Privacy Policy

Last updated: 25 September 2026

Contents

1. Purpose and scope of this Privacy Notice

2. The personal data we collect

3. Children’s personal data

4. Personal data relating to other people

5. How we collect personal data

6. Failure to provide personal data

7. Our lawful bases

8. How we use personal data

9. Cookies and similar technologies

10. Competitions, prize draws and promotions

11. Mobile applications, rewards and order-and-pay services

12. Marketing and promotional communications

13. Profiling and automated decision-making

14. Sharing personal data

15. Business and property transfers

16. International data transfers

17. California residents

18. Retaining personal data

19. Data security

20. Your data protection rights

21. Data protection complaints

22. Keeping personal data accurate

23. Changes to this Privacy Notice

Introduction

This is the Privacy Notice of Apex Hotels Ltd, a company registered in Scotland under company number SC073489.

Our registered office is:

Apex Hotels Ltd
Apex Hotels House
1 Mid New Cultins
Edinburgh
EH11 4DH

Our VAT registration number is 974 8933 55.

In this Privacy Notice, “Apex Hotels”, “Apex”, “we”, “us” and “our” refer to Apex Hotels Ltd.

Apex Hotels is registered with the UK data protection regulator under registration number Z5739764.

For the purposes of applicable data protection law, Apex Hotels is normally the controller of the personal data described in this Privacy Notice. This means that we determine why and how personal data is processed.

Personal data means any information relating to an identified or identifiable living individual.

We are committed to respecting and protecting the privacy of our guests, customers, members, website and application users, restaurant and spa visitors, competition entrants and other individuals who interact with us.

We process personal data in accordance with applicable data protection and privacy legislation, including:

• the UK General Data Protection Regulation, referred to as the UK GDPR;

• the Data Protection Act 2018;

• the Data (Use and Access) Act 2025;

• the Privacy and Electronic Communications Regulations 2003, referred to as PECR; and

• other applicable data protection and privacy legislation.

Contacting us about data protection

Apex Hotels has appointed a Data Protection Officer who oversees compliance with data protection law and can be contacted regarding privacy concerns, data subject rights, or any questions about this Privacy Notice.

Where the EU General Data Protection Regulation applies to our activities, our European Union representative is:

Rickert Rechtsanwaltsgesellschaft mbH
Apex
Colmantstraße 15
53115 Bonn
Germany

Email: art-27-rep-apex@rickert.law

1. Purpose and scope of this Privacy Notice

This Privacy Notice explains:

• what personal data we collect;

• how we collect it;

• how and why we use it;

• the lawful bases on which we rely;

• who we may share it with;

• whether it may be transferred internationally;

• how long we retain it;

• how we protect it;

• the rights available to individuals; and

• how to raise a data protection concern or complaint.

This notice applies to personal data collected through:

• our Apex Hotels website;

• our mobile applications and online services;

• hotel, restaurant, spa, golf, leisure and event bookings;

• stays and visits at our hotels and other premises;

• membership and loyalty programmes;

• competitions, prize draws and promotions;

• marketing and guest communications;

• guest feedback and review platforms;

• guest Wi-Fi;

• telephone, email, correspondence and live-chat services; and

• other products or services provided by Apex Hotels.

You should read this notice together with any additional privacy information provided when we collect personal data for a particular service, activity or purpose.

2. The personal data we collect

The personal data we collect depends on how you interact with us.

Payment-card information may be processed by specialist payment providers acting on our behalf. We apply payment-security controls appropriate to the services being used.

2.1 Special-category personal data

In limited circumstances, we may need to process personal data that receives additional legal protection.

This may include information concerning:

• health conditions;

• disabilities or accessibility requirements;

• allergies;

• dietary requirements connected with health or medical needs;

• spa-treatment requirements;

• leisure-membership requirements; and

• other health-related information needed to provide a safe and appropriate service.

We will only request and process the minimum information necessary.

Where information is special-category personal data, we will identify:

• an appropriate lawful basis under Article 6 of the UK GDPR; and

• an appropriate condition under Article 9 of the UK GDPR and, where applicable, the Data Protection Act 2018.

Where practical, we will record the service requirement rather than unnecessary details about an underlying medical condition.

2.2 CCTV images

We operate CCTV at certain hotels and other premises for purposes including:

• protecting guests, employees, visitors and property;

• maintaining safety and security;

• preventing and detecting crime;

• investigating incidents; and

• establishing, exercising or defending legal claims.

CCTV recordings are retained for up to 28 days, unless particular footage needs to be retained for longer in connection with an incident, investigation, complaint, insurance matter or legal claim.

CCTV footage may be disclosed where required or permitted by law, including to:

• law-enforcement authorities;

• courts and regulators;

• insurers;

• legal advisers;

• security and investigation providers; and

• individuals exercising applicable data protection rights.

