Last updated: 8th October 2026

1. Background and purpose

One Aldwych Limited is in independent luxury hotel offering exceptional and memorable experiences for our hotel, restaurant, and health club guests. We are committed to ensuring they are always in tune with the needs and wishes of today’s discerning guests.

References in this Privacy Notice to data protection laws mean all applicable data protection laws, including the EU General Data Protection Regulation 2016/679 and the UK Data Protection Act 2018, and the UK GDPR as retained in UK law.

For any questions about this Privacy Notice, or to exercise your rights under data protection law, please contact our Data Protection Officer at DPO@onealdwych.com.

This Privacy Notice covers how we collect, use, store and disclose the data that you supply to us, and your rights to access, amend and remove data that we hold about you. We are committed to protecting the privacy and security of your personal information, and we will always treat you and your data with the respect you deserve.

This Privacy Notice covers personal data that we process about you in relation to:

• your stay or travel with us (or enquiries to stay or travel with us), whether made by you or by a third party through whom you have made an enquiry or booking;
• your bookings and visits to our restaurants, bars, health club and meeting facilities, including Indigo, The Lobby Bar and private dining;
• your Health Club membership;
• your interactions on One Aldwych’s website, and any app we operate;
• our dealings with suppliers and with job applicants; and
• our use of closed-circuit television, card-key and other security systems.

2. Data controller

One Aldwych Limited (Companies House number FC020801) is the data controller in respect of your personal data. We are registered with the UK Information Commissioner’s Office with reference number Z3620734.

Our Data Protection Officer is responsible for overseeing questions in relation to this Privacy Notice. Contact details are in section 12.

3. The personal data we collect about you

Personal data means any information about an individual which makes that person identifiable. It does not include data where the identity has been removed (anonymous data). We may process the following personal data about you:

• Identity data: name, nationality, country of residence, marital status, title, date of birth, profession and gender.
• Contact data: address, email address, telephone numbers and preferred contact method.
• Booking data: communications with you, and dates and details relating to your stays, or visits to our restaurants, bars and health club. It may also include booking information for events held at the hotel.
• Stay data: information about your requirements during your stay, including activities you take part in, facilities you use, and other bespoke services you request or use.
• Membership data: details of your Health Club membership, including your joining fee and any ongoing membership fees.
• Profile data: information about your interests and preferences, past stays and feedback.
• CCTV and security data: static and moving images, and in some cases vehicle registration data, from our premises.
• Financial data: bank account and payment card details. Card payments are processed securely by our payment providers; we do not store full card details on our own servers.
• Marketing data: your preferences for receiving marketing from us, and your communication preferences.
• Transaction data: details of payments to and from you.
• Usage and technical data: website and app usage such as date and time, IP address, domain name, browser and operating system, referring URL, pages viewed, device type, approximate location and language preferences.
• Recruitment data: if you apply for a role, the information in your application, CV and interview, together with information from recruitment agencies, referees and, where lawful, background-check providers.

We do not collect data which is, by its nature, particularly sensitive (e.g. genetic data, biometric data, data revealing racial or ethnic origin, political opinions, sex life, sexual orientation, religion or other beliefs, data concerning health, criminal background or trade union membership) (“Special Category Data”) unless it is volunteered by you.

We may use Special Category Data where it is permitted by law or where you have given your explicit consent to us. Such Special Category Data will only be shared with our third-party service providers acting as data processors (e.g. excursion providers, restaurants, transport providers, health and wellness experts) for the purpose of providing the services you request and will not be shared or used by us for any other purposes.

Examples of special category data we may collect and process include:

• food allergies;
• dietary requirements which may imply or suggest religion, health or other sensitive information;
• mobility requirements;
• disabilities; and
• medical conditions, including medical history provided for Health Club treatments or safety.

Our website, any app, and our services are not intended for children under 18. We do not knowingly collect personal data from anyone under 18 except as part of guest registration, with the consent of a parent or guardian. Children staying at the hotel are registered with the booking adult.

Recruitment and job applicants

If you apply for a position with us, we process your personal data to assess your suitability, communicate with you, hold interviews and assessments, take up references, and comply with legal requirements such as right-to-work checks. Where we collect equal-opportunities information, we do so only as require or permitted by law, and we keep it separate from hiring decisions wherever we can.

If your application is unsuccessful, we normally keep recruitment data for up to 12 months after the process ends, unless you ask us to delete it sooner or we need it for longer to defend a legal claim. If you are successful, your data moves to your employee file and is then covered by our internal employee privacy notice.

We may share recruitment data with professional advisers, recruitment agencies and background-screening providers, under confidentiality and data-protection terms.

