Last updated: 12 October 2026
1. Who we are
This Privacy Policy explains how Habbadad ("we", "us", "our"), of 41 Harbourside Quay, Bristol BS1 5TX, United Kingdom, processes personal data when you visit habbadad.com, contact us, make a reservation, attend an event or stay at the resort. We are the data controller for the personal data described in this policy. You can reach us about privacy at support@habbadad.com or by post at the address above, marked for the attention of the Data Protection Officer.
2. Information we collect
We collect only the information we need to provide our services. Depending on how you interact with us, this may include:
- Identity and contact data: name, title, postal address, email address, telephone number and date of birth.
- Booking data: arrival and departure dates, room preferences, dining reservations, event details, special requests and accompanying guests.
- Payment data: card details are processed by our PCI DSS–certified payment providers; we retain only a token, card type and the last four digits.
- Verification data: where the law requires age or identity checks for access to age-restricted areas, we record the type of document checked, verification outcome and date. Copies of documents are retained only where legally required.
- Preference data: dietary requirements, accessibility needs, room and pillow preferences, and marketing choices.
- Technical data: IP address, browser type, device identifiers, pages visited and referring URLs, collected through cookies and similar technologies.
- Security data: CCTV recordings in public areas of the resort, access-card logs and incident reports.
- Communications: the content of emails, calls, contact forms and feedback you send us.
Some information, such as dietary or accessibility needs, may reveal health information. We process this only with your explicit consent or where necessary to protect your vital interests, and only to deliver the service you have requested.
3. How we use your information
- To take, manage and fulfil reservations for rooms, dining, spa and events.
- To process payments, prevent fraud and maintain accurate financial records.
- To meet legal duties, including licensing, anti-money-laundering, age verification, safer-play and tax obligations.
- To keep guests, colleagues and property safe, including through CCTV.
- To personalise your stay and remember your preferences.
- To answer enquiries and handle complaints.
- To send newsletters and offers where you have opted in; you can withdraw at any time.
- To improve our website, services and guest experience through aggregated analytics.
4. Legal bases for processing
Under the UK GDPR and the EU General Data Protection Regulation, we rely on the following legal bases: performance of a contract (bookings and stays); compliance with legal obligations (licensing, tax, anti-money-laundering, age checks); legitimate interests (security, fraud prevention, service improvement), balanced against your rights; consent (marketing, non-essential cookies, special category data); and vital interests (emergencies).
5. Sharing your information
We never sell your personal data. We share it only with:
- Service providers who act on our instructions, such as payment processors, booking engines, IT hosting, email delivery and analytics providers, under written data processing agreements.
- Professional advisers including auditors, insurers and lawyers.
- Regulators, law enforcement and public authorities where required by law, including licensing authorities and HM Revenue & Customs.
- A successor organisation in the event of a sale or restructuring, subject to equivalent protections.
6. International transfers
Where personal data is transferred outside the United Kingdom or European Economic Area, we ensure an adequate level of protection through adequacy regulations, the UK International Data Transfer Agreement, the EU Standard Contractual Clauses or other approved safeguards.
7. Data security
We apply technical and organisational measures appropriate to the risk, including:
- TLS encryption for all data in transit and AES-256 encryption for data at rest.
- Role-based access controls, multi-factor authentication and regular access reviews.
- Network segmentation separating payment, guest and corporate systems.
- Annual penetration testing and continuous vulnerability monitoring.
- Mandatory data protection training for every colleague.
- An incident response plan, including notification of the regulator within 72 hours of a qualifying breach and of affected individuals where required.
8. How long we keep information
We keep personal data only as long as necessary. Typical periods are: booking and financial records, six years after the end of the financial year; CCTV, 30 days unless required for an investigation; marketing preferences, until you unsubscribe; contact form enquiries, 24 months; records required by licensing and anti-money-laundering legislation, for the statutory period, normally five years.
9. Your rights
You have the right to access your personal data, correct it, request erasure, restrict or object to processing, request portability and withdraw consent at any time. You also have the right not to be subject to decisions based solely on automated processing that significantly affect you. To exercise any right, email support@habbadad.com. We respond within one month, extendable by two further months for complex requests.
If you are unhappy with how we handle your data, you may complain to the Information Commissioner's Office (ico.org.uk) or, if you live in the EU, to the supervisory authority in your country. We would appreciate the chance to resolve your concern first.
10. Children
Our website is intended for adults. We do not knowingly collect personal data from anyone under 18 except where provided by a parent or guardian as part of a family booking.
11. Changes to this policy
We may update this policy from time to time. The latest version will always appear on this page with its revision date. Material changes will be notified by email to guests with active bookings.
See also our GDPR, CCPA & Cookies Policy.