You have certain rights under data protection laws, which we summarise below. If you contact us about these rights, we may ask for proof of your identity before we act on any request, and we may refuse to act if you do not provide this, or your identity is not established by you. This is to ensure that your data is protected and kept secure. More information about your rights and our obligations can be found on the Information Commissioner Office website here.

To exercise any of your rights below, please send your request via email to compliance@rchmail.com.

You may request the following information be provided to you:

Whether we are processing personal data about you
What personal data we are processing, including a request for a copy of your data
What purposes we are processing data for
From which sources we have collected the data
Who we disclose the data to

We will act within one month after receiving a valid request (i.e. when we will have been able to identify you as the data subject). If your request is complex, or if we have a high volume of requests, we may extend this period for two additional months. We will advise you if this is the case.

The law does allow us, in certain cases, to refuse to act upon your request or to charge a reasonable administration fee, if we estimate that the request is manifestly unfounded or excessive. We will advise you at the time if this is the case along with your possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

Rectification

You have the right to have your personal data amended if it is inaccurate or incomplete.

Right to Object

You have the right to object to the use of your personal information for direct marketing or where we use it on the basis that we say we have a legitimate interest in using it.

Right to Request Access

You have the right to request access to the information we hold about you.

Erasure

You have the right to have your personal information deleted or removed in the following circumstances:

The data is no longer necessary for the purpose for which it was originally collected or otherwise processed.
Where you withdraw your consent, where consent was used as the legal basis for processing.
Personal data has been unlawfully processed.
When you object to the processing, and we have no overriding legitimate interest for continuing the processing.
Erasure is required for compliance with a legal requirement; or
Data has been collected in relation to the offering of online services to a child.

When a request for erasure is valid, we will take reasonable steps to inform third parties which are processing the personal data that you have requested us to delete.

We have the right to refuse to act on a request of erasure if the data is necessary for:

Exercising the right of freedom of expression and information.
Compliance with a legal obligation.
The establishment, exercise, or defence of legal claims.

Right to Receive a Copy

You have the right to receive your personal data which you have provided to us, in a structured, commonly used, and machine-readable format and to transmit those data to another controller, when:

the processing is based on consent or on a contract; and
the processing is carried out by automated means

Restrict Processing

You have the right to obtain from us the restriction of processing of your personal data where one of the following applies:

You contest the accuracy of the personal data, for a period enabling us to verify the accuracy of the personal data.
The processing is unlawful, and you oppose the erasure of the personal data and request the restriction of their use instead.
We no longer need the personal data for the purposes of the processing, but the data is necessary for you for the establishment, exercise, or defence of legal claims.
You have objected to processing pending the verification whether our legitimate grounds override yours.

Where the processing of your personal data is restricted, at the exception of storage, we will only process your personal data with your consent, for the establishment, exercise, or defence of legal claims, for the protection of the rights of another individual or organisation, or because we are legally required to do so. We will inform you before the restriction of processing is lifted.

Right to Withdraw Your Consent

You are free to withdraw your consent at any time, where we rely on your consent as a legal basis for processing. Please contact us using the details outlined in Section 16 of this policy. See also section 10.3 for details as to how to object to our direct marketing communications.

Right to Lodge a Complaint with a Supervisory Authority

We adhere to data protection laws regulated by various supervisory authorities worldwide. For specific regions, these include:

Geneva, Switzerland: Office of the Geneva Data Protection Authority (GDPA)

Address: Rue de Lausanne 45, 1202 Geneva, Switzerland
Phone: +44 22 388 9900
Website: GDPA website

Guernsey: Office of the Data Protection Authority (ODPA)

Address: St Martin’s House, Le Bordage, St Peter Port, Guernsey, GY1 1BR
Phone: +44 1481 742074
Website: ODPA website

Ireland: Data Protection Commission (DPC)

Address: 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland
Phone: +353 57 868 4800
Website: DPC website

South Africa: Information Regulator (South Africa)

Address: 33 Hoofd Street, Forum III, 3rd Floor Braampark, Braamfontein, Johannesburg, 2001, South Africa
Phone: +27 10 023 5200
Website: Information Regulator website

United Kingdom: Information Commissioner's Office (ICO)

Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom
Phone: +44 303 123 1113
Website: ICO website

Each supervisory authority has the authority to compel compliance with data protection laws and impose fines for non-compliance. We encourage you to contact us first with any complaints or concerns. You can find our contact details in Section 16 of our privacy notice. If you reside in the European Economic Area and are dissatisfied with our handling of your request or believe we have violated applicable data protection laws, you may also lodge a complaint with the competent supervisory authority in your country or market of residence.

Period for Retaining your Personal Data

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements. If you would like to know more about our data retention policy, please ask us.

Changes to this privacy policy

We keep our privacy notice under regular review to make sure it is up to date and accurate. When we make any change, we will notify you by email of such change. You can check the top of the document to see the latest version in force.

Contacting Us

If you have any questions about our privacy policy or about how we process your personal data, including any complaints, please contact us either by e-mail to compliance@rchmail.com or by post to Red Carnation Hotels Marketing, 14 Grosvenor Place, London, SW1X 7HH.

Our Privacy Policies

Global Privacy Policy

About us

Policy Overview and Commitment

Change of Purpose

Information that we collect

We collect the following categories of personal information for the following purposes

Personal preferences information that we collect

Data and Cookie Policy

Direct Marketing

Disclosure of your personal data to third parties

Location of Your Personal Data

Keeping Your Data Secure

Your Rights