1. Introduction

Colessio (“we”, “us”, “our”) is committed to protecting your privacy. This notice explains how we collect, use, store and share your personal data when you use our website, make a booking, contact us by phone or visit the hotel. It reflects the requirements of:

• UK GDPR & Data Protection Act 2018
• Data (Use and Access) Act 2025 (DUAA), in force from 5 February 2026 with additional provisions from June 2026 
• Privacy & Electronic Communications Regulations (PECR)

2. Call Recording

Why we record calls

Inbound and outbound calls to the hotel are recorded for:

• Training and staff development
• Ensuring service quality
• Establishing facts in case of complaints or disputes
• Security and fraudprevention purposes

Lawful basis

Recordings are processed under:

• Legitimate interests (training, dispute resolution)
• Contract (when related to completing a reservation)
• Legal obligation (where relevant)

Retention

Recordings are kept only as long as necessary for the above purposes and then securely deleted.

3. What Data We Collect

We collect:

• Name and contact details
• IP address, device identifiers, and geolocation from your device 
• Demographic information (postcode, preferences) 
• Information provided in surveys, offers or bookings
• Recording of telephone calls (see section 2)

4. How We Use Your Data

We use your data to:

• Maintain internal records 
• Improve products and services
• Provide booking confirmations, pre and poststay communications (a legitimate interest allowed under GDPR/DUAA)
• Send marketing communications where you optin
• Conduct market research with your consent

5. Marketing Communications

We will send marketing messages (email, SMS, etc.) only where:

• You have opted in; or
• You are an existing customer who made a recent purchase and the message relates to similar services 
• You may withdraw consent at any time using the unsubscribe link or by contacting us.

6. Cookies & Tracking Technologies

We use cookies to:

• Operate and secure the website (strictly necessary cookies)
• Analyse website usage and improve our services
• Remember your preferences

Consent Requirements

Under PECR and UK GDPR, consent is required for nonessential cookies, and must be specific, informed and freely 

Under DUAA (2026), certain analytics, preference and securityrelated cookies now fall within broadened exemptions and do not require consent when strictly necessary for service improvement or security. 

You can manage cookie preferences through our cookie banner or your browser settings.

7. Data Security & Retention

We use physical, technical and organisational safeguards to protect personal data.

We keep personal data only as long as needed for legal, operational or transactional purposes, after which it is securely deleted. Legalobligation retention rules apply where relevant.

8. Your Data Protection Rights

Under UK GDPR, you have rights to:

• Access your data
• Correct inaccurate data
• Request erasure
• Object to processing (including marketing)
• Withdraw consent
• Request restriction of processing

9. Sharing Your Information

We do not sell your data.
We may share data with:

• Service providers who securely process data on our behalf
• Authorities where legally required

10. External Links

We are not responsible for the privacy practices of external sites linked from our website. 

11. Contact & Complaints

To exercise your rights or raise concerns:

Hotel Colessio Data Manager
33 Spittal Street
Stirling FK8 1DU
Scotland

You may also escalate unresolved complaints to the Information Commissioner’s Office (ICO) in line with UK GDPR and DUAA.