PRIVACY POLICY

This policy applies to website visitors; travel agents and their personnel using the website in a business-to-business capacity ("Sub-Agents", "you" or "your"); and travellers or other end customers whose data is provided to us in connection with a booking ("Customers"). "Product" means accommodation and any ancillary service expressly included in a booking. "Service Provider" means the hotel, accommodation provider or other principal supplying the Product.

HRUS normally acts as controller for the personal data it uses for its own booking-agent and website purposes. HRUS and each Sub-Agent act as separate controllers for Customer personal data processed for their respective purposes, unless the Agency Agreement or applicable law provides otherwise. A Service Provider, payment provider or other third party may also be a separate controller and should provide its own privacy information.

This policy should be read with our Terms of Business, the applicable Agency Agreement, the privacy information shown during booking and our cookie controls. A Sub-Agent must direct Customers to this policy before or when their personal data is collected for transmission to HRUS.

1. Personal data we collect

We may collect identity and contact data relating to Sub-Agent personnel and Customers, including names, job titles, business contact details, titles, dates of birth or ages where required, postal and email addresses, telephone numbers and booking references. We may also collect booking and travel data, including destinations, dates, room and occupancy requirements, itinerary details, loyalty information, special requests and communications with us.

We may collect Sub-Agent account and profile data, such as usernames, login credentials, employer or agency details, permissions, contact preferences, profile information and information needed to administer access under the Agency Agreement. We do not ask users to add unrelated personal details to a profile.

We collect transaction data needed to administer a booking, including payment status and limited payment information. Card details may be collected directly by a regulated payment provider; where this happens, we may receive only a token, limited card details and transaction status.

We may collect enquiry, notification and correspondence data, including the content and metadata of website forms, emails, chats and other communications. If you subscribe to alerts or newsletters, we record your contact details, preferences, consent and unsubscribe status.

We may collect usage and technical data, including IP address, approximate location, browser and device type, operating system, referral source, page views, navigation paths, session timing, frequency of use, cookie identifiers and security logs. The source may be our website, analytics tools or security providers.

If we record an inbound or outbound telephone call, we will provide an appropriate notice. Recordings may be used for quality assurance, staff training, complaint and dispute resolution, fraud prevention and the establishment, exercise or defence of legal claims.

If you tell us about accessibility, dietary, medical, religious or other special requirements, that information may reveal health data or other sensitive information. Please provide only what is necessary. Where required, we will seek explicit consent unless another lawful basis applies.

2. How we obtain personal data

We obtain personal data directly from Sub-Agent personnel when they create an account, search, book, pay, contact us, subscribe to marketing, set privacy preferences or use our website. We receive Customer data primarily from the Sub-Agent making the booking and may also receive data from a Customer, Service Provider, payment or fraud-prevention provider, customer-service or technology provider, analytics provider, corporate-group member or lawful public source.

A Sub-Agent providing Customer data must have authority to do so, establish its own lawful basis, give the Customer required privacy information and provide only data reasonably necessary for the enquiry, booking or Product. The Sub-Agent remains responsible for the accuracy of information it supplies and for complying with the data-protection provisions of the Agency Agreement.

3. How we use personal data and our lawful bases

We use booking, account, profile, enquiry, transaction and correspondence data to operate our B2B website; authenticate and administer Sub-Agent access; perform the Agency Agreement; search for Products; arrange and administer bookings; collect or facilitate payment; issue vouchers and confirmations; process changes and cancellations; communicate with Sub-Agents, Customers and Service Providers; provide support; and handle complaints. The lawful basis is usually performance of a contract, steps taken before entering a contract, or our legitimate interests in providing and administering the requested services. A Customer is not a party to the Agency Agreement, but processing may be necessary to fulfil the booking made for that Customer.

We use personal data where necessary for our legitimate interests or those of another party, provided those interests are not overridden by your rights. Those interests include administering and improving our website and business; analysing service use; maintaining backups and records; training staff; monitoring service quality; securing accounts and systems; preventing fraud; recovering sums due; and establishing, exercising or defending legal rights.

We use personal data to comply with legal obligations, including accounting, tax, sanctions, law-enforcement, consumer-protection and data-protection requirements. We may use data to protect someone's vital interests in an emergency.

Where consent is the appropriate basis, such as for certain marketing, non-essential cookies or sensitive data, you may withdraw it at any time without affecting processing already carried out lawfully. We will not treat use of the website alone as consent where the law requires a specific, informed choice.

4. Booking administration and disclosures

To arrange and fulfil a booking, we share information reasonably required with the relevant Service Provider and, where applicable, reservation platforms, local representatives and suppliers of transfers, tours or other services included in the Product. This may include Customer names, ages where relevant, contact details, itinerary and stay details, special requests, payment status, voucher information and service communications. We may also share relevant information with the Sub-Agent through which the booking was made.

We may disclose necessary data to members of our corporate group, insurers, professional advisers, auditors, banks, payment providers, fraud-prevention and identity-verification services, technology and hosting providers, communications and customer service providers, regulators, courts, public authorities and law enforcement bodies where lawful.

Service providers acting for us must process personal data only on documented instructions, keep it secure and assist us in meeting our legal duties. We may also disclose data in connection with a proposed or completed merger, reorganisation, sale or transfer of all or part of our business, subject to appropriate safeguards. We do not sell personal data.

5. International transfers

Service Providers and technology or support providers may be located outside the United Kingdom, including in the United States, Africa, Australia, Egypt and Asia. Their countries may not provide the same level of protection as the UK.

