Privacy Policy
Last updated:
This policy explains how Hospitality Group Experience Ltd (“Hospitality Group”, “we”, “us”) collects and uses personal data when you visit hospitalitygroup.uk, send us an enquiry or download one of our guides, and the rights you have. We handle personal data in line with UK data protection law: the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
Hospitality Group Experience Ltd is the controller of your personal data, which means we decide how and why it is used. We are a company registered in England and Wales with company number 17483702.
For any question about this policy or your personal data, email us at info@hospitalitygroup.uk.
2. The personal data we collect
We collect only what you give us through our forms or by email and, if you accept analytics cookies, information about how you use our website.
- Enquiry and quote forms (on our contact, travel partners and group pages and in the trip planner): your name and email address and, if you give them, your company or organisation and country, plus the details of your trip: type of group, group size, travel dates, the places you plan to visit, the services you need, budget per person and your message. We also record the page you sent the form from and its language.
- Venues and suppliers form: your name, email address, company and country, the type of venue or service you offer, its UK location and your message.
- Guide downloads: your name, email address, company (optional), the language of the page and the page you downloaded the guide from.
- Trip planner: the description of your trip that you type in. It is sent to an AI service to prepare suggestions, and we don't save it unless you then send it to us as an enquiry. Please don't include health details, such as allergies. To limit each visitor to a few plans a day, we store a pseudonymised code made from your IP address and the date (never the address itself); it is needed for 24 hours, and codes more than two days old are deleted automatically each time the planner is used.
- Emails and bookings: the emails you send us and our replies and, if your enquiry becomes a booking, the details needed to arrange it, such as contact names, numbers of people, dates, times, services and the dietary requirements or allergies you tell us about.
- Use of the website: only if you accept analytics cookies, Google Analytics collects information such as the pages you view, how you reached our site, your type of device and browser, and your approximate location (town or country). When a form is sent successfully we record the event (the type of form, the language and, if chosen, the type of group), never your name, email address or message.
- Portal accounts: for staff and venue partners who sign in to our portals, their name, email address, role and the records they work with.
Some details, such as dietary requirements, allergies or other needs, can reveal information about health or religious beliefs. Please share only what is needed to arrange your group's meals and services.
If you give us details about other people, such as the members of your group, please make sure they know you are sharing them with us and that they can read this policy.
3. How we use it and our lawful bases
We use personal data only for the purposes below, each with a lawful basis under the UK GDPR:
- Replying to your enquiry and preparing quotes, itineraries and proposals: taking steps you ask for before entering into a contract, and our legitimate interests in answering enquiries from organisers and businesses.
- Arranging and delivering the services you book, including working with the venues and suppliers involved: performance of our contract with you or your organisation.
- Replying to and following up on your enquiries and quote requests: our legitimate interests in running and developing our business. We send marketing emails about our services only to business contacts, such as travel agencies, companies and schools, or to people who have agreed to receive them; each one lets you unsubscribe, and you can ask us to stop at any time.
- Keeping accounting and tax records: compliance with our legal obligations.
- Measuring how our website is used with Google Analytics: your consent, which you give by clicking “Accept” in our cookie banner and can withdraw at any time through Cookie settings.
- Keeping our website and services secure, preventing misuse (for example, the trip planner's daily limit) and establishing or defending legal claims: our legitimate interests.
- Running portal accounts for staff and venue partners: performance of our contract with them, or our legitimate interests in working with our partners.
Dietary requirements, allergies and other health details are used only to arrange your group's meals and services. They are shared only with the venues and suppliers involved (our email service delivers the booking notices that contain them) and, if you type them into the trip planner, with its AI service, so please leave them out of the planner. Our lawful basis is your explicit consent: when we collect these details for a booking, we ask you to confirm in writing (for example, by email) that you agree to us using them and, where they concern other members of your group, that those people (or, for children, a parent or guardian) have agreed. You can withdraw consent at any time by asking us to delete them; we will then be unable to pass these needs on to the venues.
Where we rely on legitimate interests, we have weighed them against your rights, and you can object at any time (see “Your rights”).
5. International transfers
Some of our service providers are based outside the UK, for example in the European Economic Area or the United States, or store data there. When personal data leaves the UK, we make sure it is protected as UK law requires: the destination is covered by UK adequacy regulations (for example, the EEA, or US companies certified under the UK Extension to the EU-US Data Privacy Framework), or the transfer is covered by the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU standard contractual clauses. You can ask us for more information about these safeguards.
6. How long we keep it
We keep personal data only for as long as we need it:
- Enquiries that don't become bookings: up to 24 months after our last contact with you.
- Bookings and accounting records: six years after the end of the financial year they relate to, as UK tax law requires.
- Guide download contacts: 24 months after the download, unless you ask us to delete them sooner.
- The trip planner's daily-limit codes: needed for 24 hours; codes more than two days old are deleted automatically each time the planner is used.
- Google Analytics data: Google keeps the event-level data for the retention period set in our Google Analytics account.
- Portal accounts: while the account is open; the records it worked on are kept as above.
After these periods we delete the data or make it anonymous.
7. How we protect it
We use providers with strong security measures. Data travels encrypted (HTTPS), only authorised staff can see enquiries, and our systems control access by role. No system is completely secure, but if a breach is likely to put your rights at risk, we will tell you and the ICO as the law requires.
8. Your rights
Under UK data protection law you have the right to:
- Access: find out what personal data we hold about you and get a copy of it.
- Rectification: have inaccurate or incomplete data corrected.
- Erasure: have your data deleted when we no longer have a reason to keep it.
- Restriction: ask us to limit how we use your data, for example while we check a complaint about it.
- Objection: object to our use of your data based on legitimate interests, and to direct marketing at any time.
- Portability: receive the data you gave us in a commonly used electronic format, or have it sent to another organisation, where we rely on your consent or a contract.
- Withdrawal of consent: withdraw your consent at any time where we rely on it, such as for analytics cookies (through Cookie settings) or dietary and health details. This doesn't affect what we did before.
To use any of these rights, email info@hospitalitygroup.uk. It is free in most cases. We may ask you to confirm your identity, and we will reply within one month (or tell you if we need up to two more months for a complex request).
9. Automated decisions
We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. The trip planner's AI suggestions are only a starting point: our team reviews every enquiry personally.
10. Children
Our website and services are for adults who organise group travel and are not directed at children under 16. School trips are arranged with teachers and trip organisers, not with pupils. When you organise a trip for young people, please send us only the details we need to arrange it, such as numbers, ages and dietary requirements.
11. Complaints
If you have a concern about how we use your personal data, please contact us first at info@hospitalitygroup.uk and we will try to resolve it. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: ico.org.uk.
13. Changes to this policy
We may update this policy from time to time. The “Last updated” date at the top shows when it last changed, and we will make any significant change clear on this page. Where this policy is translated into other languages, this English version prevails if they differ.