Any disclosure will be limited to what is necessary and lawful.

3. Children’s personal data

Apex Hotels does not generally collect personal data directly from children. However, we may process limited personal data relating to children where this is necessary to provide a service requested by a parent, guardian or responsible adult.

We do not routinely request or record children’s names as part of a family hotel booking.

A child’s first name may be provided by a parent, guardian or responsible adult where it is necessary to fulfil a specific request, such as:

• a restaurant reservation;

• a birthday or celebration arrangement;

• identifying the person to whom a dietary or allergen requirement relates; or

• providing another requested guest service.

Dietary requirements, allergen information, accessibility requirements or other relevant health-related information may be provided for a child at the time of booking or during a visit. This information may be recorded against the booking and may be accompanied by the child’s first name where this is necessary to provide the service safely.

Where a child joins a junior leisure membership, we collect:

• the child’s name;

• relevant membership information; and

• any necessary health, safety or service information.

The child’s membership is linked to the details of the parent or guardian responsible for it.

Guest Wi-Fi can be accessed without providing a name, email address or other directly identifying registration information. However, technical information associated with operating and securing the network may be processed automatically. This may include an IP address, device identifier, connection time and network-security information.

We do not process children’s personal data for entry into our competitions, prize draws or promotions.

Where we process children’s personal data, we:

• collect only the minimum information necessary;

• use it only for the relevant service, membership or safety purpose;

• take the child’s best interests and privacy rights into account;

• apply appropriate safeguards;

• restrict access to those who need the information; and

• retain the information only for as long as necessary.

4. Personal data relating to other people

If you make a booking, reservation or other arrangement for another person, you may provide us with that person’s personal data.

You should ensure that:

• you are authorised to provide the information;

• the information is accurate;

• the individual knows that you are providing their information to us; and

• the individual is directed to this Privacy Notice where appropriate.

The person concerned retains their individual rights under data protection law.

5. How we collect personal data

5.1 Information you provide directly

You may provide personal data when you:

• make an enquiry;

• make, amend or cancel a booking;

• stay at one of our hotels;

• visit a restaurant, bar, spa, golf course, leisure facility or other venue;

• purchase a product or service;

• buy or redeem a gift voucher;

• create an online account;

• subscribe to a service or publication;

• request marketing information;

• join Apex Insider;

• join a Yu Spa membership;

• join Meldrum Golf Club;

• enrol a child in a junior leisure membership;

• use our mobile application or order-and-pay service;

• complete a survey;

• leave a review or provide feedback;

• enter a competition, prize draw or promotion;

• contact us by post, telephone, email, live chat or social media;

• make a complaint; or

• exercise a data protection right.

5.2 Information collected automatically

When you use our websites, applications, guest Wi-Fi or other online services, we may collect technical and usage information automatically through:

• cookies;

• pixels;

• tags;

• scripts;

• software development kits;

• server logs; and

• similar storage and access technologies.

5.3 Information received from third parties

We may receive personal data from:

• online travel agents;

• travel agents and tour operators;

• hotel, restaurant, spa, golf and event-booking platforms;

• payment providers;

• gift-voucher providers;

• analytics providers;

• advertising networks;

• social-media platforms;

• review and guest-feedback platforms;

• loyalty and membership providers;

• corporate customers;

• event organisers;

• another person making a booking on your behalf;

• public authorities;

• law-enforcement authorities;

• fraud-prevention and security providers; and

• publicly available sources.

These providers may include Google, Microsoft Bing, Meta, Hotjar, Rakuten, ReviewPro, OpenTable, ResDiary and other platforms used to provide, measure or support our services.

6. Failure to provide personal data

In some circumstances, we need to collect personal data:

• to comply with a legal obligation;

• to enter into or perform a contract;

• to provide a requested service safely;

• to verify identity or eligibility; or

• to meet a dietary, accessibility or health-related requirement.

If you do not provide the required information, we may be unable to:

• complete a booking or transaction;

• provide a requested product or service;

• meet a dietary, accessibility or health-related requirement;

• verify your identity or eligibility;

• enter into or perform a contract; or

• comply with our legal obligations.

Where this applies, we will explain the consequences at the time.

7. Our lawful bases

We will only process personal data where we have a lawful basis.

Where we rely on legitimate interests, we consider:

• the purpose of the processing;

• whether the processing is necessary;

• your reasonable expectations;

• the nature of the information; and

• the effect on your rights and interests.

We may process the same personal data for more than one purpose or rely on more than one lawful basis, depending on the circumstances.

8. How we use personal data

8.1 Hotel guest-registration information

We collect information required under applicable hotel-record legislation.

The Immigration (Hotel Records) Order 1972 requires people aged 16 or over staying at relevant premises to provide their full name and nationality. Additional passport or identity-document information and next-destination information apply to individuals who fall within the further statutory category specified in the Order.

