Privacy notice
Sircle Collection believes in the importance of hospitality and is committed to providing heartfelt service, which includes respecting your privacy and protecting your personal data.
This Privacy Notice, hence, sets out and explains why and how we collect information, how this information is used, and what your rights are regarding your personal data held by us. It includes the privacy practice of our Hotels, Restaurants, Members’ Clubs, and Stores.
Who are we?
Sircle Collection BV is a company registered in the Netherlands under registration number 34369785 with its registered address at Nieuwezijds Voorburgwal 271, 1012 RL Amsterdam (“Sircle Collection” or in the personal pronoun “we” or “our”).
Sircle Collection, together with its subsidiaries and affiliates (collectively the “Sircle Group”), creates and operates hospitality brands, including Hotels, Restaurants, Members’ Clubs, and Stores. Our hospitality brands include:
Hotel Brands
- Sir Hotels
- Max Brown Hotels
- Park Centraal Hotels
- Àterre
(Collectively, the “Hotel Brands” and each hotel that we operate under as one of the Hotel Brands a “Hotel”)
Restaurants
- Seven North
- Bar Claes
- Miznon
- The Rooftop
(Collectively, the “Restaurants”)
Members’ Clubs
- The Cover
- Sircle Club
(Collectively, the “Members’ Clubs”)
Stores
- X-Bank
Our Hotel Brands, Hotels, Restaurants, Members’ Clubs, and Stores operate a number of websites, including:
Hotel Websites
(Collectively, our “Hotel Websites”)
Restaurant Websites
(Collectively, our “Restaurant Websites”)
Club Websites
(Collectively, our “Club Websites”)
Store Websites
(Collectively, our “Store Websites”)
(Our Hotel Websites, Restaurant Websites, Club Websites, and Store Websites collectively, our “Websites”)
The Data Controller
Sircle Collection determines the purposes and means of the processing of personal data for the guests, members, and visitors of the Sircle Group.
As such, Sircle Collection is the ‘Data Controller’ within the meaning of the European Union General Data Protection Regulation (“GDPR”) and the United Kingdom Data Protection Act 2018 for the purposes of this Privacy Notice and for the Sircle Group, including the Hotels, Restaurants, Members’ Clubs, and Stores.
You can contact Sircle Collection’s data protection representative by sending an email to: privacy@sirclecollection.com
What is personal data?
Personal data is information that relates to an identified, or identifiable, person
What does it mean to ‘process’ personal data?
Processing your personal data means that we collect and use your personal data and undertake other actions, including, amongst others, recording, structuring, storage, adaption or alteration, disclosure, erasure, or destruction of your personal data.
Personal data covered under this Privacy Notice
This Privacy Notice covers personal data relating to existing, former, prospective, and potential members and guests of our Hotels, Restaurants, Members’ Clubs, Stores, and persons who visit our Websites, use any of our apps, or visit or interact with any of our social media pages (the “Personal Data”).
What personal data do we process?
We collect information as part of the normal operation and marketing activities for our Hotel Brands, Restaurants, Members’ Clubs, and Stores, as well as to improve our services to you.
Subject to the nature of your booking or reservation and your interaction with our Hotels, Restaurants, Members’ Clubs, Stores, or any member or affiliate of the Sircle Group, we may process the following personal data:
Personal details
Includes information such as:
- Name
- Honorific
- Profile picture
Contact information
Includes information such as:
- Personal address
- Telephone number
- Email address
Hotel bookings
Includes information such as:
- Date and place of birth
- Nationality
- Passport, visa, or other officially-issued identification data
- Signature
- Travel itinerary or activity data
- Dietary or other health requirements that you may disclose
- Any personal preferences or requests that you may make
- Personal details of any companions / family members
- Names and ages of any children accompanying you
- Confirmation of parental responsibility for accompanying children
Restaurant reservations
Includes information such as:
- Dietary or other health requirements that you may choose to disclose
- Any personal preferences or requests that you may make known to us
Billing information
Includes information such as:
- Credit and debit card numbers or other payment data
- Business address
Usage data
Includes information such as:
- Prior stays or visits at the Hotels, Restaurants, Members’ Clubs, Stores, and/or other interactions
Transaction data
Includes information such as:
- Details of payments by and between you and Sircle Group
Profile data
Includes information such as:
- Information you may provide to us through our ‘Your Portfolio’ membership programme
- Any content you generate on, upload to, or make available on our Websites, apps, social media pages, or any other digital channels.
