Last updated: 19 June 2025
1. Who we are
ADHospitalityD Ltd (“we”, “us”, “our”) is a hospitality-focused consultancy and digital content provider registered in England & Wales (company no. 16498224). Our registered office is 34 Spanbourn Avenue, Chippenham, SN15 1LG. We are the “data controller” for the personal data we collect through adhospitalityd.com (the “Site”) and related services.
2. How we collect personal data
| Activity | Categories of data | Source | Typical lawful basis* |
| Website browsing & cookies | IP address, device/OS, pages viewed, interactions | Automated via cookies, log files, pixels | Legitimate interest (site operation, analytics); Consent (non-essential cookies) |
| Enquiry / contact forms | Name, email, phone, organisation, message contents | Direct from you | Legitimate interest (responding to enquiries) |
| Newsletter sign-up | Name, email | Direct from you | Consent |
| Client account or booking | Names, contact details, billing info, booking details, dietary/access requirements | Direct from you; travel/booking partners | Contract (performing a contract) |
| Payments | Cardholder name, partial card details, transaction ID | Payment processor (e.g. Stripe) | Contract; Legal obligation (accounting) |
| Marketing profiling | Marketing preferences, engagement history, soft opt-ins | Combination of above | Legitimate interest; Consent |
| Recruitment | CVs, covering letters, interview notes, right-to-work docs | Direct from you; recruiters | Pre-contract steps; Legal obligation |
*Under the UK GDPR and Data Protection Act 2018.
3. Purposes of processing
We use personal data to:
- Operate, secure and improve our Site.
- Respond to enquiries and provide quotations.
- Deliver consultancy and hospitality services under contract.
- Process payments, refunds and accounting records.
- Send service and marketing communications (with opt-out links).
- Meet legal, regulatory and tax obligations.
- Recruit and onboard staff or contractors.
We do not sell personal data.
4. Sharing your data
We share data only when necessary:
| Recipient | Reason & safeguards |
| Hosting & IT providers (Siteground) | Secure cloud infrastructure (UK/EU data centres where possible) |
| Payment processors (Stripe) | PCI-DSS-compliant payment handling |
| Analytics & email platforms (Google Analytics 4, Mailchimp, HubSpot) | Site metrics and email delivery (EU–US Data Privacy Framework or SCCs) |
| Professional advisers (lawyers, accountants) | Legal or financial compliance under NDA |
| Authorities (HMRC, ICO, courts) | Where legally required |
5. International transfers
Where suppliers are outside the UK/EEA, we rely on:
- Adequacy decisions (e.g. EU–US Data Privacy Framework); or
- ICO-approved Standard Contractual Clauses plus UK Addendum; and
- Additional technical & organisational safeguards (encryption at rest/in transit, zero-trust access, etc.).
6. Data retention
| Data set | Retention period |
| Enquiry emails & CRM notes | 3 years after last contact |
| Client contracts & invoices | 7 years (tax law) |
| Marketing list | Until you unsubscribe or 2 years of inactivity |
| Recruitment unsuccessful applicant data | 6 months after decision |
| Cookie identifiers | See Cookie Notice |
We securely delete or anonymise data after these periods.
7. Your rights
Under the UK GDPR you can:
- Access a copy of your data.
- Rectify inaccurate or incomplete data.
- Erase data (“right to be forgotten”) in certain cases.
- Restrict or object to processing.
- Data portability (receive data in machine-readable format).
- Withdraw consent at any time (marketing emails include an unsubscribe link).
- Complain to the UK Information Commissioner’s Office (ico.org.uk) if you believe we have mishandled your data.
To exercise any rights, contact us as below. We will respond within one month.
8. Security measures
We use industry-standard safeguards, including:
- TLS 1.3 encryption for data in transit.
- AES-256 encryption at rest.
- Least-privilege, role-based access controls.
- Annual penetration tests and vulnerability scans.
- Staff data-protection training and NDAs.
Despite our efforts, no transmission or storage is 100 % secure.
9. Cookies & similar technologies <a id=”cookies”></a>
We use:
| Cookie type | Purpose | Lifespan | Consent needed? |
| Strictly necessary | Site core functions, security | Session | No |
| Analytics (e.g. _ga) | Visitor statistics | 1 yr | Yes |
| Marketing (e.g. Facebook Pixel) | Tailored ads | up to 180 days | Yes |
On your first visit we display a cookie banner asking for consent to non-essential cookies. You can change or withdraw consent at any time in Cookie Settings or via your browser.
10. Children
Our services are not directed to children under 16. We do not knowingly collect their data. Contact us if you believe a child has provided data and we will delete it.
11. Changes to this notice
We may update this notice to reflect changes in law or our practices. New versions will be posted here with a revised “Last updated” date. Where changes are material we will notify registered users or prominent on-site.
12. Contact us
Email: gareth@adhospitalityd.com
Post: Data Protection Lead, ADHospitalityD Ltd, 34 Spanbourn Avenue, Chippenham, SN15 1LG
