Summary of the purposes for processing your personal data and the legal basis for doing so:

Transcription

1 PREMIER INN PRIVACY NOTICE This ntice describes hw Premier Inn Htels Ltd, (referred t as "Premier Inn") prcesses yur persnal data, as a cntrller. Our address is Whitbread Curt, Hughtn Hall Business Park, Prz Avenue, Dunstable, Bedfrdshire, LU5 5XE, United Kingdm. Please see Hw d I get in tuch with yu belw fr cntact details fr specific matters. Yu have the right t bject t sme f the prcessing which Premier Inn carries ut. Mre infrmatin abut yur rights and hw t exercise these is set ut in the sectin headed Yur rights belw. This ntice applies t: - Bkers; - Guests; - Visitrs; - Callers; and - Other custmers. And anyne cntacting, visiting r using ur: - Websites; - Apps; - Reservatin Centre; - Guest Relatins Team; and - Htels and ther premises. Summary f the purpses fr prcessing yur persnal data and the legal basis fr ding s: We prcess persnal data t make, amend and administer rm bkings, prvide htel services, prcess and stre payment details and prvide ther prducts and services (such as meals and car parking). We als deal with enquires, gather custmer feedback, undertake market research and direct marketing (including analysis t create prfiles), in ur legitimate interests t prmte ur business and imprve ur service and delivery. When bking with us, we dn t ask fr accessibility, dietary, health r ther sensitive persnal data. If yu (r smene n yur behalf) d prvide such infrmatin t us, please be aware we may need t ask fr yur explicit cnsent. In sme cases, it may be permissible fr us t have such data as it is in yur vital interests that we d s. On ur websites we use third party marketing and analytical ckies plus similar technlgies are included in ur marketing s, as explained in ur Ckie Ntice. Yu can reject and blck ckies in yur brwser settings. When yu pst n scial media abut ur business, we may use yur cntact details t respnd t any cmplaints r cmments, n the legal basis f ur legitimate interests. In ur legitimate interests, we als seek t prevent and detect crime as well as prtect ur business and premises. 1

2 In rder t fulfil the abve purpses: we disclse yur persnal data t payment prviders, technlgy prviders, insurers, and ther specialist prfessinal and technical service prviders and advisers, t manage yur bkings, arrange payments, and prvide services. we may transfer yur persnal data utside the Eurpean Ecnmic Area (the EU Member States plus Iceland, Lichtenstein and Nrway) and, where we d this, we will use safeguards t prtect yur data. We keep yur data t enable us t fulfil ur cntract with yu r t prvide services, where required by law, t respnd t a questin r cmplaint, t bey rules abut keeping recrds, t uphld r prtect cntractual r legal rights r where it is in yur r anther party s vital interests r ur legitimate interests. Where we prcess persnal data n the basis f yur cnsent, we will retain it fr as lng as required fr the specified purpse. We als keep yur data in line with any statutry limitatin perids and fr tax, legal r regulatry purpses. Yur rights Any cnsent(s) yu give us may be withdrawn at any time. Yu have an abslute right t bject t direct marketing (and any prfiling fr the purpses f direct marketing) at any time. Yu als have the qualified right t: request access, rectify, and erase yur persnal data; bject t prcessing fr any purpse where we rely n ur legitimate interests as the legal basis; restrict prcessing; and supply r transfer yur persnal data in a prtable frmat. Where yu exercise any f yur rights, we will prcess yur persnal data t cmply with yur request in accrdance with ur legal bligatins. Where we use autmated decisin-making, yu have the right t human interventin, t add a statement, and t have the decisin reviewed. Yu have the right t ldge a cmplaint with a data prtectin supervisry authrity f the EU Member State in which yu are resident, wrk r in which yur cmplaint arises. In the UK, the supervisry authrity is the Infrmatin Cmmissiner. Details f all EU supervisry authrities can be fund at We may prvide additinal infrmatin during the bking and check-in prcess and at ther pints at which we cllect yur persnal data. If yu wish t exercise yur rights, please visit where yu will be directed t a feedback frm. Then please select Privacy frm the Reasn fr cntact drpdwn bx. 2