We may inspect a passport or other identification document where verification is required. We will not normally retain a copy unless retaining it is necessary and lawful.

8.2 Guest Wi-Fi

Guests can access Apex guest Wi-Fi without providing a name or email address.

Technical information may nevertheless be generated through use of the service, including:

• IP address;

• device identifier;

• network connection;

• date and time of connection;

• access point or approximate network location; and

• security and usage metadata.

We use this information to:

• operate and secure the network;

• diagnose technical faults;

• detect and prevent misuse;

• maintain network performance;

• prevent unlawful activity; and

• investigate security incidents.

8.3 Health, dietary, allergen and accessibility information

We may process relevant information to:

• protect health and safety;

• meet dietary or allergen requirements;

• provide accessible services;

• deliver spa treatments or leisure services safely;

• respond to emergencies; and

• make reasonable service arrangements.

Information about an allergy or health-related dietary need may constitute special-category personal data. We collect only the minimum information required to provide the requested service safely.

8.4 Membership and loyalty programmes

This includes:

• Apex Insider;

• Yu Spa;

• Meldrum Golf Club;

• junior leisure memberships; and

• other Apex membership or loyalty programmes.

We may use personal data to:

• register and administer memberships;

• authenticate access to member services;

• manage rewards and loyalty benefits;

• process payments;

• provide consistent and personalised service;

• administer online member accounts;

• notify members of changes to terms;

• manage renewals and cancellations;

• respond to enquiries and complaints; and

• record health information relevant to a treatment, leisure service or membership.

Where you join Apex Insider, Apex Hotels Ltd may use your membership information, booking and purchase history, preferences and interactions across the brands it operates, including Apex Hotels and Monogram Collective. We use this information to administer the programme, provide benefits, personalise your experience and, where permitted, send relevant marketing communications.

9. Cookies and similar technologies

We use cookies and similar technologies on our websites to:

• enable the websites to function;

• maintain security;

• remember settings and preferences;

• provide requested website features;

• understand how our websites are used;

• measure website performance;

• improve our online services; and

• support advertising and marketing where permitted.

Cookie choices

You can review or change your choices at any time by selecting Cookies at the bottom of our website.

We will manage cookies and similar technologies in accordance with applicable privacy and electronic communications laws. Where the law permits certain technologies to be used without consent, we will assess their use carefully and ensure appropriate safeguards are applied. Further information about cookies, providers, purposes and durations is available in our Cookie Policy.

10. Competitions, prize draws and promotions

We may collect and process personal data when an adult enters a competition, prize draw or promotional campaign operated by Apex Hotels.

We do not process children’s personal data for competition, prize draw or promotion entries.

10.1 Information collected and how it is used

We may also use the information to:

• prevent fraud or abuse;

• meet legal, tax, regulatory or audit requirements; and

• send marketing where you have separately agreed to receive it.

10.2 Lawful bases

We may rely on:

• performance of the competition terms;

• legitimate interests in administering the promotion and contacting winners;

• consent for optional marketing; and

• legal obligations relating to tax, advertising, audit or regulatory requirements.

10.3 Retention

10.4 International entrants

If you enter from outside the UK, your information may be transferred to and processed in the UK.

Where required, we will use an appropriate international-transfer safeguard or a permitted legal exception.

10.5 United States and California entrants

Where a promotion is open to residents of the United States, additional competition terms and local privacy information may apply.

Apex Hotels does not sell or share competition-related personal information as “sell” and “share” are defined under the California Consumer Privacy Act and California Privacy Rights Act.

If our practices change, we will update this notice and provide any rights and choices required by applicable law.

11. Mobile applications, rewards and order-and-pay services

We may provide:

• the Apex Hotels Rewards application;

• mobile guest applications;

• online order-and-pay solutions; and

• related services through our websites, the Apple App Store and Google Play.

These services may process information for:

• account creation and authentication;

• loyalty and rewards management;

• personalised content;

• guest communications;

• orders and payments;

• application security;

• application analytics; and

• notifications where enabled.

Additional terms or privacy information may apply to a particular application or service. Where there is a difference, the more specific privacy information will apply to that service.

Further information is available in our Terms and Conditions.

12. Marketing and promotional communications

12.1 Marketing from Apex Hotels

We may use identity, contact, transaction, profile, technical, usage and marketing data to understand which products, services and offers may be relevant to you.

We may send direct marketing where:

• you have given consent;

• the PECR soft opt-in requirements are met; or

• another lawful route applies to the communication.

The soft opt-in may apply where:

• we obtained your contact details during a sale or negotiations for a sale;

• we market our own similar products or services;

• you were given an opportunity to opt out when the information was collected; and

• an opt-out is included in each subsequent message.

