Privacy Policy
Registered company: Vivatar Hotels Limited
Company number: 12178844
Last updated: 14th September 2026
1. Who We Are ?
The data controller responsible for your personal information is Vivatar Hotels Limited (“we”, “us” or “our”), trading as Vivatar Heathrow Hotel. Vivatar Hotels Limited is responsible for determining why and how personal information is processed in connection with our hotel, website and services.
Hotel address: 123 Bulstrode Avenue, Hounslow, TW3 3AE, United Kingdom
Telephone: +44 (0) 20 32 78 9189
Email: management@vivatarhotel.com
ICO registration number: ZB149526
2. What Personal Information We Collect ?
Depending on how you interact with us, we may collect and process:
• Name and contact details, including email address, telephone number and postal address
• Booking and reservation details, including arrival, departure, room and guest information
• Payment and transaction information
• Passport, driving licence or other government-issued identification information
• Copies or scans of identification documents collected at check-in
• Relevant information recorded from identification documents in MEWS
• Room preferences and requests
• Accessibility or other special-request information where you choose to provide it
• Communications, enquiries, complaints and feedback
• Information required to arrange requested services
• Information relating to reviews and post-stay feedback
• Website and technical information such as IP address, browser, device, operating system and pages visited
• Cookie and analytics information, subject to applicable consent requirements
• Records relating to any incident, accident, complaint, damage to hotel property, or insurance claim arising during your stay
3. How We Collect Your Information ?
We may collect personal information directly from you when you make a booking, contact us, check in, stay with us, request a service, provide feedback or use our website. We may also receive information from online travel agencies, booking platforms and other distribution partners when you make a reservation through them.
At check-in, guests may be required to present valid photographic identification. We scan or photocopy the identification, retain the copy for the period of the stay, and enter relevant identification information into MEWS. Retained copies are securely destroyed after checkout, subject to any longer retention that is necessary and lawful for a specific incident, investigation, legal obligation, insurance matter or claim. Destruction is audited by management staff. Where a guest does not provide satisfactory identification where this is required, we may decline to provide accommodation.
4. How We Use Your Personal Information?
We use personal information to:
• Process and manage reservations
• Provide accommodation and hotel services
• Manage check-in and check-out
• Verify guest identity
• Process payments and hotel charges
• Communicate with guests about bookings and stays
• Arrange requested services
• Respond to accessibility needs and other guest requests
• Provide customer service and respond to complaints
• Invite and manage post-stay feedback and reviews
• Operate, secure and improve our website and systems
• Maintain hotel safety and security, including CCTV
• Prevent and detect fraud, misuse and security incidents
• Meet legal, regulatory, accounting, insurance and other lawful obligations
• Establish, exercise or defend legal claims
• Investigate and respond to incidents, accidents, complaints and insurance claims involving guests, staff, visitors or hotel property
5. Our Lawful Bases for Processing
Depending on the circumstances, we rely on one or more lawful bases under UK data protection law:
• Contract — where processing is necessary to enter into or perform a contract with you.
• Legal obligation — where processing is necessary to comply with a legal or regulatory obligation, including our obligations under the Immigration (Hotel Records) Order 1972 to maintain a register of certain guest details.
• Legitimate interests — where processing is necessary for our legitimate interests, provided those interests are not overridden by your rights and interests. This may include hotel operations, security, fraud prevention, service improvement and responding to enquiries. We carry out a legitimate interests assessment, balancing our interests against your rights and interests, before relying on this basis.
• Consent — where we ask for and rely on your consent, including for certain marketing communications or non-essential cookies. Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing carried out before consent was withdrawn.
6. Guest Identification and Check-in Records
For the safety and security of our guests, staff and hotel, guests may be required to present valid photographic identification at check-in, such as a passport, driving licence or other appropriate government-issued identification.