- Language preference
- Previous special services or amenity requests
- Feedback from prior stays at our Hotels or visits to our Restaurants; including customer surveys
Marketing and Communications data
Includes information such as:
- Any consent to receive marketing newsletters and marketing materials from us
- Your communication preferences
Technical data
Includes information such as:
- Data on your visits to our Websites, pages visited, referring URLs, statistical data, and other aggregated traffic data
- Data collected when you visit our Websites or use our Wi-Fi, such as your device’s Media Access Control (MAC) address, internet protocol (“IP”) address, screen resolution, operating system name and version, device manufacturer and model, language, internet browser type and version
- Data generated when you use our apps, such as the date and time the app accesses our servers, location data, mobile device advertising identifiers, and the data and files downloaded to the app
(This information collectively, the “Technical Data”)
Security cameras
Includes information such as:
- Images and video and audio data via security cameras located in public areas, such as hallways and lobbies, in our Hotels, Restaurants, and Stores
Privacy protection data
Includes information such as:
- Consents for the processing of personal data
- Personal data processing preferences
How and where we collect your information
We use different methods to collect data from and about you including through:
- Direct interactions. You may directly provide us with information when you communicate with the staff at our Hotels, Restaurants, or Stores by filling in online forms at our Websites or by corresponding with us by post, phone, email, or otherwise. This includes personal data that you provide to us when you:
- Make a reservation at one of our Hotels or Restaurants, either directly with the respective Hotel or Restaurant or through a third-party booking or travel agent
- check-in at one of our Hotels, whether it is done in person, through our self check-in services, or via online check-in
- Visit or are a guest at one of our Hotels or use on-property services and outlets, restaurants, concierge services, health clubs, and spas
- Visit or are a guest at one of our Restaurants or Stores
- Provide us with any personal preferences, including dietary and other health requirements
- Join or update your personal data in our membership programme, ‘Sircle Club’
- Purchase goods and services from our Websites or apps
- Connect with, or post to, our social media pages
- Sign up to receive any publications or marketing materials or participate in a survey, contest, or promotional offer
- Communicate with our customer service operations or provide us with feedback
- Automated data collection. When you interact with one of our Websites, connect to the Wi-Fi in one of our Hotels, Restaurants, or Stores, or use one of our apps, we may automatically collect Technical Data. We collect these Technical Data by using cookies, server logs, and other similar technologies.
- Strategic Business Partners. We collect information from companies with whom we partner (“Strategic Business Partners”) to provide you with goods, services, or offers based upon your experiences at our Hotels, Restaurants, Stores, and Members’ Clubs, or that we believe will be of interest to you. Examples of Strategic Business Partners include spas, gyms, on-property retail outlets, travel and tour partners, rental car providers, and travel booking platforms. Strategic Business Partners are independent from the Sircle Group.
- Third parties or publicly available sources. We may receive personal data about you from various third parties and public sources, such as:
- Analytics providers
- Advertising networks
- Search information providers
- Data brokers or aggregators
- Contact, financial, and transaction data from providers of technical, payment, and delivery services you use when you make payments on any of the Websites or at any of our Hotels or Restaurants.
- We also use CCTV surveillance in order to prevent our services and facilities from being used for illegal purposes and to protect our employees and customers at our locations.
- Other Sources. We collect personal data from public databases, joint marketing partners, and other third parties.
Why we process your personal data and the legal basis
In line with the GDPR and the United Kingdom Data Protection Act 2018, we require specific legal ‘grounds’ / authorisation to process your data. These grounds form the ‘legal basis’ for processing your information. The legal bases for processing your personal data include:
“Performance of Contract”: where processing your personal data is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract.
“Consent”: where you have given consent to processing your personal data for one or more specific purposes.
“Legitimate Interest”: where we have a legitimate interest to process your personal data subject to your reasonable expectations based on your relationship with us.
“Legal Obligations”: processing your personal data where we are required to comply with or carry out a legal or regulatory obligation.
“Legal claims”: processing your personal data where your information is necessary for us to defend, prosecute or make a claim.
