For the purpose of applicable data protection legislation, the data controller of your personal
data is:
‘The Group’ (Barworks Limited, 1st Floor Olympus House, Quedgeley, Glos GL2 4NF)
1. Introduction
This Privacy Statement applies to the processing by The Group as relevant of your personal data. Barworks Ltd take your privacy very seriously and treat all your personal data with great care, acting in accordance with the applicable data protection legislation at all times.
When you use our hotspots, make a reservation, contact us or sometimes when you visit our properties, we may collect information from and about you. Some of the information we collect may be classed as personal data under the GDPR legislation.
This Privacy Statement describes which personal data is collected and for which purposes this personal data is processed by The Group. It also states which rights you have under applicable data protection legislation.
2. Categories of information that we collect
The Group collects information about you in the following ways.
Information you give to us. This includes personal data collected:
- Through our Website when you register, login, commence or complete an online transaction to use our services;
- When you contact our reservations team to make a booking or use the facilities at any of our properties. Facilities include, but are not limited to, meeting rooms, bar and/or restaurant, function rooms, and guest Wi-Fi;
- When you have provided your consent, in order to:
- sign up to any of our loyalty programmes;
- subscribe to any of our marketing communications, complete customer surveys, enter competitions or provide feedback.
When we do business with you, which will usually include:
- Full or partial contact details including names and addresses (including business details if you are making a corporate booking), telephone and email details;
- If you have special requirements, then it may also be necessary to collect details about diet or disability or any other preferences that you may have;
- We collect payment card information from you should you choose to use this form of
payment for purchasing or guaranteeing use of our services; - We may also collect your birthdate and other significant dates for making special offers to you around your birthday and other anniversaries;
- We may also collect passport details.
Information Automatically Collected. This includes information and personal data collected:
- Through CCTV at our properties. We operate CCTV systems at our properties. These are in operation and video recordings may be made. This activity is carried out for security and service reasons for the better management of our properties and security for all clients and staff as well as in accordance with our license.
3. Why and how do we process your data?
Your personal data will be stored in:
- centralized systems which are under the control of The Group and are accessible by
authorized staff of The Group as relevant; - some local systems controlled solely by The Group.
Such systems are backed up daily to the cloud using Microsoft storage facilities. Microsoft maintains a network of data centres around the world and verifies that each centre meets stringent security requirements.
We use the information we collect about you to process your bookings, answer your queries, process your gift card purchases, provide our bar and restaurant facilities / services and provide loyalty programmes. With your consent, we will contact you via our marketing and sales channels (email/ phone/ post) about other related services we, or our group business, provide which we think may be of interest to you. Our marketing communications are generally sent by email but we may sometimes use other methods of delivery such as by post or SMS.
We mainly collect, store and process personal data at two different stages:
1. before you decide to visit The Group;
2. when you visit, or have visited, The Group.
When you make a reservation, you will have to provide us with your name, email address, phone number, the dates you are wanting to book with us and credit card details or other payment information as applicable. We use this personal data to process the reservation, for billing purposes, and to allow us to communicate with you about your reservation. When you book in one of our sites, we will collect personal data about your preferences and use of our services and locations.
We may at each of the stages outlined above use your personal data but only when and to the extent the law allows us to. Most commonly, we will use your personal data in the following circumstances:
- Where we need to perform the contract we are about to enter into or have entered into with you;
- Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests;
- Where we need to comply with a legal or regulatory obligation.
For your convenience, we have made an overview of activities that involve the processing of your personal data:
- We store the personal data you provide to us in our systems for administrative purposes;
- We store your personal data in our database(s), also after your transaction has been completed, and if you have signed up a loyalty programme, to be able to contact you and welcome you again in the future;
- We process your booking, howsoever made directly via our website or via a third party reservations agent;
- We offer and provide services you request from us or which we may think you are interested in, via email, telephone or other media. These marketing communications contain commercial offers and news of The Group and related third parties;
- We use credit card data or other payment data for invoicing purposes;
- We collect data on your use of our Wi-Fi services for security and anti-piracy purposes (such as: IP address, your device’s MAC address, connections made, location, etc.). We do not process the content of traffic;
- We endeavour to provide a high level of security of both the information we store as well as our facilities, (IT) systems and premises, by means of encryption, physical security measures, passwords, company procedures and policies and professional IT support. Personal data may be processed in this context by The Group as relevant and their respective vendors;
- We endeavour to prevent our services and facilities (properties) from being used for illegal purposes, of any kind. Personal data may be processed in this context by The Group as relevant and their respective vendors, such as through CCTV surveillance;
- We engage in activities required for compliance with legal obligations, third party claims or requests from public authorities, such as the mandatory storage/containment of certain information because of a criminal investigation;
- If you have special requirements, then it may also be necessary to collect special categories of personal data in relation to diet or disability.