Service messages are not direct marketing. These may include:

• booking confirmations;

• payment information;

• arrival instructions;

• important service updates;

• safety information;

• membership administration; and

• communications necessary to fulfil a reservation or contract.

12.2 Apex Hotels, Monogram Collective and Apex Insiders

Apex Insider is operated by Apex Hotels Ltd. Apex Hotels Ltd may use your membership information, booking history, preferences and interactions with us to administer your membership, provide benefits and rewards, personalise your experience and, where permitted by law and in accordance with your marketing preferences, send you information about products, services, experiences, offers and promotions available through the brands operated by Apex Hotels Ltd, including Apex Hotels and Monogram Collective.

When you join Apex Insider, we may use your membership information, contact details, booking and purchase history, preferences and interactions with us to:

• administer your Apex Insider membership;

• provide member benefits, rewards and offers;

• personalise your experience and the communications you receive;

• understand which hotels, experiences, products and services may be relevant to you; and

• send you news, offers and promotional communications relating to Apex Hotels and Monogram Collective, where permitted by law and in accordance with your marketing preferences.

You can change your marketing preferences or stop receiving direct marketing at any time by using the unsubscribe or preference link in a marketing email, updating your account preferences where available, or contacting marketing@apexhotels.co.uk.

Leaving Apex Insider or opting out of marketing will not prevent us from sending service communications that are necessary to administer an existing booking, transaction, membership or request.

12.3 Third-party marketing

We will obtain express opt-in consent before sharing personal data with an organisation outside Apex Hotels Ltd for that organisation’s own electronic marketing, unless another lawful exception applies.

12.4 Opting out

You can stop direct marketing at any time by:

• selecting the unsubscribe or preference link in a marketing email;

• changing your account preferences where available; or

• emailing marketing@apexhotels.co.uk.

Opting out of marketing will not prevent us from sending communications necessary for a booking, transaction, membership, service, safety matter or legal obligation.

We may keep limited information on a suppression list to ensure that we continue to respect your opt-out.

13. Profiling and automated decision-making

Profiling means using automated processing to evaluate personal aspects of an individual, such as interests, preferences or behaviour.

Solely automated decision-making means making a decision without meaningful human involvement.

We may use technology-assisted tools, including automated and artificial intelligence enabled technologies, to support customer services, operational administration, fraud prevention, security monitoring, service improvement and marketing analysis. These technologies are used to assist human decision-making and operational processes. We do not currently use solely automated decision-making that produces legal or similarly significant effects on individuals. The assisted tools are used to:

• identify potentially relevant products or offers;

• segment marketing audiences;

• understand customer preferences; and

• measure campaign engagement.

We do not currently use solely automated decision-making that produces legal or similarly significant effects on individuals in connection with the activities covered by this Privacy Notice.

If we introduce significant automated decision-making, we will provide information about:

• the decision being made;

• the information used;

• the logic involved;

• the significance and likely consequences;

• the lawful basis;

• any use of special-category data; and

• the safeguards available.

Where required, those safeguards will include the ability to:

• obtain meaningful human intervention;

• make representations;

• express your point of view; and

• challenge or contest the decision.

14. Sharing personal data

We may share personal data where necessary with:

• Apex hotels, venues and internal business functions;

• banks and payment processors;

• booking and reservation providers;

• online travel agents;

• travel agents and tour operators;

• restaurant, spa, golf, leisure and event-booking platforms;

• application and loyalty providers;

• gift-voucher providers;

• website, hosting and cloud-service providers;

• IT support and information-security providers;

• marketing, email and advertising providers;

• analytics and reporting providers;

• review and guest-feedback platforms;

• lawyers, auditors, accountants and other professional advisers;

• insurers;

• fraud-prevention and investigation providers;

• security providers;

• law-enforcement authorities;

• courts, regulators and public authorities;

• parties involved in a corporate, business or property transaction; and

• another recipient where you have asked us or consented to the disclosure.

Where required by law, Apex Hotels enters into written agreements with processors that contain the mandatory data protection provisions required under Article 28 UK GDPR. These agreements require processors to implement appropriate security measures, process personal data only on documented instructions, assist Apex Hotels in meeting its compliance obligations and support the protection of individual rights and will:

• act only on our documented instructions;

• protect personal data;

• maintain appropriate security;

• assist us with applicable data protection obligations; and

• delete or return the information in accordance with its contract.

We may provide third parties with aggregated or anonymised information that does not identify an individual.

We do not sell personal data.

15. Business and property transfers

Apex Hotels Ltd may buy, sell, restructure or transfer a business, hotel, property or other asset.

Where this occurs, relevant personal data may be disclosed to:

• a prospective buyer or seller;

• funders;

• insurers;

• professional advisers; and

• other parties involved in the proposed transaction.

Disclosure will be limited to what is reasonