Privacy Policy

FOXGLOVE HOTEL GROUP LIMITED
Privacy Policy

Last updated: 23 August 2026   |   Version 1.0
Effective from: 23 August 2026
1. About this policy
Foxglove Hotel Group Limited ("Foxglove", "we", "us" or "our") is committed to protecting your privacy and handling your personal information openly and responsibly. This policy explains what personal information we collect about you, how we use it, who we share it with, how long we keep it, and the rights you have over it.
This policy applies to our website at www.foxglovehotels.co.uk, to our hotels, restaurants, bars and event spaces, to our reservation and loyalty systems, and to any other way you interact with us — for example by telephone, email, social media or in person.
Our website may contain links to third-party websites, plug-ins and applications. Clicking on those links may allow third parties to collect or share data about you. We do not control those websites and are not responsible for their privacy practices. We encourage you to read the privacy policy of every website you visit.
2. Who we are and how to contact us
Foxglove Hotel Group Limited is the data controller responsible for the personal information described in this policy. Our details are:
Company name    Foxglove Hotel Group Limited
Registered in    England and Wales
Company number    17379019
Registered office    11 Castle Hill, Maidenhead, Berkshire, England, SL6 4AA
ICO registration no.    [INSERT ICO REGISTRATION NUMBER]
Website    www.foxglovehotels.co.uk
Privacy contact    info@foxglovehotels.co.uk
Postal address    As above — 11 Castle Hill, Maidenhead, Berkshire, England, SL6 4AA

If you have any question about this policy or about how we use your personal information — including any request to exercise your legal rights — please contact us at info@foxglovehotels.co.uk or write to us at the address above, marking your letter for the attention of the Data Protection Manager.
Note: individual hotels within the group may operate under their own trading names. Unless we tell you otherwise at the point we collect your information, Foxglove Hotel Group Limited is the controller of that information.
3. The personal information we collect
"Personal information" (or "personal data") means any information about an individual from which that person can be identified. It does not include information where the identity has been removed (anonymous data).
3.1 Information you give us
•    Identity data — title, first name, last name, date of birth, nationality, passport or identity document details where we are required by law to record them, and images where you provide them.
•    Contact data — billing address, home or company address, email address and telephone numbers.
•    Booking and stay data — reservation reference, arrival and departure dates, room type and number, rate and package booked, the names of others in your party, vehicle registration for parking, and details of your stay such as room service, spa, minibar and other charges.
•    Payment data — payment card type, the last four digits and expiry date of your card, cardholder name, billing address and transaction details. Full card numbers are handled by our PCI DSS compliant payment providers and are not stored in full on our systems.
•    Preference data — room and bedding preferences, floor or accessibility preferences, newspaper choice, favourite table, and any other preference you tell us about so we can tailor your stay.
•    Restaurant, bar and events data — table reservations, covers, occasion (for example a birthday or anniversary), menu selections, and for weddings, conferences and private events, the details of your event, your guest list where you provide it, and your supplier arrangements.
•    Dietary, health and accessibility data — food allergies and intolerances, dietary requirements, mobility or accessibility needs, and any medical information you choose to share with us so that we can look after you safely. See section 5.
•    Loyalty and membership data — your membership number, tier, points balance, transaction history and redemption history.
•    Marketing and communications data — your marketing preferences, your communication preferences, and your consents and opt-outs.
•    Feedback and correspondence — reviews, survey responses, competition entries, social media interactions with us, complaints, and records of your correspondence and calls with us (calls may be recorded — see section 3.2).
•    Recruitment data — where you apply for a job with us, the information set out in section 9.
3.2 Information we collect automatically
•    Technical data — internet protocol (IP) address, browser type and version, time zone setting and location, operating system and platform, device identifiers, and other technology on the devices you use to access our website.
•    Usage data — information about how you use our website, including pages viewed, search terms, booking funnel steps, click behaviour, and the date and time of your visit.
•    Cookie data — as described in section 7 and in our Cookie Policy.
•    CCTV footage — images captured by CCTV cameras in and around our premises, as described in section 8.
•    Call recordings — we may record calls to and from our reservations and guest services teams for training, quality monitoring and record-keeping purposes. Where we do, we will tell you at the start of the call.
