Identity and contact details of data controller
Laystall Operating Company Limited (Laystall) respects your privacy and this privacy notice explains how we handle your personal data and your privacy rights. This notice applies to the collection and processing of your personal data if you are in a country that is a member of the European Economic Area (EEA) by or on behalf of Laystall and its related companies (we, us, our, Group). This policy applies to the services provided by Laystall (both online, including via our website at www.thenorthernquarters.co.uk (Website) and offline).
This notice tells you how we collect and process your personal data and the legal basis for processing it, what we use it for and who we share it with. It also explains certain rights you have in relation to the processing of your personal data.
We welcome your feedback. Please contact us if you have any questions or comments about this notice, or you wish to exercise the rights you have under applicable privacy laws, which are explained further below.
Laystall Operating Company Limited
c/o Cycas Hospitality BV
1013 AP, Amsterdam
Laystall Operating Company Limited is the controller of the Website, as well as for services provided through the Website and offline.
Categories of personal data
The categories of data that we collect from you when you visit and use the website and make a booking online or offline and when you check in include your:
- contact details (address, email address, telephone numbers)
- date of birth
- identification documents such as your passport (if you arrive from overseas and are aged over 16)
- payment information, including credit card information
- your employer if you are booking as a corporate guest
- other guests who accompany you
- your vehicle registration
- your loyalty membership number of any participating loyalty program
- services you use while staying at a property including wifi and broadband
- data regarding your employment or prospective employment, such as your employment and education history, qualifications, criminal record or health data.
- personal preferences
Personal data collected from other sources
Sometimes we collect data about you from other sources. We may collect data about you that is publicly available or made available by third parties (for example from social media, Companies House, other online registers and search tools, from our corporate customers, suppliers and service providers).
For instance, we do this where:
- we can’t get hold of you and need to update your contact details
- we need data about individuals from third parties to help us provide our services
- we need to verify data you have provided to us
- a travel agent or someone else makes a booking on your behalf.
We may use or disclose data about you in order to combine data that we hold with data collected from or held by external sources. We do this in order to enable us to provide our services. Where those insights are provided to others, such insights are based on aggregated data and do not contain any data that identifies you. We may also use service providers to undertake the process of creating these consumer insights.
Cookies and links (for Website users)
We use Google Analytics to gather statistics about how our Website content is used. This tracking data allows us to better understand the needs of our site visitors and what content they expect and view. This allows us to make better decisions about our Website and content. We use statistics about our visitors such as the browser type, geographic locations and referring sites.
No personally identifying data is collected
The data collected includes:
- how visitors arrived at our pages (e.g. directly from a bookmark, typing in an address, from a search engine; linked from another page)
- which pages are viewed and for how long, including the viewing time and date
- the general geographical locations of visitors (as indicated by the network or internet service provider they use) and the speed of their internet connections
- technical information about the computers or devices used to browse pages, including the operating systems, browsers, plug-ins, screen types and default languages
- to opt out of analytics, you can download a browser add-on from Google. Alternatively, you can set your browser to refuse or delete cookies from Google Analytics. Check your browser’s help information to find out how.
Our Website may from time to time contain advertisements placed by third party companies or links with other websites. The websites associated with those third-party companies or accessed via these links may contain cookies which may operate differently and collect personal data by different methods. We strongly suggest that you check the privacy policies of these sites.
Laystall does not monitor these sites and is not responsible for their content. If you link to another website you do so at your own risk. Laystall makes no warranties regarding these websites. Laystall is not responsible for any privacy policies or practices of any sites linked to our Website. Laystall is not responsible for the removal of your personal data from any third party to whom your personal data has been provided in accordance with this Privacy Notice.
Purposes of data processing
We may collect and process your personal data for the following purposes and on the following legal bases:
In connection with our legitimate interests in carrying on our business
We may use and process your data for our legitimate interests (where we have considered these are not overridden by your rights and which you have the right to object to as explained below) in:
- identifying opportunities to improve Laystall’s offerings and operations
- conducting research to serve you better by understanding your preferences to ensure we send you appropriate promotions and campaigns
- assisting in arrangements with other organisations in relation to services that Laystall provides to you
- allowing us to operate our business as a franchisor and provider of accommodation, perform administrative and operational tasks (such as training staff, risk management; developing and marketing products and services, undertaking planning, research and statistical analysis; providing customer support; and systems development and testing)
- verifying your identity, preventing or investigating any misconduct, fraud or crime, or any suspected misconduct, fraud or crime.
Where processing is necessary for the performance of a contract
Laystall may need to collect and process your personal data in connection with an agreement with you or to perform our obligations under a contract with you in relation to the services we provide including bookings and to process payments you make.
Under a legal obligation
We may also use and process your personal data if we are authorised or required by applicable laws, regulations or codes that bind us.
With your consent
Where required, we will only use your personal data for the purpose/s for which you have given your valid or explicit consent, which Laystall will obtain before processing your data. Some data you provide may be more sensitive and therefore falls within a special category of personal data, such as health data. Laystall will collect and process this data only with your explicit consent. You can withdraw your consent by contacting us using the contact details above.
For direct marketing
We may communicate with you (through the preferred communication channel(s) you have selected, which may include by email, telephone, SMS, iM, mail, or any other electronic means including via social networking forums) to, amongst other things, tell you about products, services, event and offers that we think may be of interest to you.
If you have provided your consent to receive direct marketing, you can withdraw it at any time without detriment, we will process your request as soon as practicable. If you no longer wish to receive these emails you can contact us using our contact details above or by choosing ‘unsubscribe’ from our electronic communications.
Automated decision making
You have the right not to be subject to a decision made solely by automated processing. Laystall has automated processing (including profiling) but does not use automated decision making solely to make any customer decisions.
