rights Regarding Your Personal Data?

At Tulip Hotels Limited, we are committed to respecting and upholding your data protection rights under applicable laws, including the EU General Data Protection Regulation (GDPR). You have the following rights concerning your Personal Data:

• Information: You are entitled to clear and transparent information about how we use your Personal Data, as detailed in this Privacy Policy.
• Rectification: You can request corrections to any incomplete or inaccurate Personal Data we hold about you.
• Deletion: You may request the deletion of your Personal Data, subject to legal exceptions and obligations.
• Withdrawal of Consent: If we process your data based on your consent, you can withdraw this consent at any time via unsubscribe links or by contacting us directly.
• Access: You have the right to access and obtain a copy of your Personal Data, subject to certain exceptions.
• Restriction: You may request that we limit the processing of your Personal Data under specific circumstances.
• Portability: You can request to receive your Personal Data in a structured, commonly used format and transfer it to another data controller where feasible.
• Objection: You have the right to object to the processing of your Personal Data, particularly when it is based on legitimate interests or used for direct marketing purposes.

These rights are designed to protect your privacy and give you control over your Personal Data. For any questions or to exercise these rights, please contact us at [email protected].

9. Automated Decision Making and Profiling

Automated Decision-Making

At Tulip Hotels Limited, we may employ automated decision-making and profiling techniques as part of our services. Automated decision-making refers to processes where decisions are made without human intervention, based on data collected about you.

• Purposes of Automated Decision-Making

Our use of automated decision-making serves several key purposes:

Personalization: To enhance user experience by providing customized recommendations, offers, and content based on your preferences, behaviors, and interactions with our services.

Operational Efficiency: To streamline operations such as reservation management, fraud detection, and customer service, thereby improving overall efficiency and accuracy.

• Your Rights and Options

You are entitled to specific rights regarding automated decision-making and profiling:

Transparency: We strive to be transparent about the logic and criteria used in automated decision-making processes that significantly impact you.

Right to Object: You have the right to object to decisions based solely on automated processing, including profiling, if such decisions have a legal or similarly significant effect on you. If you wish to exercise this right, please contact us using the information provided in this policy.

Request Human Intervention: You can request human involvement in decisions made through automated processes and provide your perspective on such decisions.

• How to Exercise Your Rights

To inquire about or exercise your rights related to automated decision-making and profiling, or to seek further clarification, please reach out to us at [email protected]. We will review and respond to your request in accordance with applicable data protection regulations.

10. Marketing

We strive to keep you updated on the latest products, services, and offers from Tulip Hotels Limited that may be of interest to you. If you have opted in to receive marketing communications, you can withdraw your consent at any time. You have the right to request that we cease all marketing communications directed to you.

To opt out of receiving marketing emails or other communications, please contact us at [email protected], or use the unsubscribe link provided in the footer of our marketing emails.

11. Changes to the Privacy Policy

We may update this Privacy Policy from time to time. Significant modifications will be announced via this Website or through other communication channels we typically use to reach you. Changes will take effect immediately upon posting, unless a different effective date is specified.

12. If You Fail to Provide Personal Data

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter with you (for example, to provide you with goods or services). In this case, we may have to cancel a product or service you have with us, but we will notify you if this is the case at the time.

13. Glossary

• Legitimate Interest: This means the interest of our business in conducting and managing our operations to provide you with the best service/product and the most secure experience. We ensure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.

14. Complaint Procedures

At Tulip Hotels Limited, we are committed to addressing any concerns or complaints regarding the handling of your personal data. You can submit a complaint through the following channels:

Email: Send your complaint to [email protected]. Please include detailed information to help us understand and address your concerns effectively.

Postal Address: Mail your complaint to 2 Chesham Street, Belgravia, London SW1X 8DT. Include your contact details and a description of the issue.

• Complaint Handling Process

Acknowledgment: We will acknowledge receipt of your complaint within [e.g., 5 business days]. Our acknowledgment will confirm that we have received your complaint and are beginning to review it.

Investigation: Our team will conduct a thorough investigation into the issue. We aim to resolve complaints within [e.g., 30 days], though more complex cases may require additional time. We will keep you updated on the progress of your complaint.

Resolution: Once the investigation is complete, we will notify you of our findings and any actions taken in response to your complaint. We strive to provide a clear explanation and resolution.

• Notification and Follow-Up

After resolving your complaint, we will inform you of the outcome and any steps we have taken to address the issue. If you are dissatisfied with our resolution, you may escalate the matter to the Information Commissioner’s Office (ICO).

• Escalation to Supervisory Authority

If you believe your complaint has not been adequately addressed, you have the right to contact the ICO or visit their website at ICO website for further information and assistance. Here are contact details:

Information Commissioner’s Office:
Wycliffe House, Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint