At Blue Orchid Group Limited we pride ourselves in offering exceptional service to our guests. We recognise the importance of respecting your privacy and take our obligation to protect your personal data seriously. This Privacy Policy sets out how we handle the personal data of our guests, suppliers and all other third parties that we deal with. It applies to our website and to all of our products and services (together our “Services”).

Your personal data allows us to the provide you with the Services You have asked for, as well as enabling us to improve and personalise our Services by understanding your interests and preferences.

Personal data, or personal information, means any information about an individual from which that person can be identified. Where an individual cannot be identified, for example when personal data has been aggregated and anonymised, this Privacy Policy does not apply.

We may need to update this Privacy Policy from time to time. Any changes made to this Privacy Policy will be communicated via our website.

This Privacy Policy is provided in a layered format so you can click through to the specific sections set out below:

1. WHO WE ARE
2. HOW WE COLLECT DATA FROM YOU
3. THE DATA WE COLLECT FROM YOU
4. HOW WE USE YOUR PERSONAL DATA
5. WHO WE SHARE YOU PERSONAL DATA WITH
6. WHERE WE STORE YOU PERSONAL DATA
7. MARKETING
8. DATA RETENTION
9. DATA SECURITY
10. YOUR RIGHTS
11. CONTACTING US

References to ‘Blue Orchid’, “we”, “us” or “our” in this Privacy Policy are to Blue Orchid Group Limited and, where relevant, to any other companies in the Blue Orchid Group.

We are registered in England and Wales under company number 11513523 and have our registered office at 10 Norwich Street, London EC4A 1BD.

When you visit our website or use our Services, we collect personal data from you via three main methods:

Information you provide to us directly. This may include when you:

• book a room or event at one of our hotels online, over email, over the phone or in person;
• create, use or manage an account on our website;
• sign up to our loyalty program;
• enter a competition run by us;
• fill out online forms or registration cards;
• use services at our hotels like gym facilities or room service;
• log on to the hotel Wifi;
• visit our restaurants or bars;
• make a donation to our charity.

Information we collect automatically. When you access our website, we may automatically collect technical data about, for example, your equipment and browsing actions. We collect some of this data by using cookies and other similar tracking technologies. Further information about the types of cookies we use and how we use them can be found in our Cookie Policy. We use CCTV in the public areas of our hotels. When you visit these areas your image will automatically be captured.

we get from third parties. Most of the data we collect about you we collect from you directly but sometimes we might also collect personal data about you from publicly available materials or trusted third parties like our marketing and sales partners, travel agents and travel websites. Information from these sources may be used to supplement the personal data we already hold about you, to personalise and improve our Services or to validate data provided by you.

Depending on which of our Services you use or access, we may collect, use, store and transfer different kinds of personal data about you including:

• Identity Data includes first name, maiden name, last name, username or similar identifier, marital status, title, date of birth and gender. We may also collect this data in respect of your fellow guests (which may include the ages of your children) if you provide this to us. Where you provide us with information about other people you should ensure that you are permitted to do so.
• Contact Data includes billing address, delivery address, email address and telephone numbers.
• Financial Data includes bank account and payment card details.
• Transaction Data includes details about payments to and from you and other details of Services you have purchased from us.
• Technical Data includes IP address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access our website.
• Profile Data includes your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses.
• Usage Data includes information about how you use our Services.
• Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.
• Images of you in areas of our hotels covered by CCTV. We use CCTV in our hotels for the purposes of protecting your safety and crime detection.
• Sensitive Data. We may also collect limited amounts of more sensitive personal data in order to provide certain Services to you:
  • when you use any of our health clubs, have a consultation with a personal trainer, attend an exercise or wellbeing event or use any of our beauty services we will collect information relating to your health;
  • we will collect information about any intolerances, allergies, disability or special requirements that you tell us about;
  • we may need to collect sensitive information about you if you have an accident in one of our hotels.

We will only ever process your personal data:

1. to perform a contract with you; or
2. where we have legitimate interests to process your personal data and those interests are not overridden by your rights; or
3. in accordance with a legal or regulatory obligation; or
4. where we have your consent.

