This policy explains what we do with your personal data when you book a room directly with The Cleveland Hotel.
Who is responsible for your data
The data controller is 39 & 40 Cleveland Square Ltd, registered in England and Wales under company number 06089721, registered office 188 Brent Street, London NW4 1BE.
You can contact us about anything in this policy at reservations@thecleveland-hotel.com or 020 7535 0860.
What we collect
When you make a booking we collect:
- your name, email address, telephone number and country
- your stay details — dates, room type, rate, number of guests and any extras
- any requests or notes you send us
We do not receive or store your full card details. Card payments are handled entirely by our payment provider (Stripe); the card number is entered directly into their secure form and never reaches our systems or the hotel's.
If you consent to analytics cookies, we also collect basic usage data about how you use this website.
We also count how many visits reach each step of the booking process — the homepage, dates, rooms, extras, checkout and confirmation. So that one person looking twice is not counted as two, your IP address and browser type are briefly combined into a scrambled code. That code changes every day, so it cannot be used to recognise you tomorrow or on any other website, and we delete it within days. Your IP address and browser type themselves are never stored, and no cookie is used. We only ever see totals, never an individual visit.
Why we use it, and our lawful basis
- To take, confirm and manage your booking, and to provide your stay — performance of a contract.
- To take payment and prevent fraud — performance of a contract and legitimate interests.
- To meet accounting, tax and legal obligations — legal obligation.
- To measure how the website is used — consent (analytics cookies only, off unless you accept).
- To count how many visits reach each step of the booking process, as totals only — legitimate interests.
We do not use your details for marketing without your consent.
Who we share it with
We share only what is necessary, with:
- Cloudbeds — our property management system, which holds your reservation.
- Stripe — our payment provider, which processes card payments.
- SendGrid — which delivers your booking confirmation and related emails.
- Google Analytics — only if you accept analytics cookies.
Our website and database are hosted on infrastructure in the EU/UK. We do not sell your data.
Cookies
Strictly necessary cookies are always on — the site cannot work without them. Analytics cookies are denied by default and are only set if you accept them in the cookie banner. You can change your choice at any time.
How long we keep it
We keep your booking and payment records for as long as we need them to provide your stay, and then for at least six years after the end of the tax year the stay falls in. UK tax and accounting law requires us to retain transaction records for that period, so we cannot delete them sooner.
Those records are held in our property management system and in our booking platform. Where we are not under a legal obligation to keep something, we will erase it on request — see your rights below.
Your rights
Under UK data protection law you have the right to access your data, have it corrected or erased, restrict or object to how we use it, and to data portability. Where we rely on consent, you can withdraw it at any time.
To exercise any of these, contact us using the details above.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office (ICO) at ico.org.uk.