Privacy

1. Introduction

This Privacy Policy outlines how Oceana Hotels & Restaurants, including its parent, subsidiary, and affiliated group entities (“we”, “us”, “our”), collect, use, store, and protect personal data belonging to guests, website visitors, staff, venue patrons, and business partners.

This policy applies to personal data processed across all our services, including our websites, online booking engines, physical hotel properties, restaurants, bars, event venues, Wi-Fi networks, customer service channels, and loyalty programmes.

We comply with all applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the EU GDPR (where applicable to international guests), the Data (Use & Access) Act 2025, and the Privacy and Electronic Communications Regulations (PECR). For any privacy-related enquiries, to exercise your legal rights, or to submit a statutory data complaint, please contact our Data Protection Team:

  • Email: dataprivacy@oceanahotels.co.uk

2. Personal Data We Collect

We collect only the personal data necessary to operate our hospitality business and deliver high-quality services. This includes:

  • Identity & Contact Data: Full name, title, physical address, email address, phone number, and emergency contact details (including next-of-kin details for emergency safety scenarios).
  • Booking & Stay Information: Room preferences, check-in/out dates, booking reference numbers, vehicle registration numbers, next destination, and identity verification documents required under UK immigration laws (including the Immigration (Hotel Records) Order 1972).
  • Financial & Payment Data: Payment card details, billing address, and transaction histories (processed securely via PCI-DSS compliant third-party payment gateways).
  • Technical & Network Data: IP addresses, browser types, device identifiers, non-content Wi-Fi connection logs, and website interaction data.
  • Security & CCTV: Audio/visual footage captured by security cameras operating in public and administrative areas across our properties.
  • Marketing & Communications: Opt-in choices, communication preferences, and feedback/survey responses.
  • Special Category Data: We do not systematically collect biometric or political data. Sensitive health data (such as accessibility requirements or severe medical allergies/dietary needs) is processed strictly with your explicit consent or to protect your vital interests during medical emergencies.

3. Lawful Bases for Processing

We process your personal data under one or more of the following lawful bases:

  • Contractual Necessity: To fulfil bookings, manage reservations, provide venue services, and process payments.
  • Legal Obligation: To comply with statutory duties, including UK tax regulations, accounting standards, hospitality record-keeping mandates, and lawful requests from law enforcement or judicial authorities.
  • Legitimate Interests: To improve operational efficiency, protect against fraud, ensure IT and physical security, manage legal claims, and market related hospitality services, provided your fundamental rights do not override these interests.
  • Explicit Consent: For non-essential cookies, direct electronic marketing (where opt-in is required), and processing special category health/accessibility data.
  • Vital Interests: To protect life, health, or physical safety during medical emergencies on our premises (including emergency disclosures to paramedics, medical teams, or emergency services).

4. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or to satisfy statutory, legal, tax, accounting, or regulatory requirements. Retention criteria include:

  • Guest Registration Records: 12 months from the date of stay for guests aged 16 and over, as mandated by statutory duty under the Immigration (Hotel Records) Order 1972.
  • Financial & Accounting Records: Retained for statutory compliance periods mandated by national tax and accounting regulatory authorities.
  • Wi-Fi Connection Logs: Retained for a limited operational window necessary to safeguard network security, detect technical abuse, and prevent fraud.
  • CCTV Footage: Recorded on a short-term rolling loop and routinely overwritten, unless specific footage is isolated and retained longer for ongoing safety reviews, security incident analysis, or law enforcement requests.
  • Complaint Records: Retained for the operational duration necessary to investigate and resolve the matter, as well as to accommodate statutory legal limitation periods.
  • Marketing Data: Retained until you withdraw consent, object to processing, or following an extended period of engagement inactivity.

We reserve the right to retain records beyond standard operational windows where necessary for compliance with legal mandates, law enforcement orders, or for the establishment, exercise, or defence of legal claims.

5. Your Legal Rights & SAR Procedures

Under UK data protection law, you have specific rights regarding your personal data, including the right to request access, correction, erasure, restriction, or portability, as well as the right to object to processing and withdraw consent.

Subject Access Request (SAR) Procedures

  • Clarification ("Stop the Clock"): Where a request is broad or ambiguous, we reserve the statutory right under the Data (Use & Access) Act 2025 to temporarily pause the standard statutory response deadline while seeking necessary clarification from you.
  • Proportionate Scope: All searches conducted to fulfil data requests will be reasonable and proportionate to prevent abusive or manifestly unfounded demands. To submit a request, email: dataprivacy@oceanahotels.co.uk.