4. How we collect your personal data?

We use different methods to collect personal data from and about you including through:

Direct interactions:

You may give us your Identity, Contact, Membership and Financial Data by filling in forms or by corresponding with us by post, phone, email, using online forms or in any other way. This includes personal data you provide when you:

• stay or travel with us and make reservations;
• book and visit our restaurants, bars, health club and meeting facilities or attend events at our hotels;
• use our One Aldwych apps;
• visit our website and use our website to make enquiries, subscribe to our marketing materials or make purchases from the online gift shops;
• give us feedback or contact us; or

To ensure that you are provided with exceptional service, telephone calls may be monitored or recorded for quality control and training purposes. We will always let you know in advance if we are going to record your call.

Indirect interactions:

To provide our highly personalized service, we may also add details about you to your guest or membership profile based on our in-person or digital interactions with you. For example, if you inform us of any personal preferences regarding your stay with us.

We may also collect your personal data from other third parties such as:

• booking agents and platforms, such as OpenTable, DesignMyNight and other reservation systems;
• travel agents, tour operators and corporate booking partners;
• payment processors and financial institutions;
• publicly available sources, for supplier and business contacts; and
• other providers involved in fulfilling a request, such as transport or experience partners

Personal data we collect automatically

• When you visit our website, use a digital service, or come to the hotel, we may collect technical and usage data, and CCTV images. We use cookies, pixels, server logs and similar technologies for usage data.
• Cookies are small pieces of data stored by your browser. We use strictly necessary cookies to run the site. We use non-essential cookies (for example analytics or marketing cookies) only with your consent, which you can withdraw at any time. Details of the cookies we use, and how to manage them, are in our separate Cookie Statement.

5. How we use your personal data

We will use your personal data for the purposes listed in the appendix to this Privacy Notice. However, in general terms, these purposes include:

• providing you with a seamless booking experience;
• facilitating your financial transactions;
• making arrangements at our health club, restaurants, and bars;
• personalising your experiences at the hotel;
• stewarding your membership at the health club;
• liaising with you to receive your comments, preferences, and feedback;
• customising and improving our digital services;
• tailoring your communications;
• prioritising your safety and security; and
• offering you with exclusive promotions that align with your preferences.

6. Sharing your personal data

We may also provide limited personal data about you to other third parties to ensure that you have a seamless experience. This could be to hotels, chauffeur services, restaurants, and bars.

We may also share personal data with the following:

• service providers acting as processors, such as IT and system-administration providers, hotel-management and concierge systems, website hosts, email platforms, booking facilitators and payment processors;
• restaurant, theatre and travel booking agents, and experience or transport providers, where you ask us to make an arrangement for you;
• professional advisers acting as processors or independent controllers, including lawyers, bankers, auditors and insurers;
• HM Revenue & Customs, the Information Commissioner’s Office, and other UK regulators or authorities who require reporting;
• law enforcement agencies, where we believe in good faith that the law requires it, or that it is necessary to protect the rights and safety of the hotel, our people or our guests; and
• Third parties to whom we may choose to sell, transfer, form a joint venture with, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this Notice.

Processors act only on our instructions and are bound by confidentiality and data-protection terms. We may also produce anonymous or aggregated statistics, which do not identify you, and share those freely.

International data transfers

One Aldwych may need to transfer your personal data outside of the country from which it was originally provided. This may be to third parties that we work with who may be located outside the UK and EU which have different data protection laws, or laws that are less strict compared with those in the UK and EU. Whenever we transfer personal data outside of the UK and EU, we take legally required steps to make sure that appropriate safeguards are in place to protect your personal data. This may include the use of Standard Contractual Clauses issued following the Commission Implementing Decision (EU) 2021/914 of June 4, 2021, of the European Parliament and of the Council and the UK Addendum issued by the UK Information Commissioner. Please contact us if you would like more information about the safeguards we use.

7. Direct marketing

We may use your personal data to send you direct marketing communications about our hotels, experiences, or our related services. This will be in the form of telephone, email, and post.

Where we are legally required, we will seek your permission before sending you any direct marketing. You have the right to stop receiving direct marketing at any time – you can do this by following the opt-out links in electronic communications (such as emails), or by contacting the Data Protection Officer. Service messages about a booking you have made are not marketing, and we may still send those.

8. Data retention

One Aldwych will only retain your personal data for as long as we feel that we have a relationship with you and will only use it for clear and explicit purposes, this may also include satisfying any legal, accounting or reporting requirements. Typically, where your information is no longer required, we will ensure it is disposed of in a safe manner.

One Aldwych will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of complying with agreements that we have in place with you and for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting, or other requirements. For more information about our retention periods, please contact us.

We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely.

9. Updating personal profile and preferences

You can update or change your preferences for the way you would like us to communicate with you – including how you receive news updates from us, or details of our latest offers by following the unsubscribe instructions in the correspondence we send to you.

10. Changes to this Privacy Notice

One Aldwych may periodically update this Privacy Notice. This may relate to changes in the law, best practice, changes in our services or treatment of your personal data. Where necessary, we will notify you of these changes. We will always display when this Privacy Notice was last amended on the website.

11. Your rights

Under data protection law you have the rights below. To exercise them, contact us at DPO@onealdwych.com. We may need to confirm your identity. We will respond without undue delay, and within one month of receiving the request, unless the law allows a longer period.

