Privacy Policy

Last Updated: Sep 01, 2022

For our Cookies Notice please click here.

PRIVACY NOTICE & COOKIES POLICY

Certain terms used in this Privacy Notice are defined in our terms and conditions, which you can find here. The rules of interpretation in paragraph 1.2 of our terms and conditions also apply to this Privacy Notice.

1. We are the Controller in respect of your personal data. We are Gold Tree Hospitality UK Limited (a UK company with registration number 14183035) and our subsidiaries from time to timeoffering Reservations, Sales & Marketing and Operational services for apartments all under the KULA brand (and in this Privacy Notice, such companies are referred to together as “Kula” or “We”). The type of personal data that we will collect from you when you use our services includes:

Your full name, contact information such as mobile number, email address, home address, nationality; and we might collect your birthdate details.
Details of other people who are in your 'party' if you make a booking, and for whom you must have their agreement to you providing us with their data.
Your identity data (such as passport or identification card details), your flight/train details and if you are making payment, we might collect your payment details.
Your booking details - locations, dates, and any special requirements notified to us.

The above is information without which we might be unable to provide services to you.

2. We might also collect information about you from third parties. This will be so when:

(a) you make a booking, as we use third party booking engines, it will provide your personal data to us;

(b) the Apartment is owned by a Network Third-party Supplier (as defined in our Terms & Conditions) and that company provides your details and those of Guests to us.

When you pay us, you provide your payment information to a third party payments platform, and we do not see your payment details.

Third parties that we receive personal data from may include:

Travel agents, booking agents, other agents (including without limitation online travel agencies), tour operators and schools;
Corporate customers and public information sources such as Companies House or similar registers in the jurisdictions of our operations;
Comparison and review websites;
Social networks;
Car park operators;
Business Account management operators;
Market researchers;
Marketing service providers and advertising technology providers;
Government and law enforcement agencies;
Other licensees in accordance with licensing requirements;
Other hotel providers and other organisations as part of their contingency plans;
Guest communication solution providers and channel managers solution providers; and
KULA group companies.

3. We are collecting your personal data for the following purpose(s):

A. To provide you with:

access to our website and/or our property management service provider (or booking partner) and to enable you to make or accept bookings, services we or other third parties provide and to make or receive payments;
the ability to communicate with us and with other users of the website and our Accommodation services or any other Services;
the ability to provide feedback;
the ability to create and operate an account with us.

B. To help us:

to verify your identity;
to help us improve our Services, and develop and market new products and services;
to carry out any requests made by you on our website or otherwise;
to investigate or settle inquiries or disputes;
to comply with any applicable laws, court order, other judicial process, or the requirements of a regulator;
to enforce our agreements with you;
to protect any of our rights, property or safety or those of any third parties, including our other customers and users of the Site and visitors to our hotels;
to provide support for the provision of our Services; and
to use the information as otherwise required or permitted by law.

C. In particular, we use your personal data for the following purposes:

We collect and hold personal data that you submit to us during your use of our website and/or through your purchase of our Services. We also may receive your personal data from third parties you have used to purchase our Services.

We use the contact and payment details you have provided to us or third parties so that we can fulfil the supply of Services you purchase, including but not limited to:

providing you with any information, products or services you request from us;
processing reservations, where we will ask for your name, mailing address, billing address, email address, telephone number, credit card information, arrival and departure dates, and airline frequent flyer (or any other applicable customer loyalty) programme information. We may also ask you to provide identification, e.g. your passport and details of your vehicle registration; and/or
processing your room preferences and any other special requests or needs.

With whom do we share your personal data for this purpose?

Your personal data will be shared within Kula and our Network Third-party Supplier (as defined in our Terms & Conditions) for the above purposes and with the following categories of third parties:

To verify card payments and process refunds – we may share your information with credit card companies and other payment providers.
To help us manage our customer relationships and fulfil our Services – we use a variety of third party vendors who provide us with systems and platforms to help us provide Services to you.
To manage aspects of our website – we use a variety of third party suppliers to help us operate features on our website or facilitate the delivery of any products and/or services purchased through our website.
To third party service providers engaged by Kula, which performance of services requires the access to and processing of Personal Data, in which case such third parties will act in the capacity of processors under the instructions of the Controller, and pursuant to data processing agreements in place.

Please note this list is non-exhaustive and there may be circumstances where we need to share personal data with other third parties in order to provide the Services to you.