“Vital Interests”: processing your personal data where processing is necessary to your, or another person’s, vital interests.
Booking & Guest registration
-
Business activities
Personal data is required for our business activities, such as:
- Making bookings and reservations for our Hotels and Restaurants
- Pre‑arrival communications (logistics, changes, preferences, extras, etc.)
Processing any pre-payments and security deposits
-
Legal basis
Performance of contract: such as recording details of bookings and reservations, guest communications, and processing payments
Legitimate interest: such as processing information on our guest’s preferences
Legal obligations: such as those relating to financial transactions and the obligation to maintain books and records
Reception
-
Business activities
Personal data is required for our business activities, such as:
- Check-in and check-out
- Processing payments
- Room selection and assignment
-
Legal basis
Performance of contract: such as providing services and processing payments
Consent: such as processing information regarding dietary requirements or health issues that our guest may choose to disclose
Legitimate interests: such as providing tailored services in line with our guest’s preferences
Legal obligations: such as processing personal identification where legally required
Hotel Services
-
Business activities
Personal data is required for our business activities such as:
- Providing consistent and personalised service and advice about the on-site services (based on past usage or expressed preferences)
- Providing concierge, luggage storage, and parking services
- Making arrangements with third-party providers on behalf of guests (such as coordinating offsite activities, arranging taxi, shuttle, and chauffeur services, and facilitating reservations and bookings at restaurants and events)
- Enabling and supporting access to Wi-Fi, TV, and other connectivity services and entertainment systems
- In-room dining (including taking into account any dietary or other health requirements expressed by the guest)
- Housekeeping services (including any personal preferences) and dry-cleaning services
- Handling customer requests, inquiries, and complaints
Determining eligibility for age‑restricted goods and services (such as alcohol or in-room adult entertainment)
-
Legal basis
Performance of contract: such as providing services, Wi-Fi access, and processing payments
Consent: such as processing information and providing tailored services in line with dietary or other health requirements and personal preferences that our guests may choose to disclose
Legitimate interest: such as optimising IT systems and Wi-Fi or disclosing personal data to third-party providers
Legal obligations: such as those relating to financial transactions, including the obligation to maintain books and records, process personal identification or confirm our guest’s age where legally required
Restaurant, Food & Beverage Services
-
Business activities
Personal data is required for our business activities such as:
- Providing for dietary or other health requirements or preferences
- Providing consistent and personalised service and advice about the on-site services based on past usage or expressed preferences
- Providing parking services
- Handling customer requests, inquiries, and complaints
- Enabling and supporting access to Wi-Fi
Determining eligibility for age‑restricted goods and services (such as alcohol)
-
Legal basis
Performance of contract: such as providing services and processing payments
Consent: such as processing information and providing tailored services in line with dietary or other health requirements and personal preferences that our guests may choose to disclose
Legitimate interest: such as optimising IT systems and Wi-Fi
Legal obligations: such as those relating to financial transactions, including the obligation to maintain books and records, process personal identification, or confirm our guest’s age where legally required
Operations & General Business
-
Business activities
Personal data is required for our business activities such as:
- Providing guest services to enable and address inquiries, comments, and complaints about any of our services (such as in person, through phone lines, email, or on social media)
- Security and fraud prevention
- Managing our Websites, apps, and social media pages (including troubleshooting, data analysis, testing, system maintenance, support, reporting, and the hosting of data)
- Monitoring and analysing usage of services and using data analytics to improve services, marketing, programmes, overall customer experience, gathering feedback, carrying out pilot programmes for potential new services, and both developing new and improving existing services
- Facilitating mergers, acquisitions, and other reorganizations and restructurings of our business (including prospective transactions)
- Collecting unpaid debts and claiming for damages or breaches of contract
Using usage data for capacity and staff planning and to comply with permits and regulations
-
Legal basis
Performance of contract: such as providing services and processing payments
Consent: such as implementing marketing programmes and functional, targeting, and performance cookies
Legitimate interest: such as responding to guest complaints and concerns, forecasting and operations planning, improving services, fraud prevention, collecting unpaid debts or damages, and using Technical Data to ensure that our Webpages, apps, and our social media pages function properly
Legal obligations: such as those relating to financial transactions and the obligation to maintain books and records
Websites, Apps & IT Systems
-
Business activities
Personal data is required for our business activities such as:
- Provide access to information about our Hotels and restaurants, online booking, Wi-Fi, personal accounts, and your booking information
- Maintaining the security of our Websites, apps, and IT systems
- Personalising your experience while using our Websites, apps, and IT systems
- Improving design and functionality and displaying content more effectively
-
Legal basis
Performance of contract: such as providing for guest communications, access to Wi-Fi, and personal online accounts
Consent: such as collecting information from functional, targeting, and performance cookies
Legitimate interest: such as processing information necessary to operate our Websites and apps
Legal obligations: such as providing appropriate security for, and the integrity of, your personal data
Emergency & Incident Response
-
Business activities
Personal data is required for our business activities such as:
- Ensuring the security of our on-site services
- Responding to, handling, and documenting on-site accidents and medical and other emergencies
- Actively monitoring properties to ensure adequate incident prevention, response, and documentation (including security cameras)
Requesting assistance from emergency services; and sending notifications and alerts in the event of incidents or emergencies (such as via SMS, email, telephone calls, etc.)
