YOTEL PRIVACY AND DATA PROTECTION STATEMENT

Who are we?

This Privacy and Data Protection Statement is issued by Yotel Limited (trading as YOTEL) and the YOTEL group of companies (collectively referred to as "YOTEL”, "we”, "us” or "our” in this Privacy and Data Protection Statement), which includes our affiliates and covers information that we collect and use in the course of our business. When we mention "YOTEL", "we", "us", or "our", we are referring to the relevant company in the YOTEL group that processes your personal information. Your information may also be collected and used by our YOTEL branded hotels and the additional facilities provided therein. In most cases these hotels and additional facilities are independently owned and their use of your information may also be covered by their own privacy notices

YOTEL is a global hospitality company and we predominantly manage hotels as well as certain additional facilities provided at our hotels,  on behalf of third party owners. We do also franchise, lease and enter into alternative operating structures for our hotels. We enter into hotel management agreement, leases and franchise agreements with these owning parties. If you make a reservation through us to stay at a YOTEL, we will share your information with that hotel which as stated above with often have a separate privacy notice and policy. Some of our hotels are outside of the European Economic Area and may be subject to local privacy laws.

Our approach to privacy

This website is owned and run by Yotel Limited (trading as) YOTEL. Our HQ is situated at 90 High Holborn, London, WC1V6LJ and this is how you can contact us. YOTEL is committed to protecting your privacy in accordance with its obligations under the Data Protection Act 1998,the General Data Protection Regulation (GDPR EU) and the California Consumer Privacy Act (CCPA)

YOTEL is also committed to protecting your privacy in accordance with other laws as may be applicable in the territories in which we operate:

•  Consumer Data Privacy Act (Colorado)
•  Dubai International Financial Centre Data Protection Law No. 5 (Dubai)
•  Florida 29 Information Protection Act (Florida)
•  Standards for the Protection of Personal Information of Residents of the Commonwealth (Massachusetts)
•  Stop Hacks and Improve Electronic Data Security Act (New York)
•  Swiss Federal Data Protection Act (Switzerland)
•  Personal Data Protection Act (Singapore)
•  Law on the Protection of Personal Data (Turkey)
•  D.C. Act 23-268 (Washington D.C.)

This privacy and data protection statement explains the type of data we collect, the purposes for collecting your data, how your data is used, the types of data linked to that purpose and our legal basis for collecting it. The policy also provides information on your rights in relation to your data, our use of cookies and IP addresses, data collected from and shared with third parties (including our third party hotel owners), the length of time we keep your data for and data transfers to countries outside of the UK. For California residents we have provided information on our collection of data as the CCPA applies to it. When you access and use this website, you agree to be legally bound by our terms and conditions [https://www.yotel.com/en/terms]. as well as our privacy and data protection statement outlined below. You agree that you will provide accurate information about yourself or any person on whose behalf you are engaging with Yotel.

What data do we collect?

‍•  Identity data: your name, address, postcode email address, telephone number, country
•  Payment data: credit card details, information on bookings
•  Geolocation and connection data: from devices and from servers such as your IP address through wifi
•  Preferences: data relating to what you book and purchase during your stay

Purpose, type of data collected and bases for processing

You are in control of what information we collect about you. However, if you choose not to share your information, some areas of the website or the App may not be accessible or usable. If any of the information you have provided changes or appears to be incorrect, you can let us know by emailing hq.dataprivacy@yotel.com or by logging into your My YOTEL account on our website and updating your details.

Your rights

Your rights in relation to your data include:
•  Access: you have the right to access a copy of your personal data held by YOTEL.
•  Rectification: you have a right to have your personal data rectified if this is inaccurate or completed if it is incomplete.
•  Erasure: in certain circumstances you have a right to have your personal data erased. This is also known as ‘the right to be forgotten’.
•  Limitation of processing: in certain circumstances you have the right to restriction or suppression of your personal data. When processing is restricted, Yotel may store your personal data, but not use it.
•  Data portability: you have the right to request a copy of your data in a commonly used and machine readable format.
•  Object to processing: you have the right to object to the processing of your personal data in certain circumstances.

Additionally, you have the right to withdraw consent for the processing of your personal data at any time.

We will not send you any promotional messaging if you have indicated you do not wish to receive this information; during the booking process, the registration sign up process or in your My YOTEL account. However, for every transaction you make with us (whether booking or cancelling), we will confirm via email even if you are unsubscribed.

Whenever we ask you for information about yourself you may, by ticking the relevant box, opt out of receiving marketing communications from us. In addition, whenever you are contacted by email you will be told how to opt out of being updated by email in the future. You can also amend your marketing preferences in your MY YOTEL account on our website. To exercise your rights, please complete our Data  Request  form [link to Data Request form]. We will action your request within 30 days.