What is our legal basis?

It is necessary for us to use your personal data to perform our obligations in accordance with any contract that we or a third party may have with you, and/or for the performance of legal obligations to which Kula is bound.

In the event that your Personal Data is used for marketing and promotion purposes such processing of your data will be subject to your prior consent or other lawful basis.

D. Customer services

Our Website, our properties and aparthotels and/or members of our group use various user interfaces to allow you to request information or provide general feedback about our Services. These may include printed and/or electronic enquiry forms. Contact information may be requested in each case, together with details of other personal data that is relevant to your customer service enquiry. This information is used in order to enable us to respond to your requests and feedback.

With whom do we share your personal data for this purpose? Your personal data will be shared within our group for the above purpose. We may share your personal data with third parties solely for this purpose.

What is our legal basis? It is in our legitimate interest to use your personal data in such a way to ensure that we provide the very best customer service we can to you.

E. Customer Insight and Analysis

We may analyse your contact details with other personal data that we observe about you from your interactions with our website, our email communications to you and/or by providing Services to you, such as the services you have purchased or viewed, or from your use of our properties’ wifi. Where you have given your consent (where lawfully required), we use cookies, log files and other technologies to collect personal data from the computer hardware and software you use to access the website, or from your mobile device. This includes the following:

an IP address to monitor website traffic and volume;
a session ID to track usage statistics on our website;
information regarding your personal or professional interests, demographics, buying habits, experiences with our products and contact preferences.

Our web pages contain and our emails may contain “cookies” or “pixel tags.” (“Tags”). Tags allow us to track receipt of an email to you, to count users that have visited a web page collect other types of aggregate information. In some of our email messages, we use a “click-through URL” linked to certain websites administered by us or on our behalf. We may track click-through data to assist in determining interest in particular topics and measure the effectiveness of these communications. Please see our Cookies Policy below for further information. This information is used to create profiles and insights about your purchase habits and the purchase habits of our other customers. Where we have your consent to do so, we will also use your location data for customer insight purposes.

By using this information, we are able to measure the effectiveness of our content and how visitors use our website and our Services. This allows us to learn what pages of our website are most attractive to our guests, which parts of our website are the most interesting and what kind of offers our registered users like to see. We also use this information:

to help us with the selection of future product and service lines, properties and websites design and to remember your preferences; and/or
for marketing purposes (see the marketing section below for further details).

With whom do we share your personal data for these purposes?

We share your personal data with a variety of third party service providers to assist us with customer insight analytics. These providers are described in our Cookies Policy below.

What is our legal basis? Where your personal information is completely anonymised, we do not require a legal basis to use it as the information will no longer constitute personal data that is regulated under data protection laws. Where your personal data is not in an anonymous form, the processing of your Personal Data as described in this section E. will be subject to your prior consent as stated above, or where it is in our legitimate interest to use your personal data in such a way to ensure that we provide the very best services to you and our other customers.

F. Marketing communications

We may carry out the following marketing activities using your personal data:

1. Email marketing

We use information that we observe about you from your interactions with our website, our email communications to you and/or by providing Services to you (see the Customer Insight and Analysis section above for further details of the information collected and how it is used) and/or your email address, to send you marketing communications by email, where you have consented to receive such marketing communications, or where we have another lawful basis to do so.

With whom do we share your personal data for these purposes? Your personal data will be shared within our group companies for the above purpose, and we share your personal data with a variety of third-party email marketing providers who assist us in delivering our email marketing campaigns to you.

What is our legal basis? Where your personal information is completely anonymised, we do not require a legal basis to use it as such information will no longer constitute personal data that is regulated under data protection laws. Where your personal data is not in an anonymous form, we will only use your personal data for marketing purposes and send you marketing communications via email where you have consented to receive such marketing communications, or where we have a lawful right to do so.

2. Online personalised advertising

With whom do we share your personal data for these purposes? Your personal data will be shared within our group for the above purpose, and we will share your personal data with a variety of third party service providers who assist us with our online personalised advertising campaigns. These providers are described in our Cookies Policy below.

What is our legal basis? Where your personal information is completely anonymised, we do not require a legal basis to use it as such information will no longer constitute personal data that is regulated under data protection laws. Where your personal data is not in an anonymous form, we will use your Personal Information if you grant us your prior consent thereto or where we have a lawful right to do so.

