The Flynn Hotel Group is committed to protecting and respecting your privacy. Please read this Privacy Statement (the “Statement”) carefully to understand our use of your personal information. If you give us information about someone else, please make sure you have their written permission and please make them aware of this Statement as it also applies to their information.

Who processes your information
For the purposes of the applicable data protection legislation, The Imperial Hotel (Cork) Limited T/A The Imperial Hotel, a company limited by shares, incorporated under the laws of Ireland with company number 45339 and registered address Imperial Hotel, South Mall, Cork, T12 A2YT acts as data controller. You will find our contact details in the “Contact us” section below.

Information we process
We process the following categories of data:
• in the case of accommodation services:
- full name;
- address;
- email address;
- phone numbers;
- nationality;
- payment details;
- details of contracts you have entered with third parties for us to provide services to you;
- details of allergies, if provided;
- CCTV footage from common areas of the hotels;
• in the case of spa and leisure services:
- full name;
- email address;
- emergency contact details.

We may also process other information, which is not personal data within the meaning of data protection law.

When you access our website or wi-fi facilities, your device’s browser provides us with information
such as your IP address, browser type, access time and referring URL which is collected and used to
compile statistical data. This information may be used to help us to improve our website and the
services we offer, and to offer services to you.

We also collect and record certain information about you when you browse our website. For more information, please see our Cookies Policy.





Why we process your information
We collect and use the information you disclose to us to assist in providing you with your chosen services.

Without collecting and using your personal information, it would not be possible for us to book you a room, a table or a spa treatment or protect your health in case of food and other allergies or ingredient or product sensitivities.

More specifically, we use the information about you (both personal and sensitive personal data/ special categories of personal data) that we hold for the following purposes:
Performance of a contract:
• for managing and administering your booking;
• to receive payment;
• carry out our obligations arising from any contracts entered into between you and us;
• notify you about changes to our services;

Comply with legal obligations:
• keeping proper books and records;
• audit purposes;
• for the safety and security of our guests;
• to comply with any other legal obligations to which we are subject;

Consent:
• direct marketing;
• perform market research;

Legitimate interests of the controller:
• prevent fraud;
• managing and improving our services;
• teaching and training our staff;
• to provide customer care and service.

From time to time we would like to contact you to:
• invite you to events we are organising;
• provide you with information on products or services which we feel may interest you;
• gauge satisfaction with the service you received from us
If you consent to us contacting you for the above purposes please tick to say how you would like us to contact you: by e-mail, text message, telephone, etc.
Who we share your data with
Flynn Hotels Group
We may disclose your personal information to our group companies for the administration and management of our business and compliance with applicable laws rules and regulations, and internal policies and procedures across the Flynn Hotels Group (including statutory reporting and disclosures to regulatory authorities).




Third party service providers
We may disclose your personal information to third parties who provide a service to us and only process your information as instructed by us. We use third party data processors for services such as the following: information technology services, marketing, database management, event management and hosting services.

Governmental, regulatory, etc.
We may disclose your personal information to a governmental or regulatory body (including tax authorities, law enforcement agencies and financial regulators) in order to comply with a legal obligation or to any person pursuant to an order of a court or tribunal.

Professional Advisors and Experts
We may also disclose your information to our solicitors, auditors, insurance advisors and financial services advisors.

Sellers or buyers of business or assets
We may disclose your information in the event that we sell or buy any business or assets, in which case we may disclose your Data to the prospective seller or buyer of such business or assets.

Data retention periods
It is our aim to only hold your data for as long as this is necessary. We hold our data for the following periods of time:

Type of information Retention period
Information need for tax and audit purposes 7 years
Information needed for performance of contract The duration of the contract plus 2 years
Information need for marketing purposes Until consent is withdrawn.
Information on gym members The duration of the gym membership plus 2 years
Information on spa users The duration of the spa membership plus 2 years 2 years/ 2 years following spa treatment


Security and where we store your personal data
We store your information in different locations. Physical files are stored in locked store rooms on the grounds of the hotel and in secure external storage. Electronic files are stored on our secure servers or in the cloud.

We are committed to protecting the security of your personal data. We use a variety of security technologies and procedures to help protect your personal data from unauthorised access and use.

As effective as modern security practices are, no physical or electronic security system is entirely
secure. The transmission of information via the internet is also not completely secure. We cannot guarantee the complete security of our databases, nor can we guarantee that information you supply will not be intercepted while being transmitted to us over the Internet. We will continue to revise policies and implement additional security features as new technologies become available.

Although we will do our best to protect your personal data, we cannot guarantee the security of
your personal data transmitted to us. Any transmission of data is at your own risk. Once we receive
your personal data, we use appropriate security measures to seek to prevent unauthorised access.

Transfers of your information outside of the European Economic Area
We use cloud solutions for web hosting or proprietary software solutions delivered through the Cloud. Our use of cloud solutions for database hosting delivered to us through the Cloud, does not result in a transfer of your information outside of the European Economic Area.

Links to other sites
Our website may, from time to time, contain links to and from other websites. If you follow a link to
any of those websites, please note that third party websites have their own privacy statements and policies and that the controller does not accept any responsibility or liability for third party website’s use of your data. Please check the respective website’s privacy statements and policies before you submit any data via those websites.

Your rights
As an individual, under EU law you have the right to request that we:
1. provide you with information as to whether we process your data and details relating to our processing, and that we provide you with a copy of your data (‘access right’). Please see Form 1a here;
2. rectify and/ or update any inaccurate data we might have about your without undue delay (‘right to rectification’). Please see Form 2a here;
3. The right to object to processing of data relating to you (‘right to object’). Please see Form 3a here;
4. under certain circumstances, be restricted from processing your data (‘right to restriction’). Please see Form 4a here;
5. under certain circumstances, erase your personal data without undue delay (i.e. the “right to erasure”). Please see Form 5a here; and
6. under certain circumstances, furnish you with the personal data which you provided us with in a structured, commonly used and machine readable format (‘right to data portability’). Please see Form 6a here;

Where we process your data solely on the basis of your consent, you are entitled to withdraw your consent at any time. This will not affect the lawfulness of our processing before the withdrawal.
You also have the right to lodge a complaint with the Data Protection Commission at any time.
The exercise of your rights might be subject to certain conditions and we might require further information from you before we can respond to your request.

You may exercise your rights by contacting our Privacy Officers at the e-mail address provided below.

Changes to this statement
We reserve the right to change this Statement from time to time in our sole discretion. If we make any changes, we will publish those changes on our website. At the bottom of this document you will find the date on which this Statement was last updated.

Contact Us
Requests relating to our processing of your personal information or this Statement should be addressed to the to the postal and email addresses below. We endeavour to deal with all requests promptly and efficiently.

Postal address:
Privacy Officer,
Imperial Hotel,
South Mall,
Cork,
T12 A2YT

Email address: reservations@imperialhotelcork.ie

Last updated: 21/06/2018