If you would like further information on your rights and information on how to make a complaint, please contact your Data Protection Authority. In the UK, this is the Information Commissioner’s Office (ICO): https://ico.org.uk/

For a list of Data Protection Authorities in the EU, please visit: https://edpb.europa.eu/about-edpb/board/members_en

For California residents, please contact the Office of the Attorney General here: https://oag.ca.gov/contact/consumer-complaint-against-business-or-company

Cookies and IP addresses

‍We and our appointed agencies collect anonymous information about your use of the website from cookies and using pixel tags. Cookies are small files of letters and numbers that we put on your device’s hard drive and pixel tags are used to read the cookies. They allow us to distinguish you from other users of our website, monitor website traffic and personalise website content just for you. This ultimately helps us provide you with a good experience when you browse our website and allows us to improve our site going forward.

We use two types of cookies:
‍
•  First party cookies are set by Yotel as publisher of the website. These cookies enable site functionality and a consistent user experience.
•  Third party cookies are served by another website. An example of this is the use of cookies that enable us to track traffic and usage information such as referrals to our website. We may also serve up content from other websites such as social media platforms. These platforms have their own terms and conditions and cookie policies that you will need to accept in order to view the content.  

Most browsers automatically accept cookies, but you can delete existing cookies from your browser and, by editing your browser options, choose not to receive cookies in future. Our website requires first party cookies to function correctly. If you’re not happy with the use of first party cookies, you’re at liberty to leave our site. If you continue to use our site, then we deem you to have opted-in to use cookies. We also use third party data from Google and other search engines:

•  Usage information: we collect usage information about you whenever you interact with our website and services. This includes which web pages you visit on the Yotel website, what you click on, when you perform those actions, what language preference you have, and so on.
•  Device and browser data: we collect information from the device and application you use to access our services. Device data mainly means your IP address, operating system version, device type, system and performance information, and browser type.Information from page tags: we use third party tracking services that employ cookies and page tags to collect data about visitors to our website. This data includes usage and user statistics
•  Log data: like most websites today, our web servers keep log files that record data each time a device accesses those servers. The log files contain data about the nature of each access, including originating IP addresses, internet service providers, the files viewed on our site, operating system versions, device type and timestamps.
•  Referral information: if you arrive at our website from an external source (such as a link on another website or in an email), we record information about the source that referred you to us. The site will still function correctly if you opt to exclude third party cookies, however when you make an online booking, the booking process requires cookies to work. These are temporary cookies which are automatically deleted once a transaction is made.

Children

Our websites are not intended for children and we do not intentionally solicit or collect personal information from individuals under the age of 18. If we are notified or otherwise discover that a minor’s personal information has been improperly collected, we will take all commercially reasonable steps to delete that information.

Third parties

Data may be received from third parties such as Online Travel Agents (OTAs) and other travel agents as well as other third party suppliers, booking agents, or parties making bookings on your behalf. It may also be received from the hotel properties.

Data is disclosed to hotel properties to fulfil bookings both for hotels stays and for other additional facilities available at the hotels, to 3rd party service providers to fulfil services, to social media platforms for targeted advertising with the consent of the individual, to the AF/KLM Flying Blue and Virgin Atlantic Flying Club for the purposes of earning air miles and to other entities as required by law.

We do not give or sell your data to third parties for marketing purposes. This includes email addresses and telephone numbers collected via our website, our App and our Mission Control kiosks.

How long is data kept for?

Your data will be processed:

•  For the period in which you remain a registered user through a MyYotel account
•  As necessary to execute bookings and the administration that surround these
•  As necessary to fulfil in-stay purchases and access to services such as wifi
•  Until you unsubscribe from marketing emails and other contact
•  As long as reasonably required to answer your customer service queries or support requests
•  For the period until you unsubscribe from marketing communications, change permissions via your    MyYotel account, change permissions via the settings on your device or browser for targeted advertising or    contact us to change your preferences. For specific promotions and competitions, a period of 6 months    after the conclusion of the activity
•  As necessary to fulfil any request you have in relation to your data
•  As necessary to perform the insight or action such as a customer service survey
•  As necessary to detect and mitigate against fraud or fraudulent use of the website•  For a period of 6    months after the closing date of the job opportunity
•  As necessary as required by law or regulation

Data transfers

Your data may be transferred outside of the European Economic Area (EEA) in some circumstances, for example where this is necessary to fulfil bookings you have made or services you have requested. This may also occur where our service provider has operations outside of the UK such as data centres or IT support.