-
Legal basis
Performance of contract: such as ensuring the safety of guests
Legitimate interest: such as monitoring properties through security cameras to ensure the safety of guests and personnel
Legal obligations: such as documenting on-site accidents
Vital interests: such as contacting medical or emergency services for an ill guest
Legal & Compliance
-
Business activities
Personal data is required for our business activities such as:
- Complying with applicable laws and legal processes
- Responding to requests from public and government authorities
- Meeting national security or law enforcement requirements
- Enforcing our terms and conditions and pursuing available legal remedies
- Protecting our operations
Protecting the rights, privacy, safety, or property of the Sircle Group, guests, visitors, and other relevant individuals
-
Legal basis
Legitimate interest: such as enforcing payment obligations, damages, and other claims
Legal obligations: such as providing information to authorities in accordance with our legal obligations, providing the security and integrity of your personal data, and use in connection with judicial proceedings
Vital interests: such as contacting emergency services in case of disturbances and incidents involving guests
Spa & Fitness Services
-
Business activities
Personal data is required for our business activities such as:
- Reservations and bookings
- Determining eligibility for services
- Providing for disability or other health-related restrictions through appropriate and safe activities, services, and treatments
- Providing consistent and personalised service based on past usage or expressed preferences
- Processing payments
- Arranging requested professionals for specific treatments and services
- Handling customer requests, inquiries, and complaints
-
Legal basis
Performance of contract: such as providing services and processing payments
Consent: such as collecting information regarding health requirements when providing our services
Legitimate interest: such as providing personalised services based on past activity
Legal obligations: such as those relating to financial transactions, such as the obligation to maintain books and records
Vital interests: Such as when an individual becomes ill while using the fitness equipment
Store
-
Business activities
Personal data is required for our business activities such as:
- Providing goods and services
- Processing your order and informing you of its progress
- Tracking and delivering your order to you
-
Legal basis
Performance of contract: such as providing goods and services and processing payments
Consent: such as processing information and providing tailored services in line with your preferences
Legitimate interest: such as optimising IT systems and other services
Legal obligations: such as those relating to financial transactions, including the obligation to maintain books and records
Child-Related Services (for Parents & Legal Guardians)
-
Business activities
Personal data is required for our business activities such as:
- Making reservations and bookings for children
- Preparing for and coordinating hotel accommodations and services in accordance with guest preferences, instructions, and expectations
- Payment and billing services;
Applying special rates and ‘child options’ such as special menus for children or special discounts for children under a certain age
-
Legal basis
Performance of contract to a parent or legal guardian: such as applying extra charges or discounts or providing children’s beds
Consent of parent or legal guardian: such as processing a child’s personal information
Legitimate interest: such as communicating special offers, initiatives, or activities for children and parents
Legal obligations: such as processing personal identification to confirm parent or legal guardian or those relating to financial transactions, such as the obligation to maintain books and records
Members’ Clubs & Other Exclusive Programmes
-
Business activities
Personal data is required for our business activities such as:
- Registering users in one of our Members’ Clubs and other exclusive programmes
- Determining eligibility for various programmes and related services
- Administering loyalty and other member programmes
- Providing consistent and personalised service based on past usage and the preferences expressed by members
- Ensuring access to our Websites, apps, and your personal online account
- Processing payments
- Communicating membership activities, events, and new initiatives
- Notifying members about changes to programmes, terms and conditions
Handling members’ requests, inquiries, and complaints
-
Legal basis
Performance of contract: such as application of discount rates benefits and processing payments, and providing access to personal online accounts
Consent: such as sending membership communications, newsletters, and other marketing communications
Legitimate interest: such as providing personalised services based on past activity
Legal obligations: such as those relating to financial transactions, such as the obligation to maintain books and records
