1. INTRODUCTION

This Privacy Policy explains how Marine & Lawn Hotels & Resorts and its owners (“Company”) collects, uses, and discloses information about you through its website, and other online products and services (collectively, the “Services”).

For the purposes of the Data Protection Legislation (defined below), Adventurous Journeys LLC and one of the following entities will be the “controllers” of your personal data depending on which Marine & Lawn Hotel you stay at, visit or otherwise interact with and with which you or your organisation may have a contract: (i) TRUK Owner Ltd, registered number 12838414 and address 54 Portland Place, London, England, W1B 1DY, in respect of The Marine Hotel, Troon; (ii) SAUK Operator Ltd, registered number 05903109 and address 54 Portland Place, London, England, W1B 1DY, in respect of the Rusacks St Andrews Hotel; (iii) BWUK Operator Ltd, registered number 12414616 and address 54 Portland Place, London, England, W1B 1DY, in respect of the Marine North Berwick Hotel and Spa; or (iv) HHG No7. Limited, registered number NI673203 and address Downs Road, Newcastle, County Down, Northern Ireland, BT33 0AH, in respect of the Slieve Donard Resort and Spa (“we”, “us” and “our”).

This Privacy Policy explains how we collect, use, and disclose any personal data that we may hold about visitors to our website, our customers, our business contacts and other third parties with whom we may interact from time to time (“you” and “your”).

We may change this Privacy Policy from time to time. If we make changes, we will notify you by revising the date at the top of this Privacy Policy and, in some cases, we may provide you with additional notice (such as adding a statement to our homepage or sending you a notification).

2. COLLECTION OF INFORMATION

Information You Provide to Us

When you use our Website or other booking facilities provided by our third party booking partners, or otherwise contact us to book a room or a meal with us, open an account, sign-up to our golf or leisure facilities or register for the Services, we ask you to provide certain information, such as your name, postal address, room preferences, company name (if travelling on business), phone number, email address, the size and makeup of your party (including how many adults and children), your preferred currency for payment, your check-in/check-out dates, the location of the hotel at which you intend to stay and your payment information.

When you stay with us or visit the Hotel, our restaurant or another hotel in our collection, or are a member of our golf or leisure facilities we may collect the above information on your arrival, as well as other information relating to your visit, such as access times and requirements, your preferences, choices and purchases and other information that you may choose to provide to us. The purpose of your visit may also reveal certain other personal data, such as if you celebrate a birthday or anniversary with us and choose to let us know so we can celebrate with you or make your trip extra special.

We also collect information when you subscribe to our monthly newsletter online, fill out other online forms, make an online purchase, enter one of our promotions or competitions, communicate with us via third party social media or travel review sites, request customer support, or otherwise communicate with us through our website.

If you are one of our contacts at one of our business partners, you or your organisation may also provide certain of your personal data so that we can administer our relationship, such as your business contact details to discuss your or our requirements. Please note that some of this personal data may also be collected from public sources, such as your/your organisation’s website.

Information About Your Use of the Website

Usage Information

We collect information about your use of our website, such as the search terms you enter, the pages you visit within our website, and the links you click on.

Automatically Collected Information

When you access or use our Website, we may automatically collect information about you, including:

Log Information: We collect log information about your use of the Services, including the type of browser you use, access times, pages viewed, your IP address and the page you visited before navigating to our Services. Device Information: We collect information about the computer or mobile device you use to access our Services, including the hardware model, operating system and version, unique device identifiers, and mobile network information. Location Information: In accordance with your device permissions, we may collect information about the precise location of your device. For more details, please see “Your Choices” below. Information Collected by Cookies and Other Tracking Technologies: Like most online services and mobile applications, we may use cookies and other technologies, such as web beacons, web storage, and unique advertising identifiers, to collect information about your activity, browser, and device. Cookies are small data files stored on your hard drive or in device memory that help us improve our Services and your experience, see which areas and features of our Services are popular, and count visits. Web beacons are electronic images that may be used in our Services or emails and help deliver cookies, count visits and understand usage and campaign effectiveness. For more information about cookies and how to enable or disable them, please see “Your Choices” below. Information We Collect from Other Sources

We may obtain information from other sources and combine that with information we collect through our Services. For example, we may collect information about you through other means, such as from third parties such as travel agencies, and combine that information with information we hold.

Where you leave reviews for us on public third party websites, such as TripAdvisor or similar websites, we may also collect certain personal data about your stay to help us improve our services for you and other customers.