We take the following steps to safeguard your information if it is transferred outside of the EEA:

•  Where possible, we agree standard contractual clauses approved by the EU Commission in the contracts    with our suppliers and third party service providers
•  Due diligence on our suppliers and third party service providers to understand the controls they put in    place to protect the information they process for us

California Consumer Protection Act
‍
•  a list of the categories (by reference to the CCPA category) of Personal Information the Business has    collected about Consumers in the preceding 12 months and who it is collected from
•  two separate lists of categories (by reference to the CCPA category) of information the Business has (i) sold    or (ii) disclosed for a business purpose, each within the preceding 12 months or, if the Business has not    done so, disclosing that fact:

Categories of personal information:

•  Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet   Protocol address, email address, account name, social security number, driver’s license number, passport   number or other similar identifiers.
•  Signature, physical characteristics or description, telephone number, state identification card number, insurance policy number, employment, employ­ment history, bank account number, credit card number, debit card number or any other financial information, medical information or health insurance information.
•  Characteristics of protected classifications under California or federal law.
•  Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
•  Biometric information.•  Internet or other electronic network activity information, including, but not limited to, browsing history, search history and information regarding a consumer’s interaction with an internet website, app or advertisement.
•  Geolocation data.
•  Audio, electronic, visual, thermal, olfactory or similar information.•  Professional or employment-related information.
•  Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act.
•  Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, predispositions, behaviour, attitudes, intelligence, abilities and aptitudes. ]

California residents have the following rights under the CCPA:

1. Right to know
You may request that YOTEL discloses to you what personal information has been collected, used, shared, or sold about you, and why it has been collected, used, shared, or sold. Specifically, you may request:

•  The categories of personal information collected
•  Specific pieces of personal information collected
•  The categories of sources from which the business collected personal information
•  The purposes for which the business uses the personal information
•  The categories of third parties with whom the business shares the personal information
•  The categories of information that the business sells or discloses to third parties  

2. Right to deleteYou may request that YOTEL delete personal information collected from you and to tell our service providers to do the same (subject to specified exceptions). These exceptions include:
•  YOTEL cannot verify your request
•  The information is necessary to complete your transaction, or provide a reasonably anticipated product or service
•  For certain business security practices
•  For certain internal uses that are compatible with reasonable consumer expectations or the context in which the information was provided
•  To comply with legal obligations, exercise legal claims or rights, or defend legal claims

3. Right to opt-out
You may request that YOTEL stop selling your personal information. With some exceptions, Yotel cannot sell your personal information after we receive your opt-out request unless you later provide authorisation allowing us to do so again. We must wait least 12 months before asking you to opt back in to the sale of your personal information.

4. Right to non-discrimination
You have the right to non-discrimination under the CCPA. This means that YOTEL cannot deny goods or services, charge you a different price, or provide a different level or quality of goods or services just because you exercised your rights under the CCPA.

However, if you refuse to provide your personal information or ask us to delete or stop selling your personal information, and that personal information or sale is necessary for us to provide you with goods or services, then we may not be able to complete that transaction.

Categories of personal information collected in the last 12 months and who it is collected from:
‍
•  Identifiers such as a real name, Internet Protocol address, email address, unique personal identifier, online identifier.
•  Signature, bank account number, credit card number, debit card number.
•  Internet or other electronic network activity information, including, but not limited to, browsing history, search history and information regarding a consumer’s interaction with an internet website, app or advertisement.
•  Geolocation data.

Data is collected directly from you (including your devices based on your settings, from third parties such as Online Travel Agents (OTAs) and other travel agents or parties making bookings on your behalf. It may also be received from the hotel properties.

Characteristics of protected classifications under California or federal law such as race, sex, age, religion, national origin, disability, citizenship information, or genetic information are not actively collected although may be acquired through the use of security monitoring such as CCTV at the hotel property or at Yotel HQ. We keep and use recordings only as strictly necessary to fulfil security purposes such as keeping our guests and staff safe in hotels or at our corporate offices.

Information sold in the last 12 months

YOTEL has not sold any categories of personal information as specified by the CCPA in the last 12 months.

Information disclosed in the last 12 months for a business purpose

•  Identifiers such as a real name, Internet Protocol address, email address, unique personal identifier, online identifier.
•  Signature, bank account number, credit card number, debit card number.
•  Internet or other electronic network activity information, including, but not limited to, browsing history, search history and information regarding a consumer’s interaction with an internet website, app or advertisement.

Data is disclosed to hotel properties to fulfil bookings, to 3rd party service providers to fulfil services, to the AF/KLM Flying Blue and Virgin Points for the purposes of earning air miles and to other entities as required by law.

Exercising your rights

To exercise your right to know and right to delete, please contact us at: hq.dataprivacy@yotel.com. You may exercise your right to know up to twice in a 12 month period at no charge.

We have 45 days to respond to your request.