•    Wi-Fi data — where you use our guest Wi-Fi, the device identifier, connection times and the registration details you provide. Use of our Wi-Fi is also subject to the terms presented when you log in.
3.3 Information we receive from others
•    Online travel agents, booking platforms and global distribution systems (for example, booking engines and comparison sites) that pass us your reservation details.
•    Travel agents, tour operators, event organisers, corporate travel bookers and your employer, where they book on your behalf.
•    Payment and fraud prevention providers, which provide us with transaction and authorisation data.
•    Analytics and advertising providers, and social media platforms, where you have permitted them to share data with us.
•    Review platforms and survey providers, where you leave feedback about your stay.
•    Recruitment agencies, job boards, referees and background-screening providers, in connection with a job application.
Where someone else books on your behalf, we rely on them to have told you that your details will be passed to us and to have obtained any consent needed.
4. How and why we use your personal information
Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 we must have a lawful basis for using your personal information. The table below sets out what we use your information for and the lawful basis we rely on. Where we rely on legitimate interests, we have considered whether our interests are outweighed by your rights, and we have set out the interest concerned.
Purpose    Types of data    Lawful basis
Taking and managing your booking, including holding or guaranteeing a reservation and confirming it to you    Identity, contact, booking, payment, preference    Performance of a contract with you; where the booking is made by someone else, our legitimate interest in providing the service requested
Providing your stay, including check-in and check-out, room allocation, housekeeping, room service, spa and other on-site services    Identity, contact, booking, preference, dietary and accessibility    Performance of a contract; legitimate interests (running our hotels efficiently)
Taking payment, managing deposits, cancellations, no-shows, refunds and chargebacks, and recovering money owed to us    Identity, contact, booking, payment    Performance of a contract; legal obligation (accounting and tax records); legitimate interests (recovering debts)
Restaurant and bar reservations, and planning and delivering weddings, conferences and other events    Identity, contact, event, dietary and accessibility    Performance of a contract; legitimate interests (delivering events booked by an organiser)
Catering for allergies, intolerances, medical and accessibility requirements    Dietary, health and accessibility data    Explicit consent, or substantial public interest, or protection of vital interests in an emergency — see section 5
Managing our loyalty scheme, including enrolment, points, tiers, member rates and redemptions    Identity, contact, loyalty, booking    Performance of a contract (the scheme terms); legitimate interests (rewarding and retaining guests)
Sending you marketing about our hotels, restaurants, offers and events by email, SMS or post    Identity, contact, marketing, preference, loyalty    Consent, or our legitimate interests where you are an existing customer and we are marketing similar services (see section 6)
Personalising your experience and our communications, and analysing which offers and content are relevant to you    Identity, preference, usage, loyalty, marketing    Consent (for cookie-based personalisation); legitimate interests (making our service relevant)
Asking for feedback, running guest surveys and responding to reviews    Identity, contact, booking, feedback    Legitimate interests (improving our service and understanding guest satisfaction)
Handling enquiries, requests and complaints, including recording calls for training and quality    Identity, contact, correspondence, call recordings    Performance of a contract; legitimate interests (service quality and keeping accurate records)
Running, securing and improving our website and IT systems, and detecting and preventing fraud, theft and misuse    Technical, usage, booking, payment, CCTV    Legitimate interests (network and information security, protecting our business and our guests); legal obligation
Protecting the safety and security of our guests, colleagues and property, including CCTV monitoring and incident investigation    CCTV, identity, booking, incident records    Legitimate interests (safety and security of people and property); legal obligation (health and safety)
Meeting legal and regulatory obligations, including guest registration requirements, licensing, health and safety, tax and accounting, and responding to lawful requests from authorities    Identity, contact, booking, payment, incident records    Legal obligation; legitimate interests (compliance and defending legal claims)
Managing job applications and recruitment    Recruitment data (see section 9)    Steps at your request prior to entering a contract; legitimate interests (assessing suitability); legal obligation (right to work checks)
Business administration, including corporate reporting, insurance, audits, and any sale, purchase or reorganisation of our business    All categories as relevant    Legitimate interests (running and developing our business); legal obligation

If you do not provide us with information we need to perform a contract with you — for example, your name and payment details — we may not be able to accept or honour your booking. We will tell you if this is the case at the time.
