Privacy policy

01

1. Who we are

The Kensington Collection’s hospitality management company is Rhodiumshaw Limited. In this policy, “we”, “us” and “our” mean Rhodiumshaw Limited, the controller of personal information used to manage this website, guest enquiries, reservations, hospitality services and marketing.

Company number 13894430, registered in England and Wales. Registered office: Universal Square Building 5, 5th Floor, Devonshire Street North, Manchester, England, M12 6JH.

This policy covers thekensingtoncollection.co.uk and our management of Ashburn Hotel, Ashburn Court, Claverley Court and Chesham Court. It explains how we use information about guests, enquirers, people booking for others, website visitors and business contacts. Independent booking platforms, payment providers and other organisations may control information for their own purposes; their privacy notices explain those activities.

02

2. Contact us about your information

For a privacy question, to exercise a data protection right or to make a data protection complaint, email reservations@thekensingtoncollection.co.uk with “Privacy enquiry” or “Data protection complaint” in the subject line. You can also write to Privacy Enquiries, Rhodiumshaw Limited, at our registered office above.

Please do not send payment card details, identity documents or detailed medical information in an initial email or website enquiry.

03

3. Information we collect and where it comes from

Depending on how you interact with us, information may include:

• Contact and enquiry details: name, email, telephone, correspondence and the information you provide when asking about a stay.
• Reservation and guest details: dates, property and accommodation preferences, party size, guest names, requests, booking references, arrival arrangements and records of your stay.
• Payments and transactions: billing details, amounts, payment status, refunds and transaction references. Payment providers process information needed to complete transactions.
• Registration information: identity, address, nationality or travel-document details where needed for guest-registration requirements or proportionate identity checks. We explain what is required when we request it.
• Preferences and communications: marketing choices, consent records, feedback, complaints and information needed to arrange a service you request.
• Business contacts: job role, employer, agency or company details when arranging corporate stays or working with travel partners.
• Technical information: IP address, browser and device details, website requests, security logs, referring pages and website interactions, subject to applicable cookie choices.

We receive information from you and, where relevant, from a person booking for you, your employer, travel agent, booking platform, payment provider or service partner. If you provide another guest’s information, please make sure they know and share this policy with them. Children may stay with us; an adult should manage the reservation and related communications, and provide only information about children needed to arrange the stay.

04

4. Why we use information and our lawful bases

We process personal information under the UK GDPR and the Data Protection Act 2018, as amended. The lawful basis depends on the purpose:

• Enquiries and bookings: steps at your request before a contract and performance of our contract. For accompanying guests or booking contacts, our legitimate interests in arranging and administering the stay.
• Accommodation and requested services: performance of our contract or legitimate interests in supporting guests where someone else booked. This includes arrival, housekeeping and essential service messages.
• Payments, refunds and accounts: our contract, tax and accounting obligations, and legitimate interests in managing payments and resolving disputes.
• Legal and regulatory requirements: compliance with obligations applying to our business, including relevant guest-registration, tax and regulatory requirements.
• Security, fraud prevention and complaints: legitimate interests in protecting guests, staff, property and systems, resolving concerns, improving service and dealing with legal claims; or a legal duty where one applies.
• Marketing: your consent, or our legitimate interests where the law permits marketing without consent.
• Website operation and measurement: legitimate interests in secure, usable essential functions, and consent where required for optional analytics, advertising or similar technologies.

When relying on legitimate interests, we consider the purpose, necessity and effects on your rights and expectations. You can ask about this assessment. Some information is needed for an enquiry, booking or legal requirement; without it, we may be unable to complete a booking or provide a service. We identify required information when collecting it. Optional marketing choices do not affect your ability to book.

05

5. Health, accessibility and other sensitive information

You may ask us to accommodate an accessibility need, allergy, dietary requirement or other request that reveals health or special category information. Please share only what we need, rather than a detailed medical history.

Where we process this information, we need both a lawful basis and an additional condition for special category data. For a voluntary request, this will ordinarily be your explicit consent, obtained separately where needed. Sending an enquiry alone is not explicit consent for every use. Other conditions may apply in limited circumstances, such as vital interests or legal claims.

You can withdraw consent by contacting us. This does not affect earlier lawful processing, but may limit our ability to fulfil the particular request.

06

6. Marketing and your choices

When you subscribe, Rhodiumshaw Limited uses your details to send The Kensington Collection news, accommodation offers and updates through the channels you choose. Unsubscribe using the link in an email or contact us directly.

Where permitted, we may use the existing-customer “soft opt-in” for our own similar services, but only when we obtained your details directly during a sale or negotiations for a sale and offered a clear, free opt-out when collecting them and in every later marketing message. A previous stay, partner relationship or third-party booking does not automatically give us permission to market to you.

Where business-to-business marketing rules permit contact without prior consent, we still respect objections and provide an opt-out. Rules differ for individuals, sole traders and some partnerships.

You have an absolute right to object to direct marketing, including related profiling, at any time. We will stop using your information for that purpose and may retain a limited suppression record to honour your choice. Essential reservation and service messages may still be sent when needed for your booking.

