Cookies & Privacy Policy

Background

The Retreat understands that your privacy is important to you and that you care about how your personal data is used. We respect and value the privacy of all of our customers and will only collect and use personal data in ways that are described here, and in a way that is consistent with our obligations and your rights under the law.

Information about us

The Retreat is the trading name of Hotel Exe Limited is a Limited Company registered in England under company number 11390413 operating Hotels and Hospitality Services.

Trading Address: The Retreat, 3 Catherine Street, Exeter EX1 1EU
Data Protection Officer: Data Compliance Manager
Email address: [email protected]
Telephone number: 01392 301801
Postal Address: Hotel Exe Limited, Company No: 11390413, c/o Prydis, Senate Court, Southernhay Gardens, Exeter EX1 1NT

What does this notice cover

This Privacy Information explains how we use your personal data: how it is collected, how it is held, and how it is processed. It also explains your rights under the law relating to your personal data.

What is personal data?

Personal data is defined by the General Data Protection Regulation (EU Regulation 2016/679) (the “GDPR”) as ‘any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier’.

Personal data is, in simpler terms, any information about you that enables you to be identified. Personal data covers obvious information such as your name and contact details, but it also covers less obvious information such as identification numbers, electronic location data, and other online identifiers.

The personal data that we use is set out in Part 5, below.

What are my rights?

Under the GDPR, you have the following rights, which we will always work to uphold:

The right to be informed about our collection and use of your personal data. This Privacy Notice should tell you everything you need to know, but you can always contact us to find out more or to ask any questions using the details in Part 11.
The right to access the personal data we hold about you. Part 10 will tell you how to do this.
The right to have your personal data rectified if any of your personal data held by us is inaccurate or incomplete. Please contact us using the details in Part 11 to find out more.
The right to be forgotten, i.e. the right to ask us to delete or otherwise dispose of any of your personal data that we have. Please contact us using the details in Part 11 to find out more.
The right to restrict (i.e. prevent) the processing of your personal data.
The right to object to us using your personal data for a particular purpose or purposes.
The right to data portability. This means that, if you have provided personal data to us directly, we are using it with your consent or for the performance of a contract, and that data is processed using automated means, you can ask us for a copy of that personal data to re-use with another service or business in many cases.
Rights relating to automated decision-making and profiling. Part 6 explains more about how we use your personal data, including automated decision-making and or profiling.
For more information about our use of your personal data or exercising your rights as outlined above, please contact us using the details provided in Part 11.

Further information about your rights can also be obtained from the Information Commissioner’s Office or your local Citizens Advice Bureau.

If you have any cause for complaint about our use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office.

What personal data do you collect?

In running and operating our business, we may collect and process certain data and information relating to you and our use of our website. This may occur when you visit our website, correspond with us such electronically email or by post and when you visit or stay at our hotels. Your privacy is important to us and we confirm that we will never release your personal details to any third party for their mailing or marketing purposes without your prior consent. We may collect some or all of the following personal data (this may vary according to your relationship with us):

Full or partial contact details including names and addresses (including business details if you are making a corporate booking), telephone and email details.
If you have special requirements, then it may also be necessary to collect details about diet or disability or any other preferences that you may have.
Car parking arrangements at our hotels and restaurants may also make it necessary for us to collect your car registration number for your visit to us.
If you make a purchase from us, your card information is not held by us, it is collected by our third-party payment processors, who specialise in the secure online capture and processing of credit/debit card transactions, as explained below.
We collect payment card information from you should you choose to use this form of payment for purchasing or guaranteeing use of our products and services. You may choose to store this information with us when booking online, for the purpose of making your future bookings more quickly, via SecureTrading ™ our secure online PCI DSS accredited facility.
We may monitor and record CCTV (in public areas) communications with you (such as telephone conversations and emails) for the purpose of quality assurance, training, fraud and crime prevention as well as compliance).
If you choose to connect with us via social media links, for example such as Facebook, LinkedIn, Pinterest, or Twitter, (for further details see Appendices II) we may collect your user name, your name (including surname) and email address, your gender, and your location. We may also collect your birthdate and other significant dates for making special offers to you around your birthday and other anniversaries.
From our overseas guests we may also collect passport details.
If you provide us with any personal data relating to any third party (e.g. information about your spouse, children, employees or colleagues) for particular purposes, by submitting such information to us, you warrant and represent to us that you have obtained the consent of such third party to provide us with their personal data for the respective purposes.

How do you use my personal data?

