HotHotels

Privacy policy

Last updated 8 October 2026 · 6 min read

In short: we use your details to run your bookings and account, and share them only as needed — for example with the hotel you book and our payment provider. We don’t sell personal data. You can unsubscribe from marketing at any time, and optional cookies only load if you accept them. You can ask to see, correct or delete your data at privacy@hothotels.co.
This policy is the complete statement of our processing of personal data. Promotional material does not confer additional data-protection rights. It should be read with our Terms of service and Cookie policy.

Hot Group Holdings Ltd ("HotHotels", "we", "us", "our") is the data controller. Company no. 17154361. Registered office: 71–75 Shelton Street, Covent Garden, London WC2H 9JQ. We process personal data under the UK GDPR and the Data Protection Act 2018. If you are in the EEA, UK GDPR-style protections still apply to how we handle your data; you may also have rights under local law.

1. Whose data this covers

This policy covers visitors, people who search or save hotels, people who create an account, lead guests and other guests named on a booking, and people who email, call or write to us. If you book for someone else, you must have their permission to give us their details.

2. The data we collect

  • Identity and contact — name, email, phone, billing address, and guest names on a booking.
  • Account and authentication — Clerk user id, sign-in method (email code, password if you set one, or Google), and security events. We do not store Google's password.
  • Booking — hotel, dates, rooms, occupancy, special requests, booking and supplier references, cancellation and change history.
  • Payment — amount, currency, last4 / brand where Stripe provides them, PaymentIntent and customer ids, billing country for tax. Full card numbers are processed by Stripe, not stored on our servers.
  • Preferences — currency, marketing consent, saved hotels.
  • Technical — IP address, device and browser, approximate location derived from IP, logs, cookie identifiers (see the Cookie policy), and — if you arrive from a Google ad — a first-party ads-visit flag so we can show the advertised rate.
  • Communications — emails, contact-form messages, support threads, and recordings or transcripts if you call a support line we operate (including an automated voice assistant).

We do not need special-category data to book a hotel. If you volunteer health or accessibility information in a special request, we pass it only as needed to try to fulfil that request and we do not use it for marketing.

3. Where it comes from

From you (forms, checkout, account, cookies you accept), from the person who books you as a guest, from payment and identity providers (Stripe, Clerk, Google if you use Google sign-in), from Google Ads, Meta (Facebook and Instagram) or TikTok when you click one of our ads (click identifiers such as gclid), from hotel suppliers when they send booking status, and from our own logs.

  • Contract (UK GDPR Art. 6(1)(b)) — create an account, complete and manage bookings, take and refund payment, send booking messages.
  • Legitimate interests (Art. 6(1)(f)) — to operate and secure the Service, prevent fraud and abuse, analyse use of the Service, improve listings, and establish, exercise or defend legal claims, balanced against your rights.
  • Consent (Art. 6(1)(a) and PECR) — optional marketing, and non-essential cookies including Google Tag Manager and Google Ads measurement, the Meta and TikTok pixels and Microsoft Clarity. You can withdraw consent without affecting a booking already made.
  • Legal obligation (Art. 6(1)(c)) — tax, accounting, sanctions and fraud rules, and answering a lawful request from a regulator or court.

We do not use your data to make solely automated decisions that produce legal effects other than ordinary fraud checks and payment authorisation. Those checks can refuse a booking; you can contact us if you think a check was wrong.

5. Who we share it with

We do not sell personal data. We share it only as needed:

  • Hotels and booking partners — guest and stay details so the reservation can be honoured, shared with the property itself and the partner that supplies its rooms to us.
  • Stripe — hotel payments, including Apple Pay / Google Pay.
  • Clerk — sign-in, sign-up and session security.
  • Email provider (Resend) — confirmations, checkout sign-in codes, support replies, a reminder about a booking you started, and marketing contacts if they subscribed on the homepage or ticked the checkout offers box.
  • Hosting and database — Vercel and our Postgres host, to run the Service.
  • Support tools — including a phone or voice provider if you call us.
  • Google — Continue with Google (authentication); public maps or place images; and, if you accept optional cookies, Google Tag Manager and Google Ads so we can measure ad clicks and bookings (including a purchase event with booking reference and value). Google's own notices apply to cookies and ads measurement they run.
  • Meta (Facebook and Instagram), TikTok and Microsoft — only if you accept optional cookies. The Meta and TikTok pixels measure whether one of our ads led to a visit or a booking: they are told when you view a hotel and move through the steps of a booking, and the booking reference and value once it is confirmed. For a confirmed booking we also send Meta that event from our servers, with your email, phone number, name and country in hashed (scrambled) form and your IP address and browser details, so Meta can match the booking to an ad. Microsoft Clarity records how pages are used; anything you type is hidden from it.
  • Professional advisers and authorities — where the law requires it, or to establish, exercise or defend a claim.

Those parties act as processors on our instructions, or as independent controllers (hotels, card issuers, Google when you use their sign-in or Ads, and Meta, TikTok and Microsoft for the measurement described above). Their own notices also apply to what they do as controllers.

6. International transfers

Bookings are worldwide. Fulfilment often means sending guest data outside the UK. Stripe, Clerk and other vendors may process data in the US or elsewhere. Where the UK has not deemed a country adequate, we use the UK International Data Transfer Agreement, UK Addendum to the EU SCCs, or another lawful safeguard.

7. How long we keep it

  • Booking and payment records — typically at least six years after the stay (tax and claims).
  • Account — while the account is open, then a short period needed to close it cleanly.
  • Marketing lists — until you unsubscribe or the list is unused.
  • Logs — a shorter operational period unless needed for security.
  • Support recordings — only as long as needed to handle the query and defend a dispute.

We delete or irreversibly anonymise data when we no longer need it.

8. Your rights

You can ask us to:

  • access a copy of your personal data;
  • correct inaccurate data;
  • erase data in the cases the law allows (we may keep booking records we must keep);
  • restrict or object to some processing;
  • receive data you gave us in a portable form; and
  • withdraw consent where we rely on it.

Email privacy@hothotels.co. You can complain to the ICO at ico.org.uk. We invite you to contact us first so that we may attempt to resolve the matter.

Erasing an account does not cancel a stay. Cancel the booking under the Rate.

9. Marketing

We send marketing only with consent or another PECR-lawful basis (for example a soft opt-in for similar products if you are an existing customer and we give you a clear opt-out). If you start a booking and give us your email address but don’t finish it, we may send you one reminder about that booking, which may include an offer. Unsubscribe on the email or write to us. Booking and payment service messages are not marketing and will continue to be sent.

10. Cookies

See the Cookie policy. Strictly necessary cookies run the booking and sign-in, and remember an ads visit so we can keep the advertised rate. Analytics and ad measurement (Google, Meta and TikTok) wait for your choice on the banner.

11. Security

We implement appropriate technical and organisational measures, including encryption in transit, access controls and PCI-compliant payment processing. No method of transmission or storage is completely secure. We will notify you and the ICO of a personal-data breach where required by law.

12. Children

The Service is for people 18 or over. We do not knowingly create accounts for children. A child named as a guest is included only because an adult booked them.

13. Changes

We may update this policy. The date at the top is the current version. Material changes will be flagged on the site or by email where we can. Continued use after a change is acceptance of the new policy for future processing.

14. Contact

Data Protection Officer, Hot Group Holdings Ltd, 71–75 Shelton Street, Covent Garden, London WC2H 9JQ.
privacy@hothotels.co