1. Data Controller & Registered Office

The Sovereign Court Hotel & Suites (“the Hotel”, “we”, “our”, or “us”) is the designated Data Controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Our registered corporate operational headquarters is located at Berkeley Square House, 4-19 Berkeley Square, Mayfair, London W1J 6BD, United Kingdom. We maintain rigorous standards of guest confidentiality, fiduciary integrity, and technical safeguarding across all digital booking interfaces and on-site guest registers.

2. Scope, Applicability & Age Demographics

This Privacy Policy governs the processing of personal information obtained from individuals interacting with our Mayfair residence, official website, telephone concierge, restaurant reservations, spa consultations, and The Sovereign Club gaming salon. Hotel accommodations are open to individuals of legal contract capacity (18 years and older), whereas admission to The Sovereign Club and participation in on-site gaming is strictly restricted to verified adults aged 21 years and over in full compliance with United Kingdom gaming standards.

3. Categories of Personal Data Collected

We collect and process only the minimum necessary personal data required to administer high-tier luxury hospitality, including:

Identity Records: Full legal name, formal title, date of birth, nationality, and photographic identification credentials (e.g., passport or UK driver's licence for statutory 21+ club verification).
Contact Information: Primary email address, mobile contact number, residential billing address, and emergency companion details.
Stay & Itinerary Data: Room and suite choices, arrival and departure schedules, dietary allergies, housekeeping notes, and bespoke concierge transport requests.
Payment & Billing Data: Payment card tokenisation identifiers, corporate invoicing details, billing addresses, and record of incidental authorizations.
Technical Diagnostics: IP address, device operating system, browser parameters, and minimal essential session cookies.

4. Methods of Data Collection

Personal information is gathered through direct guest interactions, including digital forms on gamesaroundworld.com, direct telephone communications with our 24/7 concierge, in-person check-in registration cards, secure resident Wi-Fi login portals, and correspondence with our reservations desk at [email protected]. Automated diagnostic data is captured solely during active website browsing to guarantee page stability.

5. Lawful Bases for Processing

All data processing conducted by The Sovereign Court Hotel rests upon established lawful grounds defined under Article 6 of the UK GDPR:

Performance of Contract: Facilitating room reservations, dining table allocations, spa bookings, and bespoke chauffeur transfers.
Legal & Regulatory Obligations: Compliance with the Immigration (Hotel Records) Order 1972, UK corporate tax accounting standards, and licensing laws.
Legitimate Interests: Preserving premises security, maintaining guest safety, managing fraud prevention, and optimizing digital infrastructure.
Explicit Consent: Sending optional seasonal event invitations or processing special health-related dietary or accessibility requests.

6. Specific Operational Purposes of Processing

Your data is processed strictly to confirm and fulfill room reservations, tailor personal butler services, prepare culinary orders in accordance with dietary needs, administer appointments at The Royal Thermal Spa, verify accreditation for The Sovereign Club, process accounting statements, and respond to general inquiries submitted through our contact channels. We do not sell or monetize personal data under any circumstances.

7. The Sovereign Club & Gaming Floor Verification

Patrons requesting entry to The Sovereign Club and Private Gaming Salon undergo mandatory age verification (21+). In accordance with UK regulatory practice, photographic ID is examined at the security desk to prevent underage presence. Gaming floor surveillance operates closed-circuit television (CCTV) solely for crime prevention, asset protection, and guest physical safety. CCTV footage is maintained under strict encryption and automatically overwritten within 31 days unless required for official legal investigation.

8. Disclosure to Third Parties & Data Processors

We do not disclose personal information to external commercial marketers. Personal data is shared exclusively with vetted data processors under strict data processing agreements, including PCI-DSS Level 1 compliant card tokenization gateways, property management software providers, and enterprise cloud hosting located within the UK. In exceptional circumstances, disclosures may be executed where required by statutory court order or law enforcement agencies.

9. Cross-Border & International Data Transfers

All core database systems and customer records are physically hosted within United Kingdom data facilities. If an auxiliary service provider requires data routing outside the UK or European Economic Area, we implement UK International Data Transfer Agreements (IDTAs) or approved Standard Contractual Clauses (SCCs) to guarantee an equivalent degree of privacy and protection.

10. Data Retention & Scheduled Erasure

Personal data is retained only for as long as necessary to fulfill the purpose for which it was originally collected. Financial records, invoices, and completed booking confirmations are archived for six statutory years to satisfy HMRC corporate audit requirements. General contact inquiries are purged after twelve months of inactivity, while temporary cookie data expires in accordance with our Cookie Policy.

11. Technical & Organizational Security Safeguards

The Sovereign Court Hotel maintains enterprise-grade security architecture, including Transport Layer Security (TLS 1.3) cryptographic protocols across all web endpoints, hardware firewalls, encrypted database storage, strict role-based internal credential limits, and bi-annual vulnerability audits. Staff members undergo mandatory data privacy training to ensure client discretion at all times.

12. Your Statutory Rights Under UK GDPR

As a data subject, you hold statutory rights under United Kingdom privacy legislation, which may be exercised free of charge:

Right of Access: Request a comprehensive copy of all personal data held concerning your identity.
Right to Rectification: Request the prompt correction of incomplete, outdated, or inaccurate information.
Right to Erasure: Request the deletion of personal records where ongoing legal retention is not mandated by statute.
Right to Restrict Processing: Request the restriction of active processing during dispute resolution.
Right to Data Portability: Obtain your structured personal records in a commonly readable format.
Right to Object: Object to processing founded upon legitimate interest grounds.

13. Data Protection Officer & Regulatory Recourse

To exercise any of your statutory rights or submit questions regarding our privacy framework, please reach out to our designated Data Protection Officer:

The Sovereign Court Hotel & Suites
Attention: Office of the Data Protection Officer
Berkeley Square House, 4-19 Berkeley Square, Mayfair, London W1J 6BD
Email: [email protected]
Telephone: +44 20 7946 0888

You also have the right to lodge a formal complaint with the UK supervisory authority, the Information Commissioner's Office (ICO), via Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, or online at ico.org.uk.