Where UK data-protection law requires safeguards, we rely on an applicable UK adequacy regulation, approved contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum, or another lawful transfer mechanism. We assess transfer risks and apply supplementary safeguards where appropriate. Where no other mechanism is available, we may ask for explicit consent to a specific transfer; consent can be withdrawn, although this does not affect an earlier lawful transfer. Contact us for information about the safeguard used for a particular transfer.

6. Retention and deletion

We keep personal data only for as long as necessary for the purpose for which it was collected, taking account of the amount, nature and sensitivity of the data, possible harm, legal requirements and applicable limitation periods.

Customer information held in our operational booking system is normally retained for 36 months after the return date of the trip. If the Customer has a later reservation, the 36-month period normally runs from the return date of the final trip. Sub-Agent account and access records are normally retained for the duration of the Agency Agreement and a reasonable period afterwards. Call recordings are retained only for the period justified by their stated quality, training, complaint, fraud or legal-claims purpose.

Some records must be kept longer. Core contracts, payment, accounting, tax, complaint and legal-claims records may normally be retained for up to six years after the relevant transaction or relationship, and longer where law requires or a dispute remains active. Where possible, information no longer needed operationally is deleted, anonymised or restricted to the narrower legal purpose.

7. Security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures may include access controls, encryption or tokenisation where appropriate, supplier due diligence, staff training, monitoring, backups and incident-response procedures. No internet or storage system is completely secure, but we review safeguards considering risk and available technology.

8. Marketing and privacy controls

Our privacy controls allow you to set direct-marketing preferences and manage non-essential cookies. You may access those controls on our website where available or by contacting us. We send electronic marketing where you have consented or another lawful basis permits it. You can object or opt out at any time using an unsubscribe link or by contacting us. We may retain a minimal suppression record so that we continue to respect your choice.

9. Your data-protection rights

Depending on the circumstances and applicable law, you may ask us to confirm whether we process your data and provide access to it; correct inaccurate or incomplete data; erase data; restrict processing; provide eligible data in a structured, commonly used and machine-readable format; or transmit eligible data to another controller where technically feasible.

You may object, on grounds relating to your situation, to processing based on legitimate interests. We will stop unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims. You may object at any time to direct marketing, including related profiling, and we will stop that processing.

You may withdraw consent at any time. Withdrawal does not affect earlier lawful processing. Rights are not absolute; exemptions may apply, including where data is needed for a legal obligation or the establishment, exercise or defence of claims, or where disclosure would adversely affect another person's rights.

We may request information needed to verify identity and locate the data. We normally respond within one month, although the law permits an extension for complex or numerous requests. We do not usually charge a fee, but may charge or refuse where the law permits, including for a manifestly unfounded or excessive request.

To exercise a right, send written notice using the details in clause 16. You may complain to the UK Information Commissioner's Office at ico.org.uk or another competent supervisory authority. We would appreciate the opportunity to address your concern first, but this does not affect your right to complain.

10. Automated decisions

We may use automated tools to help identify suspicious bookings or payment activity. Unless we tell you otherwise, we do not make decisions based solely on automated processing that produce legal or similarly significant effects. If such processing is introduced, we will provide the information and safeguards required by law, which may include human review and a right to contest the decision.

11. Children

Our B2B website is intended only for authorised adult Sub-Agent personnel. We may process a child Customer's data where the child is included in a booking, but the Sub-Agent should provide only what is needed to arrange and safely deliver the Product. We do not knowingly use children's personal data for direct marketing.

12. About cookies

A cookie is a small file containing an identifier that a website sends to a browser and that the browser returns with later requests. A session cookie expires when the browser closes; a persistent cookie remains until its stated expiry or earlier deletion. Cookies do not always identify a person directly, but cookie information may be linked with other personal data.

We may use cookies for authentication, login status, personalisation, security and fraud prevention, analytics, website performance and storage of cookie-consent choices. Strictly necessary cookies support essential functions. We seek consent before setting non-essential analytics or advertising cookies where required.

13. Cookies used by service providers

Where enabled and covered by your cookie choices, Google Analytics may use cookies to produce reports about use and performance of our website. If we use Google advertising or AdSense services, Google may use cookies or similar identifiers to measure advertisements or personalise advertising where you have consented. Current providers, purposes, cookie names and durations should be listed in our website cookie tool because they may change.

You can manage Google advertising preferences at adssettings.google.com and obtain information about Google Analytics controls through Google's official support pages. Third-party controls do not replace the consent choices offered on our website.

14. Managing cookies

You can use our cookie tool to accept, reject or change non-essential-cookie choices. Most browsers also allow you to block or delete cookies through their privacy or site-data settings. Browser instructions are available from the official support pages for Chrome, Firefox, Opera, Safari and Microsoft Edge. Blocking all cookies may impair website functions, including account or booking features that depend on strictly necessary cookies.

15. Third-party websites and changes to this policy

Our website or communications may link to third-party websites or services. Those parties control their own processing and privacy practices, and we encourage you to read their notices. We may update this policy to reflect changes in services, practices or legal obligations. The current version will be published on our website and will show its effective date. We will take reasonable steps to draw material changes to your attention where required.

16. Our details and Data Privacy Manager

Hotels R Us International Ltd is the controller for its processing described in this policy. Sub-Agents remain controllers for their own processing of Customer data. Our Data Privacy Team can be contacted by email at customerrelations@hotelsrus.co.uk or by post at 166 College Road, Harrow, Middlesex, England, HA1 1BH. You may also use our website contact form or the telephone number published on our website. Include enough information to identify you and the relevant booking, but do not send unnecessary identity documents or payment-card information by ordinary email.