PRIVACY POLICY

WILSON HOUSE

Effective date: 10 September 2025

Who we are: Wilson House Camden (“we”, “us”, “our”) is a hostel located in London, United Kingdom. We are the data controller for the personal data described in this policy.

Legal entity name: Wilson House Camden
Address: 161-169 Goldhurst Terrace, London, NW6 3ET
Telephone: +442080640137

1) Scope

This policy explains how we collect, use, disclose and protect personal data of guests, prospective guests, website visitors, Wifi users, job applicants, suppliers and other individuals who interact with us.

2) What data we collect

A. Booking & stay information

Identification & contact: name, email, phone, postal address, nationality, date of birth, ID/passport details (where required by law), booking reference.
Stay details: dates, room/bed type, special requests, group/lead guest details, companions’ names.
Payment information: payment method, amount, billing address; we do not store full card numbers—payments are processed by our payment processor.
Communications: emails, messages, call notes, feedback/reviews, incident reports (e.g., lost property, complaints).

B. Website & cookies

Device and usage data: IP address, device/browser, pages viewed, time on site, referral source.
Cookies and similar tech: see Section 10.

C. CCTV (on premises)

Video recordings in common areas and entrances for safety and security (no recording in private rooms or bathrooms).

D. Wifi & network logs

Device MAC address, IP, timestamps, bandwidth usage, visited domains metadata (not content), to operate the service and prevent misuse.

E. Events & marketing

Attendance lists, photos (only with consent or where our legitimate interests apply), preferences, opt-in records.

F. Suppliers & job applicants

Contact details, business information, CVs, interview notes, right-to-work documentation (applicants).

Special category data: We do not seek to collect sensitive data (e.g., health) except when you choose to share it (e.g., accessibility needs) or where required for incidents; we will handle such data with heightened care and legal basis (usually explicit consent or legal claims).

Children: Our services are intended for guests [e.g., 16+]. If you are a parent/guardian and believe a child has provided us data, contact us to remove it unless we must retain it by law.

3) Data retention

We keep data only as long as necessary for the purposes above, then delete or anonymise. Typical retention:

Booking/stay records: 6 years from end of the financial year (tax/audit).
Guest registration cards/ID checks (where required): 12 months (or per legal requirement).
Payment records (not card numbers): 6 years.
CCTV: 30 days (longer if investigating an incident).
Wifi logs: 12 months (security/abuse prevention).
Marketing data: until you opt out or after 24 months of inactivity.
Incident/claims files: until resolution + 6 years.
Job applications: 6 months if unsuccessful (unless you consent to a talent pool).

4) Security

We apply administrative, technical and physical measures to protect data, including:

Role-based access, staff training and confidentiality obligations.
Encryption in transit and at rest where appropriate.
Vendor due diligence and contracts with data protection terms.
Regular updates/patching and least-privilege access.
No method of transmission is 100% secure, but we work to maintain a level appropriate to risk.

5) Your rights (UK GDPR)

You have the right to:

Access your data and get a copy.
Rectify inaccurate or incomplete data.
Erase data (“right to be forgotten”) in certain cases.
Restrict or object to processing in certain cases (including direct marketing).
Data portability for data you provided to us and we process by consent/contract.
Withdraw consent at any time (it won’t affect past lawful processing).
Complain to the Information Commissioner’s Office (ICO): ico.org.uk or 0303 123 1113.

To exercise your rights, please fill out the form in the CONTACT US section. We may need to verify your identity. We aim to respond within one month.