3 If yu require further details f ur Privacy Ntice read mre belw. Persnal infrmatin we cllect We cllect persnal infrmatin when yu bk with us r request r use ur services. This includes htel and restaurant visits, using ur websites r apps, r crrespnding with us. We may als receive persnal data abut yu frm anther surce. This includes: Persnal Identifiers - title, name, marital status, pstal and addresses, pstcde, IP addresses and cntact telephne numbers. We may als cllect the names f thse wh are part f a grup bking where necessary, and the age f children t meet yur needs (e.g. t prvide a ct) and enable us t cnfirm any restrictins that may apply t a rm bking; Business-t-Business Infrmatin - fr crprate custmers and crprate business leads and cntacts: jb title, business address and business address; Transactin Infrmatin - payment, reservatin and bking details, including meals, beverages & car parking; Membership infrmatin - membership details fr rewards and Premier Inn Business Accunt prgrammes; and Custmer special requests and feedback including cmplaints - via call centres, s and nline free text fields. Third parties that we receive persnal data frm may include: Travel agents, bking agents, ther agents, tur peratrs and schls; Crprate custmers and public infrmatin surces such as Cmpanies Huse; Cmparisn and review websites; Scial netwrks; Car park peratrs; Business Accunt management peratrs; Market researchers; Marketing service prviders and advertising technlgy prviders; Gvernment and law enfrcement agencies; Other licensees in accrdance with licensing requirements; Other htel prviders and ther rganisatins as part f their cntingency plans; and Whitbread Grup plc and ther cmpanies in the Whitbread Grup. 3

4 Hw d we use yur infrmatin, and what is the legal basis fr this use? T fulfil a cntract, r take steps linked t a cntract. This is relevant when yu want t make a reservatin with us; r receive ther prducts and services frm us such as meals and includes: making, amending r administering yur rm bking and meal rders; prviding prducts and services requested by yu; verifying yur identity; prcessing payments; t administer yur My Premier Inn accunt; t administer yur Premier Inn Business Accunt; cmmunicating with yu; prviding custmer services, including managing cmplaints; and alerting yu by text, r phne in the event f an unplanned incident, as a result f which we have t make alternative arrangements under ur cntract (r where we believe it is in yur vital interests). If the infrmatin we request is nt prvided, we may nt be able t enter int r cmply with a cntract r ur legal bligatins. In ur legitimate interests regarding the cnduct f ur business, in particular: Ensuring custmer satisfactin, maintaining gdwill and dispute reslutin we prvide technical supprt and investigate and prcess any cmplaints abut ur website r ur prducts r services, and t maintain apprpriate recrds fr internal administrative purpses. We reserve the right t request evidence t supprt any claims r cmplaints. T prtect ur business and prevent fraud mnitr, test and cntrl the perfrmance and security f ur systems, netwrks, prcesses and premises t prevent and detect fraud and prtect ur business; and if yu prvide a credit r debit card as payment, we use third parties t check the validity f yur bank accunt r card details in rder t prevent fraud. Fr business perfrmance and imprvement mnitr and recrd CCTV, call centre cmmunicatins, including incming and utging calls and s fr staff training, quality imprvement purpses and establishing facts; and 4

5 analyse transactins t enable us t imprve ur services and prducts and plan fr ur business. Safety & Security f ur Guests and Emplyees t prtect premises and fr security purpses including infrmatin recrded frm CCTV; t mnitr fd safety and hygiene; t btain statements frm witnesses t accidents and ther incidents; and fr the detectin and preventin f crime. Develping and Marketing Prducts and Services fr raising brand awareness; t understand yu better as a custmer by analysing yur transactins and ther infrmatin yu prvide t us r which we learn thrugh yur interactins with us; fr marketing (including creating prfiles), cmpetitins and prmtins by pst, , text and push ntificatin where permitted t d s by law; we may use yur data t prvide persnalised prmtinal ffers t yu; we may als use yur data t prvide yu with persnalised prmtinal ffers n selected partner websites (fr example, yu might see an advertisement fr ur prducts n a partner site such as Facebk and Ggle); we als share sme f yur infrmatin with marketing service and ad technlgy prviders and digital marketing netwrks, such as Facebk, Ggle, Adbe and Rcket Fuel, t present advertisements that might interest yu. Fr example we may transfer infrmatin abut yu t such prviders s that they may recgnize yur devices and deliver interest-based cntent and advertisements t yu. The infrmatin may include yur name, , device ID, r ther identifier in encrypted frm. The prviders may prcess the infrmatin in hashed frm. These prviders may cllect additinal infrmatin frm yu, such as yur IP address and infrmatin abut yur brwser r perating system; may cmbine infrmatin abut yu with infrmatin frm ther cmpanies in data sharing cperatives in which we participate; and may place r recgnize their wn unique ckie n yur brwser. These ckies may cntain demgraphic r ther data in de-identified frm; fr mnitring the use f ur websites and apps in rder t imprve their perfrmance and ptimise ur media spend; we use persnal data f sme individuals t invite them t prvide feedback r take part in market research; and fr develping crprate business and applying rates. 5

