This is our main summary privacy notice.  For further details please refer to our Privacy Notice on our brand websites and/or our specific privacy notices present at our key points of data collection.  A print copy of this notice or our full privacy notice is available on request.

This is the website address where you can always view the full copy:

https://www.frasersproperty.com/privacy-policy

Malmaison and Hotel du Vin Hotels Group
3^rd Floor, 95 Cromwell Road, London, SW7 4DL

Malmaison is registered as a Data Controller with the Information Commissioner’s Office.  The details of our main central registration can be found below:

Data Controller Name:            MALMAISON HOTEL DU VIN HOLDINGS LIMITED

Registration Number:             ZA031611

Date Registered:                     20 December 2013

Questions or Complaints

Should you have any questions or concerns about our processing of your personal data, please contact our Data Protection Officer:

privacy.emea@frasershospitality.com

Collection and Use

Malmaison collect personal information from you if you register online with us or carry out transactions for goods and services via our website or our hotels or visit our properties.  It may also be sent to us by third party agents or services that you engage with to make your reservation.

In summary, we use the personal information collected for the purposes of:

• providing reservation and booking services for our venues;
• internal analysis, advertising & marketing purposes;
• keeping records and accounts;
• crime prevention and detection (including CCTV at hotel sites);
• maintaining health and safety records;
• maintaining our employee records (employees should refer to our Employee Privacy Policy which is available from our P&D team).

Lawful Basis for Processing

We process this data where:

• it is necessary for the performance of a contract or for entering into a contract – for example, booking a room or other service and our provision of relevant communications about that;
• we have obtained your consent to process – for example, to send you details of our exclusive offers and other marketing and sales communications;
• it is necessary in order to comply with a legal or regulatory obligation – for example, accident reporting, provision of wi-fi services, premises licensing;
• it is necessary for vital interests relating to you or another person – for example, avoiding serious risk or harm to you or others;
• it is necessary for our legitimate interests which include our commercial interests in operating our business in a customer-focussed and efficient manner.

Lawful Basis for Processing Special Category Data

Special Category personal data refers to sensitive personal data such as such as your racial or ethnic origin, religious beliefs or health data.  We process this data where:

• we have obtained your explicit consent: for the particular processing;
• it is necessary to process this data to protect your vital interests or those of another person - for example, in a medical emergency or where an individual is identified as a person at risk by an authority;
• you have manifestly made the data public - for example, where you have published it on social media;
• where it is necessary to deal with legal claims: for example, insurance claims which may lead to court proceedings;
• it is necessary for substantial public interest - for example to prevent or detect unlawful acts or equality of opportunity or treatment;
• as permitted by applicable law - outside the EU and other jurisdictions where these restrictions apply.

Data Sharing

We share the personal data we collect:

• with our sister brand Hotel du Vin for central administration purposes;
• with our parent company Frasers Property in Singapore, for internal audit purposes and some centralised system administration and processing.
• with third party service providers under specific contract terms, whose services we employ as a data processor to conduct our business and in relation to any supply of products and/or services by us.

Data Retention

We only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements.

Data Security

We follow strict security procedures as to how your personal data is stored and used, and who sees it, to help stop any unauthorised person accessing it.

Data Transfer

To manage our legitimate business interests, we will transfer your personal data outside of the EEA in respect of some of our central administration and management and some of our services.  Where this takes place, we will ensure that your data is protected and treated as if it were being processed in the EU.

Your Rights

You have a number of rights in relation to our handling of your data.  These include the following:

• Access
• Correction
• Erasure
• Restriction
• Portability
• Objection