Recipients of personal data
We may share your personal data with other organisations consistent with the purposes for which we collect, use and process your data as described above. This includes with the following types of entities:
- our service providers, contractors, agents, other business partners within Laystall and other entities who assist us in providing our services to you (for example, lawyers, conveyancers, financiers, property valuers);
- external providers of services where you have engaged us to act as your agent
- members of the Group as necessary and related parties appropriate for the services that you have requested
- other service providers, who provide the various services that you have requested and we have arranged
- third parties who provide us with marketing services and who conduct market research and analysis on our behalf
- our professional advisers
- an entity including government agency to whom we are required by law to disclose your data
- to third parties as required to provide our services or to meet the purposes for which the personal data was collected
- to third parties you otherwise authorise us to including administrators of participating frequent flier programs.
Sharing outside of the EEA
Laystall primarily stores your personal data in the United Kingdom. Where data is stored outside the United Kingdom, Laystall does so in line with an enforceable contract with the storage provider, or with your express consent.
Laystall may also share your personal data with the Group or entities associated with Laystall, which are located in the UK, EU, Australia, Singapore, New Zealand and Fiji.
Where these countries are not considered by the European Commission to be a country with equivalent privacy protections to the GDPR, Laystall will take steps to protect your personal data transferred from the EEA and transfer it to other third parties in a manner consistent with legal requirements applicable to the data. We will do this by:
- meeting the requirements of an applicable derogation in the GDPR, such as obtaining your consent; or
- asking the recipient of personal data from Laystall to sign a contract based on ‘standard contractual clauses’ approved by the European Commission, requiring them to protect your personal data.
What happens when we no longer need your data?
We’ll only keep your data for as long as we require it for our purposes. When we no longer require your data, we’ll ensure that your data is destroyed or de-identified.
We are required to keep your data for 7 years from the time of your booking or otherwise as required for our business operations or by applicable laws.
We may need to retain certain personal data after we cease providing you with products or services to enforce our terms, for fraud prevention, to identify, issue or resolve legal claims and/or for proper record keeping.
We may also retain a record of any stated objection by you to receiving Group marketing for the purpose of ensuring we can continue to respect your wishes and not contact you further.
Your personal data rights
How to access your data
Subject to applicable laws, you have the right to access your personal data and to receive a copy of that data.
You can ask us to access your personal data that we hold by contacting us on the details above. You can also ask that personal data provided by you to us is transmitted to another party.
We may need to verify your identity to respond to your request. We will respond to any request within a reasonable period permitted under applicable data protection laws and will generally give access unless an exemption applies to certain data.
We will give you access to your data in the form you want it where it’s reasonable and practical (for example we can give you a disk recording of a phone call you had with us). We may charge you a small fee under certain circumstances to cover our costs when giving you access but we’ll always confirm this with you first.
If we decide not to or we can’t give you access, we will tell you why in writing and how you can make a complaint about our decision.
If you have concerns, you can complain using our contact details above.
How to correct your personal data
You have the right to correct (rectify) your personal data and can contact us if you think there is something wrong with the data we hold about you.
If you are worried that we have given incorrect data to others, we will tell them about the correction. If we can’t, then we’ll let you know in writing.
Your right to erasure of your data
You also have, in certain circumstances, the right to request that the personal data that Laystall collects from you is erased. If we refuse any request you make in relation to this right, we will tell you why in writing and how you can make a complaint about our decision.
Your right to object to or restrict processing of your data
You may also request that further processing of your personal data is restricted in certain circumstances, including while we investigate your concerns with this data.
Right to object to data processing and right to data portability
You also have in certain circumstances the right to request that the further processing of your data is restricted or to object to its processing and the right to data portability (to receive and have transferred the data you provided). If we refuse any request you make in relation to this right, we will write to you to explain why and how you can make a complaint about our decision.
Right to withdraw consent
You can let us know at any time if you no longer wish to receive direct marketing offers from the Group. We will process your request as soon as practicable. Where you have subscribed to something specific (like to hear from one of our sponsored organisations) then these subscriptions will be managed separately.
You may also withdraw your consent where provided or object to the further processing of your personal data under certain circumstances. If we refuse any request you make in relation to this right, we will write to you to explain why and how you can make a complaint about our decision.
The withdrawal of your consent will not affect the processing of your data that you had consented to.
How do you make a complaint?
If you have a complaint about how we handle your personal data, we want to hear from you. You are always welcome to contact us. We are committed to resolving your complaint and doing the right thing by our customers. We aim to resolve complaints as quickly as we can, and you should hear from us within a reasonable time.
If you still feel your issue or request hasn’t been resolved to your satisfaction, then you can escalate your privacy concern and you have the right to make a complaint to the relevant data protection authority (for example in the place you reside or where you believe we breached your rights).
Contact details for escalating complaints
If you have a complaint about how we handle your personal data, we want to hear from you. Please contact us using the contact details above.
You have the right to make a complaint to the relevant data protection authority (for example in the place you reside or where you believe we breached your rights).
The UK data protection authority’s details are:
Office of the UK Information Commissioner
Phone: 0303 123 1113
Live chat: https://ico.org.uk/global/contact-us/live-chat
Changes and updates to this Notice
Laystall will review and may update this Privacy Notice from time to time in whole or part to reflect its practices, business arrangements and legal obligations. The updated notice will be available on our Website and any changes will apply when the updated version is posted on our Website (or when the changes are otherwise notified to you, if earlier). By continuing to use or access our Website, products or services after the posting or notification of an updated version of this Privacy Notice, you agree that the updated version will apply. You may also obtain a copy of our latest Privacy Notice by contacting us at the contact details set out above. You should review this Privacy Notice periodically to ensure that you are updated on any changes.
Last updated: March 2019