Marketing, Promotions, & Contests
-
Business activities
Personal data is required for our business activities such as:
- Sending out newsletters about new developments, initiates, events, or promotions
- Communicating about products and services that may be of interest to guests
- Providing personalised advertisements for products and services on selected websites
- Participation in competitions, sweepstakes, and other promotions
- Utilising cookies to identify which advertisements or offers are most likely to appeal to potential guests and deliver relevant products, content, or advertisements to display on our Website, apps, or external advertising
- Utilising cookies to track responses to online advertisements and marketing actions
Handling customer requests, inquiries, and complaints
-
Legal basis
Performance of a contract: such as processing guest requests
Consent: such as sending newsletters and other marketing communication and collecting information from functional, targeting, and performance cookies
Legitimate interest: such as providing advertisements for similar products and services
Legal obligations: such as handling data protection law queries or complaints or complying with rules relating to competitions
Personal Data Protection
-
Business activities
Personal data is required for our business activities such as:
- Complying with our legal obligation to retain information regarding your consent or personal preferences
-
Legal basis
Legal obligations: such as our obligation to provide confirmation of data privacy consents and other actions
Failure to provide personal data
If certain personal data is required to perform our obligations under contract, or we are obliged by law to process such data, and if you fail to provide that data when requested, we may not be able to perform the agreed services or may be obliged to terminate the contract. Still, we will notify you if this is the case at the time.
If we request your consent to use personal data and you decline to grant us consent, we may not be able to perform the services for which the specific personal data is required.
How and when we share information
We share your personal data with the following parties:
Sircle Group
We disclose personal data to entities within the Sircle Group members and our Hotels, Restaurants, Members’ Clubs, and Stores for the purposes set out in this Privacy Notice, such as processing your reservations, the provision and personalisation of our services, communication with you, facilitating the membership programmes and to accomplish our business purposes.
Service providers
We disclose personal data to third-party service providers to provide services in relation to our business as well as to improve our products and services. For example, companies that provide website hosting, data analysis, payment processing, credit reference agencies, order fulfilment, information technology and related infrastructure provision, upselling technology, customer service, email delivery, marketing, auditing, web analytics providers, cloud services, digital advertising service providers, providers of CRM, marketing and sales software solutions, and other services.
Strategic Business Partners
We disclose personal data and other data with select Strategic Business Partners to provide you with goods, services, and their own marketing.
Legal obligations and reporting
We may need to disclose your personal data to legal and regulatory authorities to comply with a legal obligation and/or judicial or regulatory proceedings, a court order, or other legal process or reporting requirements from public health organisations, local councils, and governmental authorities.
Disclosure necessary to protect our business interests
We may need to disclose your personal data to legal and regulatory authorities, to our accountants, auditors, lawyers, or similar professional advisers, or to other third parties when necessary to enforce our terms and conditions, house rules, or other applicable contract terms, protect our operations, pursue available remedies or limit the damages that we may sustain. We may also disclose personal data to these third parties if it is necessary to take action regarding illegal activities or to protect the safety of any person. This may include (without limit) exchanging information with the police, courts, or law enforcement organisation.
Business transactions
We may need to disclose your personal data to as yet unknown third parties in the event of any reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of all or any portion of the Sircle Group business, assets or stock (including any bankruptcy or similar proceedings).
Security
We take appropriate technical and organisational security measures to protect the personal data that you submit to us against unauthorised or unlawful access or loss, destruction, or damage. We require third parties with whom we share personal data to exercise reasonable efforts to maintain the confidentiality of personal data.