Under the GDPR, we must always have a lawful basis for using personal data. This may be because the data is necessary for our performance of a contract with you, because you have consented to our use of your personal data, we require to process it due to a legal obligation or because it is in our legitimate business interests to use it. Your personal data will be used for:

We process the personal information you have provided to us for the purposes of:

dealing with your requests;
providing reservation services;
to carry out our obligations arising from any contracts entered into between you and us and to provide you with the information, products and services that you request from us;
to notify you about changes to our service;
to ensure that content from our Websites is presented in the most effective manner for you and for your computer;
tailoring our services to your requirements and preferences; and
prospective employment enquiries and applications (via Harri)
conducting market research surveys and providing you with information about products and services we offer (where you have provided us with your consent to do so).

Health and Safety and Incident records which may be shared with our Insurers and other third parties including statutory authorities.

We process personal information we have collected about you for the purposes of:

administering our Websites and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes;
improving our Websites to ensure that content is presented in the most effective manner for you and for your computer;
allowing you to participate in interactive features of our service, when you choose to do so;
our efforts to keep our Websites safe and secure;
measuring or understanding the effectiveness of advertising we serve to you and others, and to deliver relevant advertising to you; and
making suggestions and recommendations to you and other users of our Site about goods or services that may interest you or them.

Where we have received personal information from other sources, we may combine this information with information you give to us and information we collect about you. We may us this information and the combined information for the purposes set out above (depending on the types of information we receive.

With your permission and/or where permitted by law, we may also use your personal data for marketing purposes, which may include contacting you by email and or telephone and or text message and or post with information, news, and offers on our products services. You will not be sent any unlawful marketing or spam. We will always work to fully protect your rights and comply with our obligations under the GDPR and the Privacy and Electronic Communications (EC Directive) Regulations 2003, and you will always have the opportunity to opt-out.

Profiling

We may analyse your personal information to create a profile of your interests and preferences so that we can contact you with information relevant to you. This automated processing is intended to evaluate certain personal aspects of an individual. We may also use your personal information to detect and reduce fraud and credit risk.

Use of Cookies

Like many other websites, Castlebridge Hospitality and its Hotel websites uses cookies. ‘Cookies’ are small pieces of information sent by an organisation to your computer and stored on your hard drive to allow that website to recognise you when you visit. Cookies are sometimes used to improve the website experience of a visitor to a website. They collect statistical data about your browsing actions and patterns and do not identify you as an individual. For example, we use cookies to pre-fill some information on forms and to enable us to see what people view on the website and for how long. The use of cookies enables us to improve our website, deliver effective marketing and offer a more personalised service. You are welcome to change your browser settings to not accept our cookies; should you choose to do this you may find that the functionality of our websites is reduced.

We may use cookies on Group websites for the following purposes:

To enable certain feature and functions on group websites (e.g. remembering your user-id, browsing and other product and/ or service preferences);
To identify the causes of problems arising at web servers and to resolve these problems or improve efficiency of group websites.
To improve the contents of group websites and emails from us;
To customise the contents of group websites and emails from us to suit your individual interests or preferences;
To utilise your browsing history on group websites and the results of questionnaires for market research or marketing, including sending you advertisements via group websites;
To obtain aggregated group website usage and visitation statistics;
To administer services to you; and for purposes which are reasonably related to the aforesaid.

Details of cookies which we use provided in Appendices II. If you do not know what Cookies are, or how to control or delete them, then we recommend you visit http://www.aboutcookies.org or http://www.youronlinechoices.com for detailed guidance. If you are not happy, then you should either not use our sites, or you should delete Cookies having visited the site, or you should browse the site using your browser’s anonymous usage setting (called “Incognito” in Chrome, “InPrivate” in Internet Explorer, “Private Browsing” in Firefox and Safari etc).

Phishing

Phishing is the practice of tricking someone into giving confidential information. Examples include falsely claiming to be a legitimate company when sending an e-mail to a user, in an attempt to get the user to send private information that will be used for identity theft and fraud.

We will never ask you to confirm any account or credit card details via email. If you receive an email claiming to be from The Retreat or associated companies asking you to do so, please ignore it and do not respond. You can contact our Data Compliance Manager to report it or if you are unsure.

Guest Wi-Fi

Our guest Wi-Fi service is provided contracted trusted third party. If you choose to use the service to access web sites or content provided by third parties or purchase products from third parties, then your personal information may be available to the third-party provider. The way third parties handle and use your personal information related to the use of their services is governed by their policies. The Retreat has no responsibility for their policies, or third parties’ compliance with them. Our guest wireless/wired systems use radio channels or local area networks to transmit voice and data communication information; privacy therefore cannot be guaranteed, and The Retreat shall not be liable to you for any lack of privacy you experience while using the service.

