Privacy & Cookie Policy

To facilitate accommodation reservations, we collect:

• Full name, title, email address, and telephone contact details.
• Billing address and tokenised payment card details (raw payment card numbers are never stored by HotelsMint).
• Booking parameters: hotel name, stay dates, room type, guest count, and special accommodation requests.
• Booking history, cancellation records, and customer support correspondence.
• Loyalty programme status, points balance, and redemption history.

Under the Electronic Money Regulations 2011 and Money Laundering Regulations 2017, we collect additional identity data:

• Identity documentation: Full legal name, date of birth, and nationality (for Know Your Customer validation).
• Government verification: Photo identity documents (passport, national ID card, or driving licence).
• Proof of residence: A recent utility bill or bank statement issued within the preceding 3 months.
• Biometric verification: Selfie uploads or liveness video checks for identity validation (processed strictly with your explicit consent).
• Financial background: Source of funds declarations and supporting financial documents for enhanced due diligence accounts.
• Transaction records: Complete payment history including amounts, dates, merchants, counterparties, reference numbers, and currencies.
• Virtual Card attributes: Card details (masked in account view; CVV displayed temporarily and never stored).
• Connected bank accounts: Linked bank account numbers and routing details for top-ups and withdrawals.
• Anti-fraud telemetry: Device fingerprints, IP addresses, and geolocation data for fraud prevention and Strong Customer Authentication (SCA).

To administer loyalty rewards, we maintain records of:

• Points balance, points earning transaction log, and redemption history.
• Tier qualification status, tier activity data, and anniversary renewal dates.
• Programme preference choices and linked merchant transaction summaries.

For commercial marketplace users, we gather operational attributes:

• Business entity name, company registration number, and VAT registration number.
• Authorised corporate representative name, business title, email, and contact number.
• Business settlement bank details for automated payout processing.
• Platform trading history, invoices, purchase orders, and contract records.
• Know Your Business (KYB) verification data including beneficial ownership structures.

When interacting with our website or app, we automatically record:

• IP address and approximate geographic location derived from network data.
• Browser type, software version, operating system, and hardware device model.
• Session analytics: Pages visited, clickstream sequences, session duration, and referral URLs.
• Authentication logs: Login timestamps, security audit events, and MFA state.
• Cookie identifiers and tracking pixel telemetry (detailed in Part 5).

We process personal data to fulfill our contractual commitments to you:

• Processing hotel reservations, confirmations, modifications, and cancellation requests.
• Opening, operating, and managing your HotelsMint Wallet and payment services.
• Executing payment transfers, P2P transactions, and virtual card operations.
• Administering loyalty points accrual, tier status, and reward redemptions.
• Managing supplier marketplace accounts, orders, and settlement processing.

We process data to satisfy statutory requirements under English and European law:

• KYC identity verification under Money Laundering Regulations 2017 (MLR 2017, Reg. 28).
• Transaction monitoring and suspicious activity reporting under Proceeds of Crime Act 2002 (POCA 2002) and Terrorism Act 2000.
• Financial sanctions screening enforced by OFSI (HM Treasury).
• Safeguarding of e-money customer funds under EMR 2011 and FCA Safeguarding Rules (PS25/12).
• Statutory tax and corporate record retention for HMRC and Companies Act 2006.
• Data breach notifications to the Information Commissioner's Office (ICO) under Art. 33-34 UK GDPR.

We process data for legitimate business interests where balanced against your privacy rights:

• Detecting and preventing fraud, financial crime, and platform security threats.
• Conducting platform performance analytics and service quality optimization.
• Handling legal disputes, enforcement of terms, and legal claims defense.
• Sharing reservation details with hotel partners to ensure seamless stay fulfillment.
• Direct marketing of similar products to existing customers (soft opt-in under UK PECR).

WE DO NOT SELL YOUR PERSONAL DATA TO THIRD PARTIES FOR COMMERCIAL PURPOSES. Personal data is shared only under appropriate legal safeguards with:

• Hotel Partners: Name, contact details, and booking parameters to fulfill your confirmed reservation.
• Financial Services Partner: FCA-authorised partner for e-money issuance, card processing, and safeguarding under DPA agreements.
• Payment Processors & Card Schemes: Secure PCI-DSS compliant payment processing partners.
• KYC Identity Verification Providers: Automated AML identity verification specialists (e.g. Onfido, Sumsub, Jumio).
• Sanctions Screening Providers: AML database providers (e.g. ComplyAdvantage) for ongoing sanctions monitoring.
• Law Enforcement & Regulators: National Crime Agency (NCA) for SAR filings, HMRC for tax compliance, FCA, and court orders.

Essential for baseline platform operation and security. Exemption under UK PECR Reg. 6(4).

We retain personal data strictly as necessary for purpose fulfillment or statutory retention rules:

Under UK and EU GDPR, you hold the following rights:

• Right of Access (Subject Access Request — SAR): Obtain copies of your personal data.
• Right to Rectification: Correct inaccurate or incomplete personal records.
• Right to Erasure ('Right to be Forgotten'): Request data deletion where retention is no longer legally justified.
• Right to Restriction: Restrict processing activities during legal disputes.
• Right to Data Portability: Receive data in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interests or direct marketing.
• Right to Human Intervention: Request human review of automated decisions with significant legal effect.