Primarily we use your personal data to operate our website, to provide our Services to you and to manage our relationship with you. We may also use your personal data for other purposes including:

• To communicate with you: To provide information which you have requested from us or which we are required to send to you, to send operational and/or marketing communications to you and to request feedback from you.
• To improve our Services and develop new ones: We track and monitor use of our Services so that we can continue to improve them and so that we can optimise user experience.
• To personalise your experience: We use the data we collect about you from different sources to try to understand more about you and your preferences, so that we can personalise your experience in the following ways:
  1. to help you complete a booking, if you leave the booking path before your booking is finalised;
  2. to identify your likes and dislikes, so that in future we send you news and offers that are more interesting to you (e.g., for certain hotels);
  3. to understand more about your preferences and purchasing habits, so that we can match you with similar customers and use this to offer you and other customers more relevant products and services. Sometimes we use third party systems or tools to help with this;
  4. to show you more relevant advertising online.
• To support you: To resolve technical support issues or respond to queries or complaints about our Services
• To protect you: To detect and prevent any fraudulent or malicious activity, to make sure that users of our website comply with our Terms of Use and to investigate accidents and improve our health and safety processes.
• To analyse and report: We may use your personal data together with that of other users of our Services to produce aggregated and anonymised analytics and reports, which we may share publicly or with selected third parties.

We may need to share and/or process your personal data with third parties. We will only disclose your personal data to:

• other companies in our group;
• third parties who facilitate delivery of our Services;
• our professional advisers;
• regulators, law enforcement bodies, government agencies, courts or other third parties where we think it’s necessary to comply with applicable laws or regulations, or to exercise, establish or defend our legal rights. Where possible and appropriate we will notify you of this type of disclosure;
• an actual or potential buyer (and its agents and advisors) in connection with an actual or proposed purchase, merger or acquisition of any part of our business;
• other third parties where we have your consent.

Most personal data collected and processed during the use of any of our Services is stored on servers located in the European Economic Area (“EEA”). Information may be transferred to our other offices and/or to third parties, which may be situated outside the EEA and may be processed by staff operating outside the EEA. When we transfer personal data from the EEA to other countries in which applicable laws do not offer the same level of data privacy protection as in the EEA, we take measures to provide an appropriate level of data privacy protection and such transfers are only made with your express individual consent, and/or for the reason that the transfer is necessary for one of the following reasons:

1. the performance of a contract between us and you;
2. public interest;
3. to establish, exercise or defend legal claims, or to protect your vital interests where you may be physically or legally incapable of doing so; and
4. for our legitimate interests where those interests are not overridden by your rights.

We may use your Identity, Contact, Technical, Usage and Profile Data to form a view as to what we think you may want or need, or what may be of interest to you. This is how we decide which of our Services and offers may be relevant for you.

You may receive marketing communications from us if you have requested information from us or purchased Services from us or if you provided us with your details when you registered for an account on our website or a promotion and, in each case, you have not opted out of receiving that marketing.

We will get your express opt-in consent before we share your personal data with any company outside the GHS group of companies for marketing purposes.

You can ask us or third parties to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent to you or by contacting us at privacy@blueorchid.com.

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

We will we keep your Contact Data after for a reasonable period of time after a contract between you and us has ended in case you choose to use the relevant Services again. In such event and unless you have opted-out of receiving marketing communications from us, we may contact you about our Services during this time.

Following the period outlined above we will ensure that your personal data is deleted or anonymised.

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

If you register for an account on our website you are responsible for upholding the confidentiality of your password and account information.

You have rights under data protection laws in some circumstances to:

1. request access to your personal data;
2. request correction of your personal data;
3. request erasure of your personal data;
4. object to processing of your personal data;
5. request restriction of processing your personal data;
6. request transfer of your personal data; and
7. to withdraw your consent.

You can exercise these rights at any time by sending an email to privacy@blueorchid.com.

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

You will not usually have to pay a fee to access your personal data (or to exercise any of your other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

If you are not happy with the way in which we are processing your personal data you have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance at privacy@blueorchid.com .

We have appointed a data protection officer (DPO) who is responsible for overseeing questions in relation to this Privacy Policy. Please address all questions and comments in relation to this Privacy Policy or the exercise of your rights under it to the DPO at:

Attn: The Data Protection Officer
Blue Orchid Group Limited
The Wellington Hotel
71 Vincent Square
London SW1P 2PA

Email: privacy@blueorchid.com.