We do not carry out automated decision-making that produces legal or similarly significant effects concerning you. Where we use profiling to tailor offers, we do so on the basis described above and you can object at any time.
5. Health, dietary and other sensitive information
Some of the information you give us is treated as "special category" personal data under the UK GDPR. This includes information about your health, such as food allergies, intolerances, medical conditions, mobility needs and accessibility requirements. We may also become aware of information that reveals your religious or philosophical beliefs — for example, where you request a halal or kosher meal.
We use this information only to look after you properly and safely during your stay or visit. We rely on the following conditions:
•    Your explicit consent, which you give when you tell us about a requirement so that we can act on it. You can withdraw that consent at any time, although we may then be unable to accommodate the requirement.
•    Protection of your vital interests, or those of another person, where you are physically or legally incapable of giving consent — for example, in a medical emergency on our premises.
•    Where the processing is necessary for reasons of substantial public interest, or for the establishment, exercise or defence of legal claims.
We share this information only with those colleagues and suppliers who need it to deliver the service — for example, our kitchen team where you have an allergy — and we keep it for no longer than necessary.
6. Marketing, loyalty and your choices
6.1 When we will contact you with marketing
We will send you marketing by email or SMS only where you have consented to receive it, or where you have previously booked with us or enquired about a booking and we are marketing our own similar services (the "soft opt-in" permitted by the Privacy and Electronic Communications Regulations). In every case, we give you a simple way to opt out both when we collect your details and in every message we send.
We may send you marketing by post on the basis of our legitimate interests, and you can ask us to stop at any time.
We will always obtain your express opt-in consent before we share your personal information with any third party for their own marketing purposes.
6.2 Service messages
Separately from marketing, we will send you messages that are necessary to your booking — confirmations, pre-arrival information, changes to your reservation, invoices and receipts, and important notices about our terms or this policy. You cannot opt out of these while you have a live booking or account with us, because they are part of the service you have asked for.
6.3 Our loyalty scheme
If you join our loyalty scheme, we will use your membership, booking and spending data to operate the scheme, calculate and apply points and benefits, and tell you about member offers. Membership is governed by the scheme terms and conditions, available at www.foxglovehotels.co.uk/loyalty-terms. You can close your membership account at any time by contacting us; we will then retain the underlying transaction records only for as long as set out in section 12.
6.4 How to opt out
You can change your marketing preferences at any time by clicking "unsubscribe" in any marketing email, replying STOP to any marketing SMS, updating your preferences in your account, or contacting us using the details in section 2. Opting out of marketing will not affect personal information we hold for booking, loyalty, payment, safety or legal purposes.
7. Cookies and similar technologies
Our website uses cookies and similar technologies (such as pixels, tags and local storage) to make the site work, to remember your preferences, to measure how the site is used, and — where you allow it — to show you relevant advertising and measure its effectiveness.
Strictly necessary cookies, which are required for the site and the booking engine to function, are set on the basis of our legitimate interests and do not require your consent. All other cookies, including analytics and advertising cookies, are set only where you have given consent through our cookie banner. You can withdraw or change your consent at any time through the cookie settings link on our website.
Full details of the cookies we use, their purpose and their duration are set out in our Cookie Policy at www.foxglovehotels.co.uk/cookie-policy. Most browsers also allow you to block or delete cookies; if you block strictly necessary cookies, parts of our website may not work.
Where we use analytics or advertising tools provided by third parties — for example, website analytics platforms and social media advertising services — those providers may act as our processors or, in some cases, as independent or joint controllers. Our Cookie Policy identifies them and links to their own privacy notices.
8. CCTV
We operate CCTV in and around our premises. Cameras are used to protect the safety and security of our guests, colleagues, visitors and property, to prevent and detect crime, and to help us investigate incidents, accidents and complaints. Signage is displayed in the areas covered.
Our lawful basis is our legitimate interests in maintaining the safety and security of our premises and the people in them, and in some cases a legal obligation (for example, licensing conditions). We do not place cameras in areas where people have a heightened expectation of privacy, such as guest rooms, bathrooms or changing areas.
CCTV footage is normally retained for 30 days and then automatically overwritten, unless it is needed for an ongoing investigation, insurance claim or legal proceedings, or has been lawfully requested by the police or another authority. Access to footage is restricted to authorised personnel. We operate our CCTV in line with the Information Commissioner’s guidance on video surveillance.