6. Statutory Data Complaints Handling

In accordance with statutory rules under the Data (Use & Access) Act 2025, individuals must submit data protection complaints directly to us using our formal internal complaint procedures prior to regulatory escalation.

How We Handle Complaints

  • Submission: Email full details of your privacy complaint to dataprivacy@oceanahotels.co.uk.
  • Acknowledgement: We will acknowledge receipt of your privacy complaint within statutory timeframes mandated by law.
  • Resolution: We will investigate your complaint thoroughly, keep you informed of progress, and issue a formal written response or outcome without undue delay prior to any secondary regulatory escalation.
  • Regulatory Escalation: If you remain unsatisfied with our final response, you have the statutory right to escalate your complaint to the UK Information Commissioner’s Office (ICO):
    • Website: https://ico.org.uk/make-a-complaint
    • Telephone: 0303 123 1113

7. Cookies & Tracking Technologies

We use functional, analytical, and targeting cookies to optimise website performance, analyse web traffic, and tailor advertising.

Cookie Compliance Controls

  • Equal Choice Banners: Our consent management panel provides equally prominent "Accept All" and "Reject All" options on initial loading.
  • Auditability: User consent preferences are stored using cryptographically verifiable logging mechanisms.
  • Strict Opt-In: Non-essential analytical and advertising cookies remain disabled until explicit consent is given. You may manage or revoke your cookie preferences at any time via the Cookie Control Panel link in our website footer.

8. Marketing Communications

We may contact you with direct marketing, promotional offers, and news about our hotels, restaurants, and venues via:

  • Explicit Consent: Where you actively opt in via our website forms or sign-up sheets.
  • Soft Opt-In: Where we obtained your contact details during a booking, booking inquiry, event quote request, or service negotiation, provided you were given a clear and simple opportunity to opt out at the point of collection and the marketing relates exclusively to similar hospitality products and services offered directly by Oceana Hotels & Restaurants.

Every marketing email or SMS includes an immediate, automated "Unsubscribe" link. We never sell or trade your personal data to third parties for independent marketing purposes.

9. Data Sharing & Third-Party Processors

We share data strictly on a need-to-know basis with approved service providers, vendors, and entities within our corporate group structure operating under centralised management. Categories of recipients include:

  • Property Management Systems (PMS), central reservation engines, and channel managers.
  • PCI-DSS compliant payment gateways and merchant payment processors.
  • IT, Wi-Fi infrastructure, cloud storage, CRM, and cybersecurity providers.
  • Professional advisers, auditors, insurers, and legal representatives.
  • Law Enforcement, Emergency Services & Public Authorities: Statutory regulatory bodies, police or law enforcement agencies, emergency medical teams, and judicial authorities where required by statutory legal duties, court orders, or to protect vital human safety interests.

All external data processors operate under binding Data Processing Agreements (DPAs) restricting them from using your data for independent purposes.

International Data Transfers: Where personal data is transferred outside the UK or European Economic Area (EEA), we ensure adequate legal protections are in place using UK International Data Transfer Agreements (IDTAs), Standard Contractual Clauses (SCCs), legal Adequacy Decisions, or certified frameworks such as the UK Extension to the EU-US Data Privacy Framework.

10. Cybersecurity & Operational Technology (OT) Safeguards

We implement robust technical and organisational security controls to protect your data:

  • Network Segmentation: Operational technology—such as Property Management Systems (PMS), electronic door locks, and HVAC infrastructure—is isolated on separate network segments from guest databases and public Wi-Fi networks to minimise cyber risks.
  • Multi-Channel Verification: To guard against social engineering, business identity fraud, and AI-driven impersonation, our staff enforce strict multi-channel authentication procedures before disclosing sensitive customer records or processing payment alterations.
  • Incident Management: In the event of a security incident involving personal data, we maintain formal response protocols to notify affected individuals and the ICO within required statutory deadlines.

11. Children’s Data

Our services are not directed at unsupervised individuals under statutory age. We do not knowingly collect personal data directly from minors without the consent of a parent or legal guardian.

12. Updates to This Policy

We reserve the right to amend this Privacy Policy to reflect changing legal requirements, operational needs, or technical standards. The revised policy will be posted on our website with an updated revision date.