We scan or photocopy the identification document and enter relevant identification information into MEWS where necessary for identity verification, reservation management, hotel security and applicable legal, regulatory or operational requirements. Where required by law, we maintain a register recording specified details (including name, nationality and next destination) of guests who are not British or Irish citizens, in accordance with the Immigration (Hotel Records) Order 1972.
Identification copies are retained for the period of the guest’s stay and securely destroyed after checkout, unless a longer retention period is necessary and lawful in connection with a specific incident, investigation, legal obligation, insurance matter or claim. Destruction is audited by management staff.
Identification information and check-in records are accessible only to authorised personnel who require access for legitimate hotel operations, security, legal or regulatory purposes.
7. Special Category Information
Some information, including certain health or accessibility information, may constitute special category personal data under UK data protection law.
You may choose to tell us about a disability, mobility requirement, medical consideration or other accessibility needs so that we can determine whether our accommodation and facilities are suitable and make appropriate arrangements.
Where special category information is processed, we will ensure that an appropriate condition under applicable data protection law applies in addition to a lawful basis. We will only request or use such information where relevant and necessary. We will typically rely on your explicit consent, or, where relevant to guest health and safety, the substantial public interest condition in Schedule 1 to the Data Protection Act 2018.
8. Booking, Reservation, Distribution and Payment Systems
MEWS is our hotel booking and property-management system. Bookings made through our website and connected booking channels are processed through MEWS. MEWS processes information necessary to manage reservations, guest details, room allocation, check-in and check-out, payments and other hotel operations.
Payments are processed through MEWS and its relevant payment-processing partners. We do not ordinarily have access to your full payment card details.
SiteMinder is an integrated technology provider connected with MEWS. It supports the distribution and management of our room availability and rates across connected booking channels and may process personal information where necessary to provide these services.
We may add or change booking channels, distribution partners, technology providers or integrators as our business develops. Where appropriate, personal information may be processed by such providers where necessary to provide the relevant service, manage reservations, communicate with guests or operate our hotel. We take appropriate contractual and data protection measures with providers processing personal information on our behalf.
9. Who We Share Your Information With?
We do not sell your personal information. We may share personal information where necessary with trusted organisations that help us operate our hotel and provide our services, including:
• MEWS — booking, property management, guest records and payment processing
• SiteMinder and other distribution or integration providers — where necessary to support connected booking channels and distribution
• Online travel agencies and booking platforms — where you make a reservation through them
• Payment-processing partners — where required to process transactions
• Airport transfer, laundry and other service providers — where you request or require the relevant service
• Website, IT, analytics and security providers — where required to operate, maintain or secure our systems
• Professional advisers such as accountants, lawyers and insurers where necessary and lawful
• Authorities, courts, regulators and law enforcement where required or permitted by law
• Prospective purchasers, investors, funders or their advisers, and any successor operator, in connection with an actual or proposed sale, financing, restructuring or other transaction involving our business, the hotel, or its assets
The specific providers we use may change from time to time. Where a new provider processes personal information on our behalf, we will assess the provider and put appropriate data protection arrangements in place before permitting access to personal information.
10. International Transfers
Some service providers or technology partners may process personal information outside the United Kingdom.
Where personal information is transferred outside the UK, we will take appropriate steps to ensure that the transfer is lawful under applicable UK data protection legislation and that appropriate safeguards are in place. This may include UK adequacy regulations, appropriate contractual safeguards or the UK International Data Transfer Agreement (IDTA), the UK-adapted EU Standard Contractual Clauses, or another lawful transfer mechanism recognised under UK data protection law.
11. How Long We Keep Your Information
We keep personal information only for as long as reasonably necessary for the purposes for which it was collected, including to meet legal, accounting, reporting and dispute-resolution requirements.
Identification document copies are retained for the period of the guest’s stay and securely destroyed after checkout, unless a longer retention period is necessary and lawful for a specific incident, investigation, legal obligation, insurance matter or claim. Destruction is audited by management staff.
