Oatlands Park Hotel ("we," "our," or "us") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, process, and protect your personal data when you visit our website, use our digital services, or book a stay or event with us. The registered entity for Oatlands Park Hotel is Oatlands Investments Ltd.

1. Important Information and Who We Are

Oatlands Park Hotel is a luxury estate based in Weybridge, Surrey, United Kingdom. For the purposes of applicable data protection laws, we act as the Data Controller for your personal information.

Our digital infrastructure, website, and advanced technical systems are managed in partnership with Marhala AI Ltd, a contractual Data Processor.

Both Oatlands Park Hotel and Marhala AI Ltd are registered with the Information Commissioner's Office (ICO).

2. The Data We Process & Our Third-Party Partners

We work with selected third-party service providers and processors to manage our operations and deliver our services to you. Data is shared with these partners under strict contractual agreements for the following purposes:

2.1 Hotel Operations & Reservations

We have a few partners who are responsible for processing data in accordance with our Privacy Policy and their appropriate service terms & conditions to provide a contractual service:

Navarino (SynXis GDS Software): We process your personal data through this platform to fulfil our contractual service obligations to you when processing room reservations.

Oracle (Opera System): We use this property and event management system to process your data for contractual service purposes regarding meetings, conferences, and private events.

Michels & Taylor (Hotel Management Company): We share anonymised data with our management partners for analytical purposes to help shape the operational and strategic direction of the hotel.

Payments: We use secure, PCI-DSS compliant third-party payment gateways to process credit/debit card data on face-to-face, telephone and other digital payments. We require a valid credit or debit card at check-in for security and incidentals purposes. Card payments are processed via Chip and PIN only, and we do not manually record or store full card details outside of the approved payment processing systems. We also accept cash payments in accordance with hotel procedures. This uses the lawful basis of performance of a contract.

Check-in: Guests complete a registration card at check-in. This collects information such as email address, telephone number, home address and vehicle registration number. Vehicle registration details are not normally collected during the reservation process and are instead taken at check-in. Proof of ID may be requested in certain circumstances where verification is necessary. Identification may also be requested for age verification and is at the discretion of the staff member. For guests residing outside the UK, passport details are collected at check-in and recorded on the registration card. The registration cards are handled by the Reception team, and the relevant information is entered into the Oracle Opera system. Access to Opera is password protected and activity can be tracked through user history.

CCTV and On-Site Security Surveillance: We operate Closed-Circuit Television (CCTV) cameras throughout the public areas, entry points, and grounds of Oatlands Park Hotel to ensure the safety of our guests, staff, and property. This data is handled securely, retained for a limited period (typically 30 days), and is processed under our legitimate business interests for crime prevention and security. This information is only accessible by the Duty Manager or other specially delegated staff with the Duty Manager's approval.

Dietary and Accessibility: We routinely collect sensitive "Special Category" data, including general health data, such as sensitive dietary allergies and physical accessibility requirements for bedroom allocations and events. This is for the performance of Vital Interests and/or with your explicit consent. This information is only shared with appropriate staff.

Email Communications: Email correspondence is handled by appropriate staff for Performance of a Contractual Service, including for customer service, support and/or complaint purposes. Our email system is appropriately hosted using Microsoft 365 with 2-factor Authentication enabled for security access assurance.

2.2 Website, Marketing & Artificial Intelligence

We work with partners to deliver our digital website and marketing services:

Marhala AI Ltd: We partner with Marhala AI Ltd for our website development, marketing and digital customer service infrastructure. Any processing of personal data within these systems relies strictly on your explicit consent.

Google Analytics: We use Google Analytics to provide anonymised analytical insights into user behaviour on the Oatlands Park Hotel website, helping us optimise our digital/website performance.

2.3 Recruitment & HR

Have you recently applied for a job at Oatlands Park Hotel? This is only shared with:

Oatlands Park Hotel HR department: If you submit an application through our careers portal or vacancy endpoints, your personal data, CV and credentials will be processed solely by our internal HR department and interviewers for recruitment purposes. Our onboarding process is handled by the Oatlands Park HR department. Proof of photographic Government-issued ID, national insurance number and other documents will be required to prove your Right to Work in the United Kingdom.

Data retention: We securely store CV's for a maximum of 6 months. Following the expiry of this data retention period, we permanently shred or delete your CV.

Similarly, for ex-employees we keep personnel files for a maximum of 6 years' following the termination of their employment with the hotel. Personnel files are then shredded or its digital equivalent are permanently deleted.

3. How We Use Artificial Intelligence (AI)

AI technologies are deployed across the Oatlands Park Hotel website and other interactive touchpoints within our digital estate to enhance your user journey.

Explicit Consent Required: We will always require your explicit opt-in consent before you interact with or input data into our AI systems.

Purpose: This data processing is utilized exclusively to provide you with tailored digital services and, where you have separately consented, to deliver consensual targeted marketing.

4. Third-Party Booking Platforms & Social Media

Our website and the wider hotel interacts with external platforms that operate under their own independent privacy frameworks:

Third-Party Booking Channels (e.g. Booking.com): When you book a room through external travel agents or online platforms, separate privacy policies apply to those sites. These platforms share the necessary customer data with us so that we can fulfil our contractual service to provide your bedroom stay or desired hotel service.

Free Hotel Wi-Fi: You appropriately provide your explicit opt-in consent for the hotel's Free Wi-Fi, if you choose to connect to this service, for the performance of a contractual service. Your information is processed by CyberAir for the purposes of providing the hotel's Free Wi-Fi and digital internet security services. Types of data collected include: MAC addresses, email addresses, device types, name, email address and newsletter opt-in consent.

Social Media Pages: When you interact with our official brand profiles on social media, their separate privacy policies apply.

Data residency for these interactions resides in the geographic locations determined by their respective parent companies: Meta (Facebook, Instagram, WhatsApp), LinkedIn, Pinterest, and X (formerly Twitter).

5. Data Storage, Security and Selling Policies

Data Residency: All personal data directly collected and controlled by Oatlands Park Hotel is securely stored and hosted within the United Kingdom.

No Data Selling: We value your trust implicitly. Your personal data is never sold to third parties under any circumstances.

Law enforcement: CCTV footage or booking data may be shared with the Police or other law enforcement agencies in the event of a criminal incident.

Your Legal Rights

Under UK data protection laws, you have specific rights regarding your personal data, including:

The right to access your information;
Correct inaccuracies
Request deletion
Object to processing, and;
Withdraw your consent at any time (particularly regarding AI interactions and marketing).

You may be asked for proof of photographic Government-issued ID when requesting access to your personal data. This is so we can verify your identity and the privacy of customer personal data.

Should this not be possible and there still be a lawful basis for processing your data, you will be appropriately informed.

To exercise any of these rights, or if you have questions regarding this policy, please contact our Data Protection Officer, David Bull, directly at:

[email protected]

01932 847 242

Mr David Bull DPO, Oatlands Park Hotel, Oatlands Drive, Weybridge, Surrey, KT13 9HB