Whilst we take reasonable, appropriate technical and organisational measures to safeguard the personal data that you provide to us, no transmission over the internet can ever be totally guaranteed secure. Consequently, please be aware that we cannot guarantee the complete security of any personal data that you transfer over the internet to us whilst in transit. Sending such information is entirely at your own risk.

We advise that you follow general internet security guidelines:

Always log out and close the website browser when you complete an online session, especially if you are using a computer or terminal in a public location.
Keep your online account passwords private. Our online accounts are intended for single guest use and link information provided to your guest record.
When creating a password, use at least 8 characters. A combination of letters and numbers is best. Dictionary words, your name, email address, or other personal data that can be easily obtained are best avoided for passwords.
Avoid using the same password for multiple online accounts.

How long will you keep my personal data?

We will not keep your personal data for any longer than is necessary in light of the reason(s) for which it was first collected. Your personal data will therefore be kept in accordance with the Company Retention Policy.

How and where do you store or transfer my personal data?

We may store or transfer some or all of your personal data in countries that are not part of the European Economic Area (the “EEA” consists of all EU member states, plus Norway, Iceland, and Liechtenstein). These are known as “third countries” and may not have data protection laws that are as strong as those in the UK and/or the EEA. This means that we will take additional steps in order to ensure that your personal data is treated just as safely and securely as it would be within the UK and under the GDPR as follows.

We share your data within the group of companies of which we are a part. Where this involves the transfer of personal data outside the EEA, our group ensures that personal data is protected by requiring all companies within the group to follow the same rules with respect to personal data usage. These are known as “binding corporate rules”. More information on binding corporate rules is available from the European Commission.

Do you share my personal data?

We may share your personal data with other companies in our group who share a central reservation and data processing systems. This includes subsidiaries and/or our holding company and its subsidiaries.

We may sometimes contract with the following third parties to supply products and or services to you on our behalf. These may include corresponding with you on our behalf, assisting us in the management functions or our business. The processing of data, payments, delivery, and marketing. In some cases, those third parties may require access to some or all of your personal data that we hold.

If any of your personal data is required by a third party, as described above, we will take steps to ensure that your personal data is handled safely, securely, and in accordance with your rights, our obligations, and the third party’s obligations under the law, as described above in Part 8.

If any personal data is transferred outside of the EEA, we will take suitable steps in order to ensure that your personal data is treated just as safely and securely as it would be within the UK and under the GDPR, as explained above in Part 8.

In some limited circumstances, we may be legally required to share certain personal data, which might include yours, if we are involved in legal proceedings or complying with legal obligations, a court order, or the instructions of a government authority

Links to other websites

Our website contain links to other websites run by other organisations including; Facebook, Linkedin, Pinterest, Resdiary, IHG, Instagram and Twitter (Their Privacy Policies can be access via the links listed in Appendices I). This privacy policy applies only to our website‚ so we encourage you to read the privacy statements on the other websites you visit. We cannot be responsible for the privacy policies and practices of other sites even if you access them using links from our website.

In addition, if you were referred to our website from a third-party site, we cannot be responsible for the privacy policies and practices of the owners and operators of that third-party site and recommend that you check the policy of that third-party site.

How can I access my personal data?

If you want to know what personal data we have about you, you can ask us for details of that personal data and for a copy of it (where any such personal data is held). This is known as a “subject access request”.

All subject access requests should be made in writing and sent to the email or postal addresses shown in Part 12. To make this as easy as possible for you, a Subject Access Request Form is available for you to use. You do not have to use this form, but it is the easiest way to tell us everything we need to know to respond to your request as quickly as possible.

There is not normally any charge for a subject access request. If your request is ‘manifestly unfounded or excessive’ (for example, if you make repetitive requests) a fee may be charged to cover our administrative costs in responding.

We will respond to your subject access request within 28 Days and, in any case, not more than one month of receiving it. Normally, we aim to provide a complete response, including a copy of your personal data within that time. In some cases, however, particularly if your request is more complex, more time may be required up to a maximum of three months from the date we receive your request. You will be kept fully informed of our progress.

How do I contact you?