Other booking, guest, financial, correspondence and operational records are retained in accordance with our internal data retention schedule, having regard to the purpose for which the information was collected and any applicable legal, regulatory, accounting or limitation-period requirements. Where we are required to retain records to establish, exercise or defend legal claims, or in connection with an actual, threatened or anticipated legal, insurance or regulatory matter, we may retain the relevant personal information for as long as reasonably necessary for that purpose, including for the duration of any applicable limitation period.
When personal information is no longer required, we will securely delete it, anonymise it or otherwise dispose of it appropriately.
12. Marketing Communications
We may in future send marketing communications about Vivatar Heathrow Hotel, offers, services or news.
For unsolicited electronic marketing to individuals, we will only send marketing where we have valid consent or where we can lawfully rely on the applicable existing-customer soft opt-in and all of its conditions are met.
Where we rely on consent, consent will be freely given, specific, informed and unambiguous, obtained by a clear affirmative action, and recorded so that we can demonstrate when and how it was obtained. We will retain evidence of consent (including the date, method and wording used to obtain it) for as long as necessary to demonstrate compliance with applicable marketing laws.
Where we rely on the existing-customer soft opt-in, we will only use it where the legal conditions are met, including that the contact details were obtained directly from the individual in connection with a sale or negotiation, the marketing concerns our similar products or services, and a clear opportunity to opt out was provided when the details were collected.
Every marketing email will identify us and provide a simple, free and clear way to unsubscribe. We will maintain suppression/do-not-contact records and act on opt-outs promptly.
Essential communications relating to a booking or stay will continue where necessary.
13. Reviews and Guest Feedback
We may invite guests to provide feedback or reviews about their experience at Vivatar Heathrow Hotel. Reviews may be submitted through or displayed on platforms including Google, Booking.com, TripAdvisor, Facebook and other online travel or review platforms.
We may also send a post-stay feedback or review invitation by email where permitted by applicable law.
Reviews posted on third-party platforms are subject to the relevant platform’s own privacy policy and terms. We are not responsible for how third-party review platforms handle personal information submitted directly to them.
14. Cookies, Wix and Analytics
Our website is hosted and operated using Wix and may use Wix cookies and similar technologies. We also use Google Analytics.
We may introduce other analytics, marketing, performance, security or similar technologies in the future. Where required by law, we will obtain consent before using non-essential cookies or similar technologies.
We will maintain a cookie consent mechanism appropriate to the technologies used on our website and will respect users’ choices.
For more information about the cookies and similar technologies used on our website and how you can manage your preferences, please see our Cookie Policy.
15. Website Links
Our website may contain links to third-party websites, including booking platforms, local businesses, attractions and other services. We are not responsible for the privacy practices, security or content of third-party websites. We encourage you to review the privacy policy of any third-party website before providing personal information.
16. CCTV and Hotel Security
We operate CCTV cameras across public and communal areas of the hotel, including entrances, reception areas, corridors and parking facilities, to help ensure the safety and security of our guests, staff and property.
CCTV footage is retained for 90 days, unless it needs to be retained for longer where reasonably necessary in connection with an incident, investigation, legal obligation, insurance matter or other legitimate purpose.
CCTV is not operated in areas where guests would reasonably expect privacy. Appropriate CCTV signage is displayed throughout relevant areas.
Access to CCTV footage is restricted to hotel management. CCTV footage may be used as evidence in connection with the investigation of incidents, insurance claims, legal proceedings or disputes involving guests, staff or third parties, and may be disclosed to our insurers, legal advisers, or law enforcement authorities where necessary for these purposes.
17. Keeping Your Information Secure
We take reasonable technical and organisational measures designed to protect personal information against unauthorised access, disclosure, loss, misuse, alteration or destruction.
Access to personal information is restricted to people who need it for legitimate business purposes.
No method of transmission or storage can be guaranteed to be completely secure. To the fullest extent permitted by applicable law, we exclude liability for loss or damage arising from unauthorised access to, or disclosure of, personal information that occurs despite our taking the security measures described in this Policy, except to the extent that loss or damage arises from our negligence or wilful default.