6 Legal and Regulatry purpses in cnnectin with legal claims, cmpliance, regulatry and investigative purpses as necessary (including disclsure f such infrmatin in cnnectin with claims, legal prcess r litigatin); t cmply with health and safety legislatin, including accunting fr the number f individuals n ur premises and lgging accidents; t prevent, investigate and/r reprt suspected fraud, terrrism, security incidents r ther crime, in accrdance with applicable law; and t annymise persnal data when we n lnger need t prcess it. Where we have relied n legitimate interests as the lawful basis fr prcessing, we have carried ut a balancing test. Fr details f these privacyfficer@whitbread.cm. Where yu give us cnsent: we will send yu s, texts and push ntificatins (including newsletters) in relatin t prducts and services prvided by us, r by ur named affiliates and carefully selected partners; when yu use ur websites r apps, we place ckies and use similar technlgies n yur cmputer, mbile r ther device and we use such technlgies such as pixel tags and web beacns in marketing s and cmmunicatins (als see ur Ckie Ntice); we may use credit checks if yu apply fr a Business Accunt; t participate in cmpetitins we run and, if yu win, t use yur infrmatin fr prmtinal purpses; we will prcess health infrmatin, such as dietary, accessibility, and allergy infrmatin yu r a party n yur behalf prvides t us (we may als be able t d this where it is in yur vital interests); and n ther ccasins where we ask yu fr cnsent, we will use the persnal data fr the purpse which we explain at that time. Yu have the right t withdraw cnsent at any time. Fr purpses which are required by law: t recrd details f guests nt resident in the UK; in respnse t requests by gvernment, law enfrcement authrities, r intelligence services and curt rders; if required t cmply with health and safety legislatin t which we are subject; we may be required t share infrmatin with ther licensees in accrdance with lcal licensing requirements; and 6

7 respnding t a rights request under data prtectin legislatin. T prtect yur vital interests r thse f anther persn: disclsing yur persnal data t the emergency services where we believe it is necessary t prtect yur vital interests r the vital interest f anther persn; and where yu (r a persn acting n yur behalf) prvide us with dietary r ther persnal health data such as allergies. Other recipients that we disclse, transfer r share yur persnal data with: Grup cmpanies We will share yur persnal data with Whitbread Grup plc and ther cmpanies in the Whitbread Grup fr administering htel and restaurant services & prducts. Details f the Whitbread grup can be fund n ur crprate website at The grup includes Whitbread Grup plc and Premier Inn Htels Limited. Premier Inn shares data within the Whitbread grup when Whitbread Grup plc prvide us with supprt, advisry, IT, safety and security, including CCTV, and ther services. When yu bk a htel with us in sme limited circumstances it may be prvided by ne f ur sister cmpanies: hub by Premier Inn - Premier Inn Ochre Ltd; German htels - Premier Inn GmbH; Jersey htels - Premier Inn (Jersey) Ltd; and Dublin htels - Premier Inn Htels and Restaurants Ireland Ltd. In these cases, we will pass yur bking details t the relevant cmpany t fulfil yur bking. Each f these cmpanies use yur details t prvide the services and prducts requested with yur bking and fr the ther purpses set ut in this ntice. Premier Inn Htels Ltd is Premier Inn (Jersey) Ltd s representative in the EU. Service Prviders Fr sme activities Premier Inn uses third party service prviders. Yur persnal data will be disclsed t such rganisatins where this is necessary t prvide a service t yu, r where it is in ur legitimate interests. Fr example, we use third parties t: administer bkings; prvide Wifi; prvide parking facilities (e.g. fr Sleep Park Fly); undertake custmer feedback surveys; prvide analytics; send prmtinal ffers; prvide persnalised advertisements; prvide insurance; prvide IT develpment, supprt, maintenance and hsting, including the prvisin f applicatins and website hsting; prcess payments t enable yu t pay by credit r debit card; prvide credit checks and fraud checks; and prvide CCTV systems and maintenance. 7

