Privacy centre

1. Who is responsible for your data

ARK PLATFORMS, EUROPE LIMITED (company number 16762355, registered office Office 12 Initial Business Centre, Wilson Business Park, Manchester, M40 8WN, United Kingdom) is the controller of personal data collected through this site and through Averton Circle. Where you stay in a house operated by an independent owner — a franchise, or a house in the Haven or Origin collections — that owner is a separate controller for data about your stay, and we identify them in your booking confirmation.

2. What this notice covers

This notice covers the website, the booking and enquiry forms, Averton Circle membership, and our correspondence with you. Each house may process additional data in the building itself — for example a registration card required by local police or tourism law — under its own notice, given to you at check-in.

3. What we collect

We collect only what a stay actually requires:

• Identity and contact data: name, email address, postal address, telephone number, and the country you live in
• Booking data: houses, dates, room types, rates, companions named on the booking, arrival time, and the notes you send us
• Membership data: Averton Circle number, tier, points balance, stay history and the preferences you have asked us to keep
• Payment data: the last four digits and expiry of the card used, and the payment reference. Full card numbers are handled by our payment provider and are never stored on our systems
• Correspondence: messages you send to reservations, development, careers, press or partners, and our replies
• Technical data: IP address, device and browser type, and pages viewed, collected only where you have allowed analytics cookies
• Special category data, only if you volunteer it: health or accessibility information needed to prepare a room, and dietary requirements that reveal religious belief. We use it solely to provide what you asked for, and delete it when the stay is complete unless you ask us to keep it on your membership

4. Where the data comes from

Most of it comes from you, when you book, join Averton Circle, write to us or stay with us. Some reaches us from a travel agency, a corporate travel programme or an online travel agent when they make a booking on your behalf, and in that case it is limited to what is needed to honour the reservation. We do not buy personal data from data brokers, and we do not enrich your record from third-party sources.

5. Why we use it, and on what legal basis

Every use has a stated purpose and a lawful basis under the UK GDPR and the EU GDPR:

• To take and service your booking, and to answer your enquiries — performance of a contract, or steps taken at your request before entering into one
• To run Averton Circle, including earning, tiers and redemption — performance of the membership contract
• To apply preferences you have given us on future stays — our legitimate interest in providing the service we promise, which you can object to at any time
• To take payment, prevent fraud and pursue unpaid amounts — performance of a contract and our legitimate interest in protecting the business
• To keep records required by tax, accounting, hotel registration and consumer law — compliance with a legal obligation
• To send you offers and news — your consent, which you may withdraw at any time
• To prepare accessible rooms or meet dietary requirements — your explicit consent for special category data
• To measure how the site is used and improve it — your consent, given through the cookie banner

6. Marketing, and how to stop it

We write to you about offers only if you have opted in. Every message carries a one-click unsubscribe, which takes effect immediately, and you can also write to us. Withdrawing consent does not affect your membership, your points, or the service you receive. We do not run advertising based on tracking you across other websites, and we do not share your details with advertisers.

7. Profiling and automated decisions

We do not make decisions about you by automated means alone that produce legal effects or similarly significant effects. We do group members by broad stay patterns — for example, whether you usually travel for work or for leisure — to decide which offers to send. That grouping affects only what you are shown, never the rate you are quoted, and you can object to it.

8. Who else sees it

Your data is seen by the house you are staying in and by the group team supporting it. Beyond that we share it only with:

• Processors acting on our instructions: hosting, the property management and booking systems, email delivery, the payment provider, and analytics where you have allowed it, each under a written contract
• Independent owners of houses in the franchise and collection models, as separate controllers, limited to your reservation with them
• Travel agencies and corporate travel programmes, where they made the booking, limited to that booking
• Public authorities, where hotel registration, tax or law enforcement obligations require it in the country of the house
• Professional advisers, and a buyer or successor if the business or part of it is transferred, under confidentiality

9. Sending data outside the UK and the EEA

Our houses are in the United Kingdom and the European Economic Area, and most data stays there. Where a supplier processes data elsewhere, we rely on an adequacy decision where one exists, and otherwise on the UK International Data Transfer Addendum or the European Commission's standard contractual clauses, together with an assessment of the safeguards in the destination country. You may ask us for a copy of the mechanism used for a specific transfer.

10. How long we keep it

We keep data only as long as it is needed for the purpose it was collected for:

• Booking and stay records: seven years after the stay, to meet tax and accounting obligations
• Averton Circle membership: while the membership is active, and for 24 months after the last eligible night, after which the balance expires and the record is deleted
• Enquiries that do not lead to a booking: 12 months
• Job applications: 12 months, unless you ask us to keep them longer
• Development enquiries: for the life of the discussion and three years afterwards, given their commercial nature
• Accessibility and dietary information: deleted when the stay is complete, unless you ask us to hold it on your membership
• Marketing consent records: for as long as you are subscribed, and three years after you unsubscribe, as evidence that consent was given and withdrawn

11. How we protect it

Access is limited to staff who need it for their work, and is logged. Data is encrypted in transit, and at rest where our systems support it. Payment data is handled by a PCI-DSS compliant provider. We test our systems and review access rights regularly. If a breach occurs that is likely to result in a risk to your rights, we notify the supervisory authority within 72 hours and tell you directly where the risk is high.

12. Your rights

Wherever you live, we honour these rights for everyone:

• Access: a copy of the personal data we hold about you
• Rectification: correction of data that is wrong or incomplete
• Erasure: deletion, where we no longer need the data and no legal obligation requires us to keep it
• Restriction: a pause on processing while a dispute about accuracy or legitimate interest is resolved
• Portability: the data you gave us, in a machine-readable format, transmitted to you or to another controller
• Objection: to processing based on legitimate interest, including profiling for marketing purposes
• Withdrawal of consent: at any time, without affecting processing already carried out

13. How to exercise them

Write to us at the address in clause 16. We answer within one month, and tell you if we need a further two months because the request is complex. We do not charge, unless a request is manifestly unfounded or excessive. We may ask for enough information to confirm who you are, and we do not use that information for anything else.

14. Children

This site and Averton Circle are for adults. We do not knowingly collect data from anyone under 18 except the name and age of a child travelling on a booking made by an adult, which we need to allocate a room correctly and to comply with safety rules. Seren houses are adults only.

15. Complaints

Tell us first and we will try to resolve it. You also have the right to complain to a supervisory authority: in the United Kingdom, the Information Commissioner's Office; in Spain, the Agencia Española de Protección de Datos; and in any other member state, the authority where you live, where you work, or where the issue occurred.

16. Contact and changes

Write to ARK PLATFORMS, EUROPE LIMITED, Office 12 Initial Business Centre, Wilson Business Park, Manchester, M40 8WN, United Kingdom, or by email to the reservations address in the footer, marking your message for the attention of privacy. We update this notice when our processing changes; the date it took effect is shown at the foot of this page, and material changes are notified to members by email.