Access. You can ask for a copy of the personal data we hold about you, and for information about how we process it.
Correction. You can ask us to correct incomplete or inaccurate data. We may need to check the new information.
Erasure. You can ask us to delete data where there is no good reason to keep processing it, or where you have objected and we have no overriding ground. We may have to refuse where the law requires us to keep it, and we will explain why.
Object. You can object where we rely on legitimate interests, and you can always object to direct marketing. For other objections we may continue if we have compelling legitimate grounds.
Restrict processing. You can ask us to suspend processing while accuracy is checked, where processing is unlawful but you do not want erasure, where you need the data for a legal claim, or while we consider an objection.
Portability. Where processing is based on consent or contract and is carried out by automated means, you can ask for your data in a structured, commonly used format, or ask us to send it to another organisation where technically feasible.
Withdraw consent. Where we rely on consent, you can withdraw it at any time. That does not affect processing carried out before withdrawal.
Automated decisions. You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces a legal or similarly significant effect. We do not make that kind of decision about guests.

12. Contact us

In you have any questions in connection with your personal can contact our Data Protection Officer.

Email

dpo@onealdwych.com

By post

Data Protection Officer
One Aldwych Hotel
1 Aldwych
London
WC2B 4BZ
United Kingdom

13. How to complain

If you have a concern about how we handle personal data, contact us first at DPO@onealdwych.com. We will confirm receipt and our next steps, and we will investigate without undue delay. We will write to you with the outcome and the steps we have taken.

If you remain dissatisfied, you can complain to the Information Commissioner’s Office, the UK regulator, at ico.org.uk/make-a-complaint. If you are outside the UK, you may also contact your local data protection authority.

14. Third party

Our website may link to other sites, including social media platforms and booking partners. Their privacy practices are their own. Information you submit on a social platform is governed by that platform’s notice. We encourage you to read the privacy notice of any site you visit.

Appendix

Purpose	Examples of data used	Legal basis (and legitimate interest where applicable)
Confirm and manage your hotel reservations and stays	Identity, Contact, Booking, Stay, Financial, Transaction, Profile	Contract – necessary to perform our agreement with you.
Provide personalised hotel services (room preferences, concierge, in-room dining, amenities)	Identity, Contact, Stay, Profile, Special Category (for example allergies and mobility)	Contract / Consent (for special category data) / Legitimate interests – to deliver a bespoke, tailored experience.
Fulfil restaurant, bar and event bookings (including The Lobby Bar, Indigo, and private dining)	Identity, Contact, Booking, dietary and stay preferences	Contract – necessary to perform your reservation.
Deliver Health Club services and membership benefits (gym, pool, spa treatments, fitness classes)	Identity, Contact, Membership, Health/Special Category (medical information for treatments and safety), Usage	Contract (membership agreement) / Explicit consent (health data) / Legitimate interests (safety and service delivery).
Process payments, refunds and financial transactions	Financial, Transaction, Identity	Contract / Legal obligation.
Facilitate concierge and external arrangements (theatre tickets, restaurant reservations, transport, excursions)	Identity, Contact, Preferences	Legitimate interests – necessary to provide the seamless service you request.
Respond to your inquiries, requests and feedback	Contact, Booking, Stay, Profile	Legitimate interests – to respond promptly and improve our relationship with you.
Send service-related communications (booking confirmations, pre-arrival details, stay updates)	Contact, Booking, Stay	Legitimate interests – necessary to provide information relevant to your booking and stay.
Send marketing communications about offers, experiences, events and news (email, post, or phone where permitted)	Contact, Profile, Marketing preferences	Consent (where required) or legitimate interests (soft opt-in for existing guests, with an easy opt-out).
Personalise your future experiences based on past stays and preferences	Profile, Stay, Usage, Preferences	Legitimate interests – to analyse preferences and enhance our offerings for you.
Maintain accurate records, manage relationships and improve our services	Identity, Contact, Booking, Stay, Profile, Feedback	Legitimate interests – to keep records up to date, analyse feedback and develop our hospitality services.
Ensure security, health and safety, and prevent fraud or crime (including CCTV)	Identity, CCTV/Security, Booking	Legitimate interests / Legal obligation – to protect guests, staff and premises and create a safe environment.
Respond to emergencies or incidents	Identity, Contact, Stay, Health (if relevant)	Vital interests / Legitimate interests / Legal obligation.
Comply with legal, regulatory and tax obligations (accounting, reporting, anti-money laundering)	Identity, Financial, Booking, Stay	Legal obligation.
Improve our website, digital services and guest experience (analytics and functionality)	Usage, Technical, Device	Legitimate interests – to deliver a better and more personalised digital and in-hotel experience.
Assess job applications and run recruitment	Identity, Contact, employment history, right-to-work and referee data	Steps prior to contract / Legitimate interests – to recruit suitable staff / Legal obligation (right to work).