8 Other parties Persnal data may be shared with regulatrs, gvernment authrities and/r law enfrcement fficials fr the preventin r detectin f crime, if required by law r if required fr a legal r cntractual claim r regulatry purpses. We disclse yur persnal data t payment prviders, technlgy prviders, insurers, and ther specialist prfessinal and technical advisers, t manage yur bkings, arrange payments, and prvide services. With yur cnsent, we will als disclse yur persnal data t Ombudsman services and Citizens Advice. A very small number f htels using the Premier Inn brand are run by a franchisee partner Greene King Brewing and Retailing Limited. Yur data will be shared with such franchisee where yu bk ne f thse htels t enable them t fulfil yur bking and any related services requested by yu. Such franchisee is cmmitted t prtecting yur privacy but, t be clear, the franchisee is an independent business and is respnsible fr the peratin f its wn htels and cmpliance with data prtectin laws. Restructure and sale We may restructure ur internal grup f cmpanies s that different grup cmpanies run ur htels and related services. S, fr example, in the future Whitbread Grup plc (r anther grup cmpany) may take ver respnsibility fr the running and peratin f htels frm Premier Inn Htels Ltd. If this happens we will let yu knw and yur data may be shared with such cmpany and prcessed as set ut in this ntice. In the event that the business is sld r integrated with anther business, yur details may be disclsed t ur advisers and any prspective purchaser s adviser and will be passed t the new wners f the business. Internatinal transfers Smetimes we may need t send r stre yur data utside f the Eurpean Ecnmic Area (the EU plus Iceland, Lichtenstein and Nrway) ( EEA ). Fr example, t fllw yur instructins, cmply with a legal duty r t wrk with r receive services frm ur service prviders wh we use t help run yur accunts and ur services. If we d transfer infrmatin utside f the EEA, we will make sure that it is prtected by using ne f these safeguards: Transfer it t a nn-eea cuntry with privacy laws that give the same prtectin as the EEA. Sme cuntries have been deemed adequate by the EU. Put in place a cntract with the recipient that means they must prtect it t the same standards as the EEA r use ther mechanisms and measures t achieve adequate prtectin. We als may use the Standard Cntractual Clauses published by the EU. Transfer it t rganisatins that are part f Privacy Shield. This is a framewrk that sets privacy standards fr data sent between EU cuntries and the US. It makes sure thse standards are similar t what is used within the EEA. Binding crprate rules. These are internal rules adpted by grup cmpanies t allw internatinal transfers f persnal data t entities within the same crprate grup lcated in cuntries which d nt prvide an adequate level f prtectin. 8