You have the right to ask for a copy of CCTV footage of yourself. Please contact us using the details in section 2, giving the date, time and location so we can locate the footage. Where footage shows other people, we will edit it to protect their privacy or, where that is not possible, explain why we cannot release it.
9. Job applicants and recruitment
If you apply for a role with us, whether directly, through our careers page, or through an agency or job board, we will collect and use:
•    Your name, contact details, CV, covering letter, employment and education history, qualifications, skills and references.
•    Information you provide during interviews, assessments and trial shifts, and our notes and scores.
•    Right to work documentation, including passport or immigration documents, which we are legally required to check and copy.
•    Where relevant to the role, results of background, criminal record or financial checks, carried out only where lawful and proportionate and with appropriate safeguards.
•    Equal opportunities monitoring information, where you choose to provide it. This is used only in anonymised, aggregated form for monitoring and is never used in recruitment decisions.
We use this information to assess your suitability for the role, to communicate with you about your application, to verify your right to work in the UK, and to keep records of our recruitment decisions. Our lawful bases are: taking steps at your request prior to entering into a contract; our legitimate interests in recruiting suitable people and keeping proper records; our legal obligations, including immigration and equality law; and, for special category data, the substantial public interest condition for equality of opportunity monitoring, or your explicit consent.
If your application is unsuccessful, we will keep your application information for 12 months so that we can consider you for other suitable roles and defend any claim arising from the recruitment process, unless you ask us to delete it sooner. If you are successful, your information will be transferred to your employment file and used in accordance with our employee privacy notice.
10. Who we share your personal information with
We do not sell your personal information. We share it only where we need to, and only with recipients who are required to keep it secure and to use it for the purposes we specify. These may include:
•    Companies within the Foxglove group, and the individual hotels, restaurants and venues that operate under our brands, for the purposes described in this policy.
•    Service providers who process data on our behalf, including our property management and reservation systems, booking engine, channel manager, customer relationship management platform, email and SMS providers, IT hosting and support providers, and survey and review platforms.
•    Payment providers, acquirers and card schemes, to take payment and to prevent and detect fraud.
•    Online travel agents, booking platforms and travel agents, where your booking was made through them, so that they can manage the reservation.
•    Third parties you ask us to deal with, such as event organisers, corporate travel bookers, wedding planners and suppliers you have engaged for your event.
•    Professional advisers, including lawyers, accountants, auditors and insurers, where necessary.
•    Law enforcement, regulators, courts and other authorities, where we are required or permitted by law to do so — including guest registration information where the law requires it.
•    Prospective buyers, sellers or investors, and their advisers, in connection with any sale, purchase, merger or reorganisation of our business or assets, subject to appropriate confidentiality protections.
Where a third party acts as a processor on our behalf, we have a written contract in place requiring them to keep your information secure, to act only on our instructions, and not to use it for their own purposes.
11. International transfers
We are based in the United Kingdom and we aim to keep your personal information within the UK and the European Economic Area (EEA). Some of our service providers, however, are based outside the UK, or store or access data outside the UK.
Where we transfer personal information outside the UK, we make sure a similar degree of protection is given to it by using at least one of the following safeguards:
•    The country has been assessed by the UK Government as providing an adequate level of protection for personal data (an "adequacy regulation").
•    We use the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, approved by the Information Commissioner, together with any additional safeguards identified by a transfer risk assessment.
•    Another lawful transfer mechanism recognised under the UK GDPR applies.
You can ask us for a copy of the safeguards we use for a particular transfer by contacting us using the details in section 2.
12. How long we keep your personal information
We keep your personal information only for as long as we need it for the purposes set out in this policy, including to satisfy any legal, accounting, regulatory or reporting requirements, and to resolve disputes or defend legal claims. Our normal retention periods are set out below. Where a longer period is required by law, or where information is relevant to an ongoing claim, investigation or complaint, we will keep it for as long as necessary.