3. Social media remarketing

We use information that we observe about you from your interactions with our website, our email communications to you and/or by providing Services to you (see the Customer Insight and Analysis section above for more details of the information collected and how it is used) to provide you with personalised advertising on social media channels operated by Facebook, Instagram, Tik Tok, LinkedIn and/or Google where you are a registered user of such services. We do this using custom audiences, customer match and/or similar services. Please note that such activity is also subject to the privacy choices you have elected on such services.

With whom do we share your personal data for these purposes? Your personal data will be shared within our group for the above purpose and with the following categories of third parties: We share your email address with third party service providers who assist us with social media remarketing campaigns. Your encrypted email address is also shared by us or our third-party service providers with Facebook, Instagram, Tik Tok, LinkedIn and/or Google under the terms of their respective custom audiences, customer match and/or similar services.

What is our legal basis? Where your personal information is completely anonymised, we do not require a legal basis to use it as such information will no longer constitute personal data that is regulated under data protection laws. However, our collection and use of such anonymised personal information may be subject to other laws where your consent is required. Please see our Cookies Policy below for further details. Where your personal data is not in an anonymous form, it is in our legitimate interest to use your personal data for marketing purposes.

4. Social media insight Where you are a registered user of Facebook, Instagram, Tik Tok, or of a Google service:

We will use your email address in an encrypted format to enable Facebook and Google to find other registered users of their services that share similar interests to you based on:

information that we observe about you from your interactions with our website, our email communications to you and/or with our products and services in our properties (see the Customer Insight and Analysis section above for more details of the information collected and how it is used); and
the information Facebook, Instagram, Tik Tok and/or Google hold about you.

We do this using lookalike audiences, similar audiences and/or related services. Please note that such activity is subject to the privacy choices you have elected to make on such services.

With whom do we share your personal data for these purposes? Your personal data will be shared within our group for the above purpose and with the following categories of third parties:

To administer marketing campaigns – we share your email address with third party service providers who assist us with social media remarketing
To utilise social media platforms – your encrypted email address is also shared by us or our third party marketing consultancies with Facebook, Instagram, Tik Tok, LinkedIn and/or Google under the terms of their respective services, such as lookalike audiences and/or similar audience services.

What is our legal basis? Where your personal information is completely anonymised, we do not require a legal basis to use it as such information will no longer constitute personal data that is regulated under data protection laws. Where your personal data is not in an anonymous form, we will use your Personal Information if you grant us your prior consent thereto or if we have another lawful basis.

5. Prize draws, prize competitions and other promotions.

From time to time, we may run prize draws, prize competitions and other promotions on our website, through our or our group companies’ social media accounts, and/or properties. For the purposes of administering such promotions, we may process your name, contact details (including email address, postal address and/or telephone number), social media handle (if relevant) and any other personal data volunteered by you in your promotion entry.

With whom do we share your personal data for this purpose? Your personal data will be shared within our group for the above purpose, and we may share your personal data collected in connection with any prize draws, prize competitions and other promotions that we run with third party providers that assist us with the administration of such promotions from time to time.

What is our legal basis? It is necessary for us to use your personal data to perform our obligations in accordance with any contract that we may have with you (e.g., the terms and conditions applicable to the promotion). The use of your personal data to enable you to participate in any prize draws, prize competitions and other promotions will be subject to your prior consent.

G. Careers

We may collect personal data in order to consider and process any enquiries or applications regarding our employment opportunities. We collect and maintain personal data that you voluntarily submit to us or which we collect from third party recruitment agencies for this purpose. The information that we collect may include your name, contact details, education details, and any other information that you include on your CV, résumé and any cover letter. Where you apply for a vacancy using LinkedIn, we may collect any information you make publicly available through LinkedIn. We also may use this information in order to communicate with you about your application.

With whom do we share your personal data for this purpose? We may share your personal data with third party service providers who assist us to match applicants with job vacancies.

What is our legal basis? It is in our legitimate business interests to use the information you provide to us when you apply for a job vacancy for the purposes described above.

H. Business administration and legal compliance.

We use your personal data for the following business administration and legal compliance purposes:

to comply with our legal obligations;
to enforce our legal rights;
to protect rights of third parties; and
in connection with a business transition, such as a merger, acquisition by another company, sale of all or a portion of our assets or admission or listing of our shares on a recognised investment exchange.

With whom do we share your personal data for these purposes? Your personal data will be shared within our group for the above purpose and we will share your personal data with third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this Privacy Policy. We will share your personal data with professional advisers such as lawyers and accountants, brokers, financial institutions, our insurers and/or governmental or regulatory authorities.

What is our legal basis? Where we use your personal data in connection with a business transition, enforcing our legal rights, or to protect the rights of third parties, it is in our legitimate interest to do so. For all other purposes described in this section, it is our legal obligation to use your personal data to comply with any legal obligations imposed upon us, such as a court order.

4. Unless otherwise stated, the legal basis for processing your personal data is that we have a legitimate interest in processing your personal data, which we have carefully considered relative to your rights and freedoms, and which we consider entitles us to process that personal data.

5. The legitimate interest being pursued is that of operating our business, providing you our services, and providing you with this platform.

6. The recipients or categories of recipients of your personal data are:

If you make a booking via our service, we will provide your details to our employees, consultants, agents or other third-party service providers who will be providing you with the services before, during and after your stay, for example, our ‘meet and greet’ team.

I. Overseas transfers of personal data:

a. Due to the global nature of our business and that of our third-party suppliers who process your personal data on our behalf, personal data that we collect from you may be transferred, processed and stored overseas including (where applicable) outside the jurisdiction where the personal data is collected.

b. Although the data protection laws of these other countries may not be as comprehensive as those in your own, we will take all necessary steps to ensure that your personal data is treated securely, and in accordance with this Privacy Notice and any applicable laws.

c. In particular, where your personal data is transferred from one jurisdiction such as the EU to a jurisdiction outside of it, we will comply with our legal and regulatory obligations (and will ensure that our third party suppliers comply with their obligations) in relation to the personal data, including having a lawful basis for transferring personal data and putting appropriate safeguards in place to ensure an adequate level of protection for the personal data. The use of personal data transferred shall (where applicable) be governed by contracts incorporating EU approved standard contractual clauses or the transfer shall be subject to another lawful transfer mechanism.-

II. The personal data will be stored for no more than 20 years from the date of the completion or cancelation of the relevant Booking Agreement.

III. You have the right to request from us access to and rectification or erasure of personal data or to restriction of processing concerning you or to object to our processing of the data as well as the right to data portability. Please contact us at legal@staykula.com.

In this regard, please note as follows:

a. In line with its legal obligations to comply with applicable immigration laws, Kula has to store certain personal data for a period of 1 year, which includes the following data of its guests that are foreign citizens: Name; Date of birth; Nationality; Country of residence; Identification number/Passport and its issuing entity/country.

b. Kula is also bound to comply with the data / documents storage obligations arising from tax legislation, that requires retention of all the documents and data needed to evidence compliance with tax obligations, for a period of 10 years. This legal requirement entails the storage obligation of general financial or accounting documents, such as books, records and any supporting documentation, ie. orders/reservations, invoices, which may include the following data of Kula guests: identification data, contact details and tax data, such as name, address, ID and taxpayer number.

c. Kula is also bound to comply with the data / documents storage obligations arising from the need to prove that it has acted in accordance with relevant privacy laws. For that reason, the communications on any request for erasure, restriction or data portability will be kept, due to the requirement of retention of all the documents and data that are needed to make evidence of compliance with obligations in the capacity of data controller under the GDPR, for a period of 10 years, starting from the end of the calendar year of request for erasure, restriction or data portability information.

d. Therefore, Kula will duly comply with the above legal obligations and any other legal obligation by which it is bound, and therefore keep the storage such data for the timelines specified, after which it will proceed with any requested erasure or restriction relating to the personal data.

7. We do not generally rely on your consent to process data. However, if we are relying on your consent to process data, you may withdraw your consent at any time by notice to us.

8. You have the right to complain to the relevant regulator about the manner in which or otherwise in respect of the manner in which we process your personal data. The relevant regulator is:

If you are in Australia: Office of the Australian Information Commissioner – Tel: 1300 363 992 (or if you are calling from outside Australia, +61 2 9284 9749)
If you are in the European Union: Comissão Nacional de Proteção de Dados – Email: geral@cnpd.pt
If you are anywhere else: the Information Commissioner's Office – website: https://ico.org.uk/global/contact-us/

9. Your provision of personal data to us is not a contractual or legal requirement. However, if you do not supply your personal data to us, there may be certain features of our service which we will not be able to provide to you, and you will not be able to make or accept bookings unless we have certain personal data for you.