9 Fr sme f ur service prviders in the US, we rely n Privacy Shield. Fr example the party wh helps us with ur custmer feedback surveys. We rely n cntractual measures fr a small number f ur suppliers wh have r use ffices utside the EEA and wh have restricted access t sme data t prvide us with IT services including develpment, testing, supprt and maintenance. Fr further details n the mechanisms used please cntact privacyfficer@whitbread.cm Significant autmated decisin-making Like many businesses we use business rules n financial and ther infrmatin in rder t detect and prevent fraud. When used, these may identify a risk and, as a result, a particular transactin may nt be prcessed. What rights d I have? Withdrawing cnsent r therwise bjecting t direct marketing Wherever we rely n yur cnsent, yu will always be able t withdraw that cnsent. We will cntinue t prcess yur persnal data fr ther purpses n a different lawful basis (ther than cnsent) where that applies. In sme cases, we are able t send yu direct marketing withut yur cnsent, where we rely n ur legitimate interests. Yu have an abslute right t pt-ut f direct marketing, and any prfiling we carry ut fr direct marketing, at any time. Yu can d this by clicking n the 'unsubscribe' link lcated in the fter f every marketing r text. Where yu have a relatinship with anther rganisatin, such as a scial media platfrm like Facebk, we may ask them t send marketing t yu. If yu bject t receiving marketing frm us we will stp marketing t yu. Hwever, please cntact the rganisatin directly if yu want t withdraw yur cnsent t such rganisatin marketing t yu. Other qualified rights Yu have the right t knw whether r nt we prcess infrmatin abut yu and t access that infrmatin. Yu have the right t update, crrect and cmplete any infrmatin we hld abut yu which is inaccurate r incmplete. Yu have the right t btain the persnal data yu prvide t us fr a cntract r with yur cnsent in a cmmnly used, structured, and machine-readable frmat, and t ask us t share (prt) this persnal data t anther cntrller. Yu have the right t ask that we erase r restrict (stp active) prcessing f yur persnal data. In additin, yu can bject t the prcessing where the lawful basis is ur legitimate interests. These rights may be limited, fr example if fulfilling yur request wuld reveal persnal data abut anther persn r yu ask us t erase infrmatin which we are required by law t keep. Where yu bject t us prcessing persnal infrmatin we may have a cmpelling justificatin fr prcessing it. Relevant exemptins are als included within the data prtectin laws that apply in the UK. We will infrm yu f relevant exemptins we rely upn when respnding t any request yu make. 9

10 T exercise any f these rights, yu can get in tuch with us using the details set ut belw. If yu have cncerns, yu have the right t cmplain t the data prtectin supervisry authrity f the EU Member State in which yu are resident, wrk r in which yur cmplaint arises. In the UK, the supervisry authrity is the Infrmatin Cmmissiner. Details f all EU supervisry authrities can be fund at: Hw lng will yu retain my persnal data? We keep yur data t enable us t fulfil ur cntract with yu r t prvide services, where required by law, t respnd t a questin r cmplaint, t bey rules abut keeping recrds, t uphld r prtect cntractual r legal rights r where it is in yur r anther party s vital interests r ur legitimate interests. Where we prcess persnal data n the basis f yur cnsent, we will retain it nly fr as lng as required fr the specified purpse. We als keep yur data in line with any statutry limitatin perids and fr tax, legal r regulatry purpses. The perid fr which we will retain yur persnal data depends n the purpses fr which we are prcessing it and where the same persnal data is prcessed fr tw r mre purpses, we will retain it fr the lngest perid. Fr example, we retain:, CCTV recrding fr up t 31 days; fr up t 1 year incming and utging vice recrdings (althugh we will keep a recrd f any cnsent yu give us during a call fr as lng as we rely n it as the lawful basis fr prcessing); until a perid f 3 years has elapsed since yur last interactin with us, persnal data we prcess fr marketing (including prfiling) purpses, unless yu ask us t stp sending electrnic direct marketing, in which case we will act n yur request, and then keep a recrd f yur request indefinitely; accident reprt frms fr 3 years (r fr accidents relating t a child, fr 3 years after the child s 18th birthday); and financial infrmatin fr a perid f 7 years, fr accunting, business reprting, analysis and audit purpses. In any f the cases mentined abve, we may retain the persnal data fr lnger, if it is required fr the purpses f any internal r external investigatin r litigatin. In these cases, it may be retained until the matter is reslved. We may keep yur data fr lnger in line with any limitatin perids, r if we cannt delete it, e.g. fr tax, legal r regulatry reasns. Yu have the qualified right t request deletin f yur persnal data at any time, r we may chse r be bliged t erase yur persnal data earlier, fr example, if we n lnger need t prcess it. Ckies and ther similar technlgies we use Infrmatin abut the first and third parties ckies and ther technlgies we use is available in ur Ckie Ntice Hw d I get in tuch with yu? General data prtectin queries 10

11 If yu have any queries abut the way we prcess yur persnal data. Yu can get in tuch at Queries and exercise f rights If yu have any queries r want t exercise any f yur rights please visit This Privacy Ntice was last updated n 20 th May Any changes t this Privacy Ntice will be cmmunicated n ur website. 11