Privacy policy

This Privacy Policy explains how Dukes Bath ("we", "us", "our") collects, uses and protects your personal data when you visit our website, make a booking, or otherwise interact with us. We are committed to protecting your privacy and complying with UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We may update this policy from time to time. The current version will always be available on our website

1. Who We Are

The data controller responsible for your personal data is:

Dukes Bath 53–54 Great Pulteney Street Bath BA2 4DN

Email: reservations@dukesbath.co.uk Telephone: 01225 787960

Dukes Bath is part of Kaleidoscope Hotels, owned by Ian and Christa Taylor.

2. What Personal Data We Collect

We may collect and process the following categories of personal data:

Identity data: name, title
Contact data: email address, postal address, telephone number
Booking data: arrival and departure dates, room preferences, special requests, number of guests
Financial data: payment card details (processed securely via our third-party payment provider; we do not store full card numbers)
Marketing preferences: whether you have opted in to receive promotional communications
Technical data: IP address, browser type, pages visited, cookies (see Section 8)
Communications: records of correspondence with us by email, phone or post

3. How We Collect Your Data

We collect personal data in the following ways:

Directly from you - when you make a booking, contact us, complete a form on our website, or sign up for our mailing list
Automatically - through cookies and similar technologies when you browse our website (see Section 8)
From third parties - such as online travel agents or booking platforms through which you may make a reservation

4. How We Use Your Personal Data

We use your personal data for the following purposes, relying on the lawful bases set out below:

Fulfilling your booking and stay

Lawful basis: Performance of a contract. We use your identity, contact and booking data to process and manage your reservation, send booking confirmations, and provide the services you have requested.

Communicating with you

Lawful basis: Performance of a contract / Legitimate interests. We may contact you before, during or after your stay regarding your reservation or to respond to enquiries.

Marketing

Lawful basis: Consent (for email marketing) / Legitimate interests (for postal marketing to existing customers). Where you have opted in, we may send you information about offers, events and news at Dukes Bath and across the Kaleidoscope Hotels collection. You may withdraw consent or opt out at any time (see Section 7).

Improving our website and services

Lawful basis: Legitimate interests. We use technical and usage data to understand how our website is used and to improve our services.

Legal compliance

Lawful basis: Legal obligation. We may need to process your data to comply with applicable laws and regulations.

5. Who We Share Your Data With

We do not sell your personal data. We may share it with:

Service providers who help us operate our business (e.g. our booking system provider, payment processor, email marketing platform) — these parties process data on our behalf and are bound by data processing agreements
Our sister properties within the Kaleidoscope Hotels collection, where relevant to your booking or stay
Professional advisers such as lawyers and accountants, where necessary
Law enforcement or regulatory authorities, where required by law

We will not share your data with third parties for their own marketing purposes without your explicit consent.

6. How Long We Keep Your Data

We retain your personal data only for as long as necessary for the purposes for which it was collected, and in accordance with our legal obligations. As a guide:

Booking and guest records: up to 7 years (to comply with financial and legal obligations)
Marketing data: until you withdraw consent or opt out
Website technical data: typically up to 13 months (cookie lifespan)

When data is no longer needed, it is securely deleted or anonymised.

7. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

Right of access — to request a copy of the personal data we hold about you
Right to rectification — to ask us to correct inaccurate or incomplete data
Right to erasure — to request deletion of your data in certain circumstances
Right to restriction — to ask us to restrict processing of your data in certain circumstances
Right to data portability — to receive your data in a structured, machine-readable format
Right to object — to object to processing based on legitimate interests or for direct marketing purposes
Right to withdraw consent — where processing is based on consent, you may withdraw it at any time

There is no fee for exercising any of these rights. We will respond within one calendar month. To make a request, please contact us at reservations@dukesbath.co.uk or write to us at the address in Section 1.

If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

ICO helpline: 0303 123 1113 Website: www.ico.org.uk

8. Cookies

Our website uses cookies — small text files placed on your device — to help us understand how visitors use the site and to improve your experience. We use:

Essential cookies — necessary for the website to function (e.g. session management)
Analytics cookies — to understand how visitors interact with our site (e.g. Google Analytics)
Marketing cookies — to help us deliver relevant content and measure campaign effectiveness

When you first visit our website, you will be asked to consent to the use of non-essential cookies. You can change your cookie preferences at any time via your browser settings. Please note that disabling some cookies may affect the functionality of the site.

9. Links to Other Websites

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of those sites. We encourage you to read their privacy policies before providing any personal data.

10. Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or disclosure. Payment card information is handled by our PCI-compliant payment provider and is not stored on our systems.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The current version will always be available on this page. Where changes are significant, we will notify you directly where possible.

For any questions about this policy, please contact us at reservations@dukesbath.co.uk

A cookie is a small file which asks permission to be placed on your computer’s hard drive. Once you agree, the file is added and the cookie helps analyse web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences.

We use traffic log cookies to identify which pages are being used. This helps us analyse data about webpage traffic and improve our website in order to tailor it to customer needs. We only use this information for statistical analysis purposes and then the data is removed from the system.

Overall, cookies help us provide you with a better website, by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us.

You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website.