However, the transmission of data can never be completely secure, and we cannot fully guarantee the security of personal data that you provide to us. In the event of a security incident, we will notify regulators and/or you as a data subject as required by applicable laws and regulations.
How long do we store your personal data?
We will keep your personal data only for as long as is reasonably necessary for the purposes outlined in this Privacy Notice or for the duration required by any legal, regulatory, accounting, or reporting requirements, whichever is longer.
Additionally, the information collected by a web analytics tool through our Website is retained for a period of 50 months following your account closure or our last contact with you, as applicable.
When you consent to receive marketing communications, we will keep your data until you unsubscribe.
In some circumstances, we may anonymise your personal data so that it can no longer be associated with you, in which case it is no longer personal data.
Your personal data protection rights
Your personal data protection rights are based on the data protection laws governing the processing of your personal data. If you are a resident of the European Economic Area (“EEA”) or the United Kingdom, the GDPR and the United Kingdom Data Protection Act 2018 grant you the following rights in relation to your personal data:
Right of access
You have the right to request, and receive, confirmation whether or not we are processing your personal data and, if so, have access to your personal data to receive information regarding how your personal data has been processed.
Right to rectification
If your personal data is inaccurate or incomplete, you are entitled to ask that we correct or complete it. If we shared your personal data with others, we will tell them about the correction where possible. If you ask us, and where possible and lawful to do so, we will also tell you with whom we shared your personal data.
Right to erasure
We are obliged to delete or remove your personal data if you request us to do so, where such data is no longer necessary for the purpose for which it was collected, or if you withdraw your consent where such consent was required. We shall not be required to erase the data if there is a legal requirement to retain the information or if the data is required for the establishment, exercise or defence of legal claims. If we shared your data with others, we will tell them about the erasure where possible. If you ask us, and where possible and lawful to do so, we will also tell you with whom we shared your personal data.
Right to restrict processing
You may ask us to restrict or 'block' the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or the lawfulness of the data processing. We will tell you before we lift any restriction on processing. If we shared your personal data with others, we will tell them about the restriction where possible. If you ask us, and where possible and lawful to do so, we will also tell you with whom we shared your personal data.
Right to data portability
In certain circumstances, you have the right to receive your personal data from us in a format that can be transferred to you and to another data controller. This right relates to data processed on the basis of your consent and data required for the performance of a contract with you. You may reuse it elsewhere.
Right to object
You may object at any time and instruct us to stop processing your personal data:
- That is being processed solely on the grounds of our ‘legitimate interest’ (in which case we must demonstrate compelling legitimate grounds to continue processing the data)
- That is being processed for direct marketing
Right to withdraw consent
If we rely on your consent to process your personal data, you have the right to withdraw that consent at any time. This will not affect the lawfulness of processing your data before we received notice that you withdrew your consent.
Right to lodge a complaint with the data protection authority
If you have a concern about our privacy practices, including the way we handled your personal data, you can report it to the Netherlands Data Protection Authority (the ‘Autoriteit Persoonsgegevens’) or, as the case may be, any other competent Data Protection Authority of an EEA member state or the United Kingdom that is authorised to hear those concerns. (You may find the Data Protection Authorities' contact information at https://edpb.europa.eu/about-edpb/board/members_en).
If you wish to exercise any of these rights, please contact us as described in the “Contact” section below. We may also need to ask you for further information to verify your identity before we can respond to any request.
Such requests are usually provided free of charge. However, a reasonable fee may be applied to cover our administrative costs for requests that are manifestly unfounded, excessive, or repetitive.
International Data Transfers
Where we transfer personal data to a recipient based in a jurisdiction outside of the EEA or the United Kingdom, which is not subject to a European Commission adequacy decision (in other words, official approval for us to transfer Personal Data to those recipients), or equivalent, we will where feasible, put in place European Commission-approved standard contractual clauses or equivalent to protect the personal data. We may rely on other transfer mechanisms or legal bases available to us
Changes to our Privacy Notice
Any changes we may make to our Privacy Notice in the future will be posted on this page. Please check back frequently to see any updates or modifications.
Contact
For any questions, comments, or requests regarding this Privacy Notice, you can contact Sircle Collection’s data protection representative by sending an email to: privacy@sirclecollection.com
Last update: 11 April 2024