Type of information    Normal retention period    Why
Booking and stay records, including guest registration information    7 years from the end of the stay    Tax and accounting requirements; limitation periods for contractual claims; statutory guest registration duties
Payment and transaction records    7 years from the end of the financial year in which the transaction took place    Tax, accounting and audit requirements; chargeback and fraud investigation
Guest profile and preference data    3 years from your last interaction with us    To recognise returning guests and tailor your stay
Loyalty scheme records    For the life of your membership, then 3 years    To operate the scheme and resolve queries about points and benefits
Marketing preferences and consent records    Until you withdraw consent or object, plus 3 years as a record of consent    To honour your choices and evidence our compliance
Suppression list (people who have opted out)    Indefinitely, in minimal form    To make sure we do not contact you again
Dietary, allergy and accessibility information    For the duration of the stay or event, plus 12 months    To deliver the service safely and deal with any incident or complaint
CCTV footage    30 days    Security, crime prevention and incident investigation
Call recordings    6 months    Training, quality monitoring and dispute resolution
Correspondence and complaints    6 years from resolution    Limitation periods for legal claims
Accident, incident and health and safety records    3 years from the date of the incident, or from the date a child involved turns 18; 40 years for records involving hazardous substances    Health and safety law and insurance requirements
Unsuccessful job applications    12 months    To consider you for other roles and defend recruitment claims
Website and cookie data    As set out in our Cookie Policy    Site functionality, analytics and advertising

In some circumstances you can ask us to delete your data — see section 14. We may also anonymise your information so that it can no longer be associated with you, in which case we may use it indefinitely for statistical and research purposes without further notice to you.
13. How we keep your personal information secure
We have put in place appropriate technical and organisational measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. These include access controls and role-based permissions, encryption of data in transit and, where appropriate, at rest, secure hosting, network security controls, staff training and confidentiality obligations, supplier due diligence, and policies covering incident management and business continuity. Card payments are processed by PCI DSS compliant providers.
We limit access to your personal information to those colleagues, agents, contractors and other third parties who have a business need to know it, and they are subject to a duty of confidentiality.
We have procedures to deal with any suspected personal data breach and will notify you and the Information Commissioner’s Office where we are legally required to do so.
14. Your rights
Under data protection law you have the following rights in relation to your personal information:
•    Access — to be told whether we hold personal information about you and to receive a copy of it, together with information about how we use it.
•    Rectification — to have inaccurate personal information corrected and incomplete information completed.
•    Erasure — to ask us to delete your personal information where there is no good reason for us to continue using it. This right is not absolute and may not apply where we must keep information for legal reasons.
•    Restriction — to ask us to suspend the use of your personal information in certain circumstances, for example while we check its accuracy.
•    Objection — to object to our use of your personal information where we rely on legitimate interests, and an absolute right to object at any time to its use for direct marketing.
•    Portability — to receive the personal information you have provided to us in a structured, commonly used, machine-readable format, or to have it transferred to another controller, where we rely on consent or on a contract with you and the processing is automated.
•    Withdrawal of consent — where we rely on your consent, to withdraw it at any time. This does not affect the lawfulness of anything we did before you withdrew it.
•    Rights relating to automated decisions — not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not currently make such decisions.
To exercise any of these rights, please contact us using the details in section 2. You will not have to pay a fee, although we may charge a reasonable fee or refuse to act if a request is manifestly unfounded or excessive. We may need to ask you for information to confirm your identity before we act. We will respond to all legitimate requests within one month, and will tell you if we need longer because your request is complex or you have made several requests.
15. How to complain
If you are unhappy with how we have handled your personal information, please tell us first using the details in section 2 so that we have the chance to put things right.
You also have the right to complain at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection:
Information Commissioner’s Office    Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline    0303 123 1113
Website    ico.org.uk

16. Children
Our website and services are not directed at children, and we do not knowingly collect personal information from children through our website. Where children stay with us or attend an event as part of a booking, we collect only the information we need — such as names, ages where relevant to occupancy, room allocation or age-restricted facilities, and dietary or medical requirements — and we rely on the parent or guardian making the booking to provide it. If you believe we hold information about a child that we should not, please contact us.
17. Changes to this policy
We may update this policy from time to time to reflect changes to our practices or to legal requirements. The date at the top of this policy shows when it was last updated. Where the changes are significant, we will take reasonable steps to bring them to your attention, for example by email or a notice on our website. We encourage you to review this policy periodically.
Previous versions of this policy are available on request.