Where a personal data breach occurs, we will assess the breach and, where required by applicable law, notify the Information Commissioner’s Office and affected individuals within the applicable statutory timeframes.
18. Your Data Protection Rights
Depending on the circumstances, you may have rights under UK data protection law including:
• Right of access
• Right to rectification
• Right to erasure
• Right to restriction of processing
• Right to data portability
• Right to object, including to certain processing based on legitimate interests
• Rights relating to solely automated decision-making that produces legal or similarly significant effects
These rights are subject to conditions and exemptions under applicable law.
19. How to Exercise Your Rights
To exercise your rights or ask questions about how we handle your personal information, please contact:
Vivatar Heathrow Hotel
Vivatar Hotels Limited
Address : 123 Bulstrode Avenue Hounslow TW3 3AE United Kingdom
Email: management@vivatarhotel.com
Telephone: +44 (0)20 32 78 9189
We may need to verify your identity before responding to certain requests. We will respond within the timeframe required by applicable data protection law. We reserve the right to charge a reasonable administrative fee for, or to refuse to act on, requests that are manifestly unfounded, excessive or repetitive, in accordance with applicable data privacy laws.
20. Data Protection Officer
Vivatar Hotels Limited has not appointed a statutory Data Protection Officer. We have assessed that we are not required to appoint one under applicable data privacy laws, as we are not a public authority and our core activities do not involve large-scale, regular and systematic monitoring of individuals, or large-scale processing of special category data. Data protection enquiries can be made using the contact details provided in this Privacy Policy.
21. Complaints
If you have concerns about how we have handled your personal information, please contact us first so that we have an opportunity to address your concern.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator.
ICO complaints: https://ico.org.uk/make-a-complaint/
Submitting a complaint to us does not affect your right to complain to the ICO at any time, and does not extend or suspend any statutory time limit that may apply to a claim you wish to bring against us.
22. Children’s Privacy
Our hotel welcomes families and children.
Where information about a child is necessary to provide accommodation or services, we will process it only where appropriate and necessary for the relevant purpose. Where a booking or stay involves a child, the accompanying adult guest is responsible for that child and for providing any consents necessary on the child's behalf in connection with our processing of the child's personal information.
We do not knowingly use children’s personal information for marketing purposes without an appropriate lawful basis.
23. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, website, technology, data protection law or how we process personal information.
When we make significant changes, we will update the “Last updated” date at the top of this page and, where appropriate, bring important changes to your attention.
This Privacy Policy is a notice to you and does not form part of, and does not vary the terms of, any contract between you and us for the provision of accommodation or other services.
24. Contact Us
If you have questions about this Privacy Policy or how we handle personal information, please contact us.
Vivatar Heathrow Hotel
Vivatar Hotels Limited
Company number: 12178844
123 Bulstrode Avenue Hounslow TW3 3AE United Kingdom
Email: management@vivatarhotel.com
Telephone: +44 (0)20 32 78 9189
25. Governing Law and Jurisdiction
This Privacy Policy, and any dispute or claim arising out of or in connection with it (including non-contractual disputes or claims), is governed by and construed in accordance with the laws of England and Wales. The courts of England and Wales have exclusive jurisdiction to settle any such dispute or claim.
Further Information
Equality Act 2010 – GOV.UK: https://www.gov.uk/guidance/equality-act-2010-guidance
UK GDPR guidance – Information Commissioner’s Office: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/
Privacy notices – Information Commissioner’s Office: https://ico.org.uk/for-organisations/advice-for-small-organisations/privacy-notices-and-cookies/how-towrite-a-privacy-notice-and-what-goes-in-it/
Cookies and similar technologies – Information Commissioner’s Office: https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/cookies-and-similar-technologies/
Electronic mail marketing – Information Commissioner’s Office: https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guida nce-on-direct-marketing-using-electronic-mail/