Information about those related or otherwise connected to our employees

We sometimes ask our colleagues to provide details of their next of kin for the purpose of our emergency scenario planning or in case an incident occurs at work. We may also ask for details of their dependents, spouses and/or other people in relation to their employee benefits and pensions arrangements. We will only ever use this information for the benefit of our staff and for the purpose it was provided.

Public information

We may also process certain personal data where you have made such personal data public (such as through social media or business contact information sites).

Photos and other media

Where we have your permission to do so, we may also use images or videos of you in our marketing campaigns and on our website, so that your experiences can inspire other customers to join us.

Children

You must be over 18 to access and use our Website or make a Transaction (as defined in our Terms of Service). We do not intentionally collect or retain any personal data relating to individuals under 13, however, there may be occasions where the person with parental responsibility provides us with personal data relating to a child. For example, if you are a family with children under 13 and take a vacation with us, certain information you provide during your stay may relate to those children, such as their name, dietary preferences or age so we can make sure their stay is just as inspiring as yours. We will only process such information where we have parental consent or another legal basis to do so.

Special category data

Under Data Protection Legislation we have greater obligations in relation to processing special category and criminal offence data. “Special category” data is defined in the Data Protection Legislation and broadly means any information relating to an individual’s racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, physical or mental health or condition, sex life, sexual orientation and biometric information. We will only ever process any such information in very limited circumstances, such as set out below. Please know that we take our responsibilities in relation to such sensitive data very seriously and will only retain it for as long as strictly necessary and then delete such information.

3. USE OF INFORMATION

We use the information we collect to provide, maintain, and improve our Services and Website and to administer our business. We may also use your personal data to:

Fulfil your booking with us or another hotel in our collection, fulfil another Transaction (as defined in the Terms of Service) you have made with us or process your leisure or golf membership; Send you technical notices, updates, security alerts and support and administrative messages and to respond to your comments, questions and requests and provide customer service, including where you have purchased a Product (as defined in our Terms of Service); Where we have you consent to do so or we otherwise have the right to do so, communicate with you about products, services, offers, promotions, rewards, and events offered by us and others, and provide news and information we think will be of interest to you; Conduct website analytics, monitor and analyse trends, usage and activities in connection with our Website and Services; Detect, investigate and prevent fraudulent transactions and other illegal activities and protect our and/or others’ rights and property; Personalize and improve the Services and provide and improve our advertisements, content or features that match user profiles or interests; Facilitate contests, sweepstakes and promotions and process and deliver entries and rewards; Link or combine with information we get from others to help understand your needs and provide you with better service; and Carry out any other purpose described to you at the time the information was collected or reasonably notified to you.

4. LEGAL BASIS FOR PROCESSING

We will process your personal data on the following legal bases under Data Protection Legislation:

Where processing such information is in our or a third party’s legitimate interests and they are not overridden by your interests – for example to communicate with you about changes to our Services, and to provide, secure, or improve our Website or Services; Where it is necessary for the performance of our contract with you or to take steps requested by you prior to entering into a contract – for example to process payments for and fulfil a booking or Transaction (as defined in our Terms of Service) you make, provide services you have requested or to respond to your enquiries prior to making such a booking; Where it is necessary for us to comply with our own legal obligations – for example if you have an accident at our hotel and we need to maintain a record in accordance with health and safety laws; Where it is necessary to protect your or another person’s vital interests – for example, if you fall ill at our hotel and we need to provide your allergen information to a healthcare professional; Where it is necessary in connection with the performance of a task we are carrying out in the public interest – for example, in connection with any “test and trace” in connection with the COVID-19 pandemic; and Where we otherwise have your consent to do so – such as where you have subscribed to our marketing. In the limited circumstances where we might process special category personal data, we will only do so where:

You have given us your consent to do so – such as where you have chosen to let us know or ask us to help you making a personal or religious celebration more special; Where necessary for us to carry out our obligations in connection with the employment of our staff – such as to ensure that they have a safe and positive working environment and to process their benefits and pensions arrangements (including in connection with their next of kin); Where it is necessary to protect your or another person’s vital interests and you are unable to provide your consent – such as set out above; Where you have manifestly made that information public – such as if you are a public member of a religious or political group; Where we need to do so in connection with establishing, exercising or defending a legal claim – such as where we consider you are in breach of the terms of your contract with us; Where it is necessary for reasons of public interest in the area of public health – such as in connection with the Covid-19 pandemic. We may also process your criminal offence data where it is in our legitimate interests and we need to do so for the prevention or detection of unlawful acts, fraud, terrorist financing or money laundering, to protect your or another’s vital interests, or in connection with a legal claim – such as where we suspect that you may have committed fraud or a crime against us, our staff or another customer.

5. SHARING OF INFORMATION

We may share information about you as follows or as otherwise described in this Privacy Policy:

With vendors, consultants and other service providers who need access to such information to carry out work on our behalf; With third parties where you have selected to purchase a third party product so that they can fulfil your purchase (including as set out in our Terms of Service); In response to a request for information if we believe disclosure is in accordance with, or required by, any applicable law or legal process, including lawful requests by public authorities to meet national security or law enforcement requirements; If we believe your actions are inconsistent with our user agreements or policies, or to protect our and/or others’ rights, property and safety; In connection with, or during negotiations of, any merger, sale of company assets, financing or acquisition of all or a portion of our business by another company; Between and among us and our current and future parents, affiliates, subsidiaries and other companies under common control and ownership; and With your consent or at your direction. We may also share aggregated or de-identified information, which cannot reasonably be used to identify you.

6. SOCIAL SHARING FEATURES

We may allow others to provide analytics services and serve advertisements on our behalf across the internet and in applications. The Website may offer social sharing features and other integrated tools (such as the Facebook “Like” button), which let you share actions you take on our Website with other media, and vice versa. Your use of such features enables the sharing of information with your friends or the public, depending on the settings you establish with the entity that provides the social sharing feature. Please note that where a social media provider may carry out these processes, that provider shall also be considered a controller of your personal data. For more information about the purpose and scope of data collection and processing in connection with social sharing features, please visit the privacy policies of the entities that provide these features.

7. ADVERTISING AND ANALYTICS SERVICES PROVIDED BY OTHERS

We may allow others to provide analytics services and serve advertisements on our behalf across the internet and in applications. These entities may use cookies, web beacons, device identifiers and other technologies to collect information about your use of the Services and other websites and applications, including your IP address, web browser, mobile network information, pages viewed, time spent on pages or in apps, links clicked and conversion information. This information may be used by us and others to, among other things, analyse and track data, determine the popularity of certain content, deliver advertising and content targeted to your interests on our Services and other websites and better understand your online activity.

Please note that where a social media provider may carry out these processes, that provider shall also be considered a controller of your personal data and will be able to tell you more about how they use and process personal data. We therefore ask that you review their privacy policies and your privacy settings on such sites for further information and controls as to how to opt-out of such marketing.

For more information about interest-based ads, or to opt out of having your web browsing information used for behavioural advertising purposes, please visit www.aboutads.info/choices.

8. DATA RETENTION

We store the information we collect about you for as long as is necessary for the purpose(s) for which we originally collected it. We may retain certain information for legitimate business purposes or as required by law. Once we no longer have a legal basis to hold it, we will anonymise or delete it.

9. PROFILING

We may collate and analyse personal data in order to create customer profiles and to assess and improve our Website and Services. If you wish to opt-out of such profiling, please contact us on the details at Section 12. We do not carry out any automated decision making or profiling that may produce legal effects or that may significantly affect you.

10. TRANSFER OF INFORMATION TO THE U.S. AND OTHER COUNTRIES

The nature of our business means that we and our service providers will process and store your personal data in the UK, the U.S. and Canada. Where we do transfer personal data from our systems in the UK to our systems or third parties located outside the UK, we will only do so in accordance with Data Protection Legislation and where one of the following applies (in each case according to which Data Protection Legislation might apply in the relevant situation):

UK Data Protection Legislation (including the UK GDPR and the UK Data Protection Act 2018) applies and the transfer is to a country which has been assessed by the UK Government as ensuring an adequate level of protection for personal data; or a written agreement has been entered into between the relevant parties which incorporates the “model clauses” as approved by the European Commission (or some other form of data transfer mechanism approved by the UK Government) to protect your personal data as required by Data Protection Legislation. A copy of the model clauses can be found on the European Commission website or at the link here. 11. QUESTIONS OR COMPLAINTS If you have a question or concern about our processing of personal data we ask that you contact us on the details below. However, if we are not able to resolve your concern, you have the right to lodge a complaint with the UK data privacy authority, the Information Commissioner’s Office (the “ICO“).

12. YOUR CHOICES

Data Subject Rights

Subject to certain exemptions, you have the right to access personal data we hold about you and to ask that your personal data be corrected, erased, or transferred. You also have the right to object to, or request that we restrict, certain processing. You can also withdraw any consent you may have given to us to hold and use your personal data. If you would like to exercise any of these rights, you may contact us as indicated below. Please note that in certain circumstances, we may have a lawful reason to continue to process your information (for example, where we need to hold a copy to comply with our legal obligations).

To help us comply with our obligations, please do ensure that any personal data you provide us with is accurate and complete and notify us of any changes to your personal data as soon as possible so that we can update our records.