We are committed to collecting and using your personal data in accordance with applicable data protection laws. We will only collect, use and share your personal data where we are satisfied that we have an appropriate legal basis to do this.
This may be because:
- you have provided your consent to us using the personal data;
- our use of your personal data is necessary to perform our contract with you;
- our use of your personal data is necessary to meet responsibilities we have to our regulators, tax officials, law enforcement, or otherwise meet our legal responsibilities;
- our use of your personal data is in our legitimate interest as a commercial organisation, for example to operate and improve our services and to keep people informed about our services; – in these cases we will look after your information at all times in a way that is proportionate and respects your privacy rights.
After a period of 6 months, all reasonable endeavours will be taken to remove your data from our systems, except for data that we are required to retain for legal and/or regulatory purposes.
4. Sharing your data
We may share your personal data as follows:
- Third Parties Designated by You. We may share your personal data with third parties where you have provided your consent to do so;
- Our Third-Party Service Providers. We may share your personal data with our third party service providers who provide services such as payment processing, information technology and related infrastructure provision, business support (operational and administrative), customer service, the processing and delivery of marketing communications to you, email delivery, auditing and other similar services. These third parties are only permitted to use your personal data to the extent necessary to enable them to provide their services to us. They are required to follow our express instructions and to comply with appropriate security measures to protect your personal data. Third parties are subject to confidentiality obligations and may only use your personal data to perform the necessary functions and not for other purposes;
- Affiliates. We may share some or all of your personal data with our affiliates, in which case we will require our affiliates to comply with this Privacy Statement. By way of example, you may let us share personal data with our affiliates where you wish to receive marketing communications from them.
Other Disclosures. We may share personal data as we believe necessary or appropriate:
a. to comply with applicable laws;
b. to comply with lawful requests and legal process, including to respond to requests from public and government authorities to meet national security or law enforcement requirements;
c. to enforce our Privacy Statement;
d. to protect our rights, privacy, safety or property, and/or that of you or others.
We do not share your data with any third parties outside of the above processing arrangements and we do not share your data with any business external to our group for their own marketing purposes. From the data we collect, you should only ever receive marketing communications from our own group.
5. Your rights
The GDPR provides the following rights for individuals:
Right to revoke consent
If we process personal data on the basis of your consent, you have the legal right to revoke such consent at any time. We will then cease the relevant processing activity going forward.
Right of access to your information
If you want to know what personal data we have collected or process about you, you may request us to provide a copy of your personal data by contacting The Group. We will ask you to identify yourself. We will not provide you with a copy of your personal data to the extent that the rights and freedoms of others are or may be adversely affected.
Right to rectification and erasure of data, and restriction of processing
If you believe that our processing of your personal data is incorrect, inaccurate, unlawful, excessive, incomplete, no longer relevant, or if you think that your data is stored longer than necessary, you may ask us to change or remove such personal data or restrict such processing activity.
Right to data portability
You have the right to receive your personal data, which you have provided to us, in a structured, commonly used and machine-readable format, in accordance with General Data Protection Regulations.
Right to object
You have the legal right to object, on grounds relating to your particular personal situation, at any time to processing of your personal data which is based on our legitimate interests. Furthermore, you have the right to object at any time to our processing of your personal data for direct marketing purposes. You can do this by either:
(i) opting out by using the option we provide in the relevant direct marketing message (e.g. an email newsletter), or
(ii) by contacting either The Group directly.
For the sake of clarity: without prejudice to the foregoing we are at all times entitled to send you messages that do not constitute direct marketing, i.e. service messages.
6. General information relevant for all requests and queries
Nothing in this Privacy Statement is intended to provide you with rights beyond or in addition to your rights as a data subject under applicable mandatory data protection law.
We will use reasonable endeavours to respond to your request or query within one month. We are entitled to extend this term by another two months if the complexity of the situation so requires. If your request is manifestly unfounded or excessive, we may either:
(i) charge you a fee, or
(ii) refuse to process your request. With respect to access requests we may also charge you for extra copies. If we decide not to honour your request or answer your query, we will explain our reasons for doing so in our reply.
7. Protection and Storage of your data
We have used and will continue to use reasonable endeavours to protect your personal data against loss, alteration or any form of unlawful use. Where possible, your personal data will be encrypted and stored on a virtual private server that is secured by means of state-of-theart protection measures. A strictly limited amount of people have access to your personal data.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
8. General
We are committed to resolve any complaints about our collection or use of your personal data. In case you have any questions in relation to this Privacy Statement or our practices in relation to your personal data, or you wish to exercise any of your right you may contact us using the details in our letterhead.
This policy and conduct has been approved by:
Name: Tanja Schoenberger
Position: Head of Operations & People Management for and on behalf of Barworks Ltd.
Date: November 2023