10. We may provide our services in additional countries from time to time and we will update this Privacy Notice to reflect any such change.

11. We may amend this Privacy Notice at any time. If we do so, we will post the revised Privacy Notice with the "Updated” date at the foot of the Privacy Notice. Your continued use of the website and our services is subject to the updated Privacy Notice.

12. These are the Controller’s contact details:

Address: The Barbon Building, 15 Red Lion Square, London, England, WC1R 4QH.

Email: legal@staykula.com

Cookies Policy:

Kula uses cookies and similar technologies to help provide and improve the Kula Service. This Cookies Policy, in addition to the Kula Privacy Notice set out above, explains how (and why) we use these technologies and the choices you have.

Why do we use this technology?

We use this technology for various reasons, including:

to enable you to use and access the Kula website and its underlying services
to enable certain aspects of the Kula website to function as intended
to monitor and analyse the workings of and visitors’ use of the website
to assist in user navigation of the website
to serve advertising to users
to help prevent and detect fraud
to enable Kula to assess the performance of the website and its features

What are Cookies?

When you visit the Kula website we may place cookies on your device.

Cookies (and similar technology) are described as "a small file of letters and numbers or software labels that can be stored on your computer when you visit a website, through the browser. Cookies are used by many websites and can do a number of things, e.g. remembering your preferences, recording what you have put in your shopping basket, and counting the number of people looking at a website".

During a visit to the Kula website pages, files named "Cookies" may be placed on the user's computer. These Cookies allow you to tailor the web pages to the tastes and preferences of the user and present promotions and offers of products that may be of interest to you as a user. There are different types of cookies, such as: authentication cookies, tracking cookies; strictly necessary cookies.

In addition, where websites allow users to log in to services, authentication cookies are the most common method used by web servers to know whether a user is logged in or not.

Tracking cookies, and especially third-party tracking cookies, are commonly used as ways to compile long-term records of individuals' browsing histories.

The law distinguishes between "strictly necessary" cookies, such as those which enable websites to operate properly, or which allow purchases to be safely completed, and those which are not strictly necessary, such as tracking cookies, or cookies used for the purposes of web analytics.

Strictly necessary cookies help the website function and provide services that the website visitor expects, such as browsing web pages or accessing secure areas of the website. Without these cookies, the Kula website cannot function properly.

The storage or reading of certain cookies do not require the user's consent, because it does not require the processing of the user's personal data, either because they are strictly necessary for the provision of the service required by the user. We are allowed to place strictly necessary cookies on your device without your consent, as long as we inform you, such as by way of this notice, but for all other cookies we require your express consent. This is why we have a clear "cookie banner" when you land on our website, which allows you either to consent to receive these "non-necessary" cookies or decline them. In most Internet browsers these cookies can be easily removed or refused. You can change your permissions by selecting the desired settings in the browser.

There are two types of cookies used on the Kula website: (1) “session cookies” and (2) “persistent cookies.” Session cookies normally expire when you close your browser, while persistent cookies remain on your device after you close your browser and can be used again the next time you access the Kula website.

If you choose to remove or reject cookies or clear existing cookies, this might affect the features, availability and functionality of the Kula website. Blocking certain types of cookies or deleting them may affect the access to certain functions or pages of the website or make impossible, or inaccessible, certain services offered on the website, for which Kula cannot be held responsible.

The Kula website might from time to time use pixels, web beacons and other similar technologies. Kula might also from time to time use pixels and other similar technology in emails.

The pixels may record your online activity and can be used by our advertising partners to build a profile from your interests and display relevant advertising to you. You can reject this action by deleting advertising cookies through your browser settings, but your user experience is likely to be impaired.

Third Parties

The features of this website may use services provided by third parties, for example content disseminated on other pages and on social networks.

If you give your consent, these third parties may store cookies that will allow you to view the content hosted by these third parties directly at their website address or share our content.

Through these cookies, these third parties may collect and use your browsing data for their own purposes in accordance with their confidentiality policy.

The Kula website might allow third party cookies, such as analytics cookies from Facebook and Google to place cookies on visitors’ browsers.

The Kula website might offer sharing tools (such as Facebook or Twitter) - if you use these, the sharing tools for those sites set a variety of cookies.

Updated: September 2022