07

7. Cookies and similar technologies

Our website uses technologies that support its operation, including session storage that remembers stay-finder choices during your browser session. The website also includes Google Tag Manager, which manages website tags; cookies and data collection depend on the tags configured within it.

Strictly necessary storage supports functions you request, such as reservation searches or security. Optional technologies may measure website performance or advertising effectiveness. Where consent is legally required, they must remain inactive until you choose to allow them. Rejecting optional technologies must not prevent you from booking.

You can manage cookies through your browser settings. Blocking necessary cookies may affect website functions. Where a cookie preference control is provided, use it to review or change your choices. The booking service may use its own cookies and controls. Contact us for information about a particular cookie or technology; this policy does not replace consent controls required for optional tracking.

08

8. Who receives your information

We share information where needed for the purposes described in this policy, with appropriate limits. Recipients can include:

• Authorised reservations, reception, guest-service and hospitality-management staff.
• Website hosting, booking, property-management, customer-relationship, communications, IT-support and security providers.
• Payment processors, banks and providers supporting refunds, payment verification or fraud prevention.
• Travel agents, booking platforms, corporate bookers and people arranging your stay, as needed to manage that booking.
• Chauffeur, concierge, housekeeping or other providers when needed to fulfil a service you request.
• Professional advisers, insurers, auditors, regulators, courts, law-enforcement bodies and others where disclosure is necessary and lawful.
• Parties involved in a proposed business transfer or restructuring, subject to appropriate confidentiality and data-protection safeguards.

Providers acting on our instructions must process information under appropriate contractual terms. Independent controllers are responsible for their own processing and notices. We do not treat a booking as consent to unrelated third-party marketing.

09

9. Information processed outside the UK

Some service providers may store or access information outside the UK. Where this is a restricted international transfer, it must be covered by a relevant UK adequacy regulation, appropriate safeguards such as the UK International Data Transfer Agreement or UK Addendum to approved contractual clauses, or a permitted legal exception.

The applicable mechanism depends on the provider, destination and processing. Contact us to ask where information relevant to your interaction is processed and for information about, or a copy of, the applicable safeguards, with confidential information redacted where necessary.

10

10. How long we keep information

We keep identifiable information for the period needed for its purpose, taking account of legal requirements and proportionate business needs:

• Enquiries: to respond, complete follow-up and resolve outstanding issues; booking-related enquiries become part of the booking record.
• Reservations, transactions and accounts: for the stay and any further period required for accounting and tax, refunds, disputes and applicable legal-claim periods.
• Guest registration: the period required by applicable law.
• Special requests: as long as needed to fulfil the request, unless a further lawful reason justifies retention.
• Marketing: while a subscription or other lawful basis remains current, with periodic review. Limited consent and suppression records may be kept longer to demonstrate and honour your choices.
• Technical and security records: according to their operational purpose, security needs and the technology’s expiry period.
• Complaints and claims: until resolved and for any further period justified by legal obligations or applicable claim periods.

A legal hold or active dispute can require longer retention. When information is no longer needed, it should be securely deleted or anonymised. Contact us about the period applying to a particular record.

11

11. Security

We use organisational and technical measures appropriate to the information and risks, including limiting access to people who need it for their work. No online system can be guaranteed completely secure. Please use the designated booking or payment service for financial information and tell us promptly if you suspect misuse of information connected with your booking.

12

12. Your data protection rights

Depending on the circumstances and lawful basis, you can ask us to:

• Give you access to your personal information and details about how it is used.
• Correct inaccurate or incomplete information.
• Erase information where legal conditions are met.
• Restrict processing where the law provides.
• Provide certain information in a portable format where processing is automated and based on consent or contract.
• Respect your objection to processing based on legitimate interests, taking account of your circumstances.
• Respect withdrawal of consent without affecting earlier lawful processing.

You can object to direct marketing at any time, without giving a reason. If a decision about you falls within legal rules for solely automated significant decisions, you can exercise applicable safeguards, including requesting human intervention, expressing your view and contesting the decision.

Contact us using the details above. We normally respond to rights requests within one month without a fee. Where the law permits an extension, we will explain why and the revised timescale. We may need proportionate information to verify identity or clarify a request. Rights are subject to legal conditions and exemptions; we will explain if we cannot comply.

13

13. Complaints

If you are concerned about our use of personal information, email us or write to our registered office, marking the message “Data protection complaint”. Explain what happened and the outcome you seek; no particular form is required.

We will acknowledge a data protection complaint within 30 days, investigate without undue delay, keep you informed and explain the outcome.

You also have the right to complain to the Information Commissioner’s Office, the UK’s data protection regulator: telephone 0303 123 1113; or write to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. You do not need our permission to contact the ICO.

14

14. Other websites and updates to this policy

Our website links to a booking service, WhatsApp and social-media services. Their own privacy information applies when you choose to use them. This policy explains Rhodiumshaw Limited’s processing and does not replace those providers’ notices.

We may update this policy to reflect changes to our services, processing or the law. The revision date above identifies the current version; where required, we will draw significant changes to your attention.