To contact us about anything to do with your personal data and data protection, including to make a subject access request, please use the following details (for the attention of Data Controller:

Email address: [email protected]
Telephone number: 01392 301801
Postal Address: Hotel Exe Limited, Company No: 11390413, c/o Prydis, Senate Court, Southernhay Gardens, Exeter EX1 1NT

Opt out

You have a choice about whether or not you wish to receive information from us. We will not make contact with you unless you have opted in. If then, you no longer want to receive direct marketing communications from us about the hotels and our favourite local areas, then you can change your preferences or completely unsubscribe in one of two ways:

Click the ‘unsubscribe’ or ‘change preferences’ link at the bottom of marketing emails sent to you
Email gdpr@retreatexeter.co.uk or telephone 01392 301801 and we will process your request within 28 days
We will not contact you for marketing purposes by email, phone or text message unless you have given your prior consent. We will not contact you for marketing purposes by post if you have indicated that you do not wish to be contacted.

Business transfer

In the event that our business is transferred, sold or integrated with another business, your details may be disclosed to our advisers and any prospective purchaser’s advisers and may be passed to the new owners of the business.

Changes to this Privacy Notice

We may change this Privacy Notice from time to time. This may be necessary, for example, if the law changes, or if we change our business in a way that affects personal data protection.

Any changes will be made available via our website sjhotels.co.uk. Following any changes, the new version of the policy will be uploaded to the websites and the old versions removed. Please check or website frequently to see any updates.

Appendices 1

Google Analytics

We use analytics Cookies to find out more about how you use our website – like the pages you visit, the searches you make and your preferences in order to improve the user experience. All user data is anonymous. You can find out more about Google’s position on privacy as regards its analytics service at;

https://support.google.com/analytics/answer/6004245

IHG Hotel Indigo

The Retreat is associated with the Hotel Indigo Exeter. The Hotel is operated by Hotel Exe Limited which has a franchise to operate Hotel Indigo and a hotel brand owned by Intercontinental Hotel Group (IHG). Your data maybe shared with IHG and is subject to their privacy policies. Further details can be obtained at:

https://www.ihg.com/content/us/en/customer-care/privacy_statement

Restaurant Diary

The Restaurant Diary widget that you use to book a table at one of our restaurants uses Cookies help you personalise your online experience and store some of your booking details. Further details can be obtained at;

https://sales.resdiary.com/privacy-statement/

Guest Revu

We use Guest Revu, a third party company used by the us to obtain guest feedback. We see feedback as a vital part of “legitimate business” for hotels and their guests, to measure and monitor the standards and satisfaction levels of a provided service. Guest Feedback is a specific process that gives each and every guest a chance to comment on whether they have received good service for a particular event or stay, or enjoyed a good experience. It’s done for the guests’ benefit, to meet their needs and expectations, to measure and improve their experience, and in order to maintain standards and service levels for guests.

https://www.guestrevu.com/privacy

Wi-Fi systems

Our hotel Wi-Fi systems are provided by AirAngel. This company use Location Based Services (LBS) to understand traffic patterns in venues. The location data we capture helps us to understand venues, such as how long customers stand in line and how they generally move around an area, enhancing operational efficiency and improving the user experience.

If you would like to find out more about the data they collect through Mobile Location Analytics MLA, take a look at our solution providers location analytics policy, alternatively, you can opt out of location analytics.

We use Location Based Services (LBS) to understand traffic patterns in venues. The location data we capture helps us to understand venues, such as how long customers stand in line and how they generally move around an area, enhancing operational efficiency and improving our user experience. Further details of AirAngel privacy policy can be obtained at;

https://www.airangel.com/privacy-policy-2018-04/

Other websites which we have widget links to include;

https://en-gb.facebook.com/full_data_use_policy

https://www.linkedin.com/legal/privacy-policy

https://policy.pinterest.com/en-gb/privacy-policy

https://twitter.com/en/privacy

Cookie	Duration	Description
cookielawinfo-checkbox-advertisement	1 year	Set by the GDPR Cookie Consent plugin, this cookie is used to record the user consent for the cookies in the "Advertisement" category .
cookielawinfo-checkbox-analytics	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics".
cookielawinfo-checkbox-functional	11 months	The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
cookielawinfo-checkbox-necessary	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-others	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other.
cookielawinfo-checkbox-performance	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
CookieLawInfoConsent	1 year	Records the default button state of the corresponding category & the status of CCPA. It works only in coordination with the primary cookie.
viewed_cookie_policy	11 months	The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.

Cookie	Duration	Description
_ga	2 years	The _ga cookie, installed by Google Analytics, calculates visitor, session and campaign data and also keeps track of site usage for the site's analytics report. The cookie stores information anonymously and assigns a randomly generated number to recognize unique visitors.
_ga_1V6HX1PXB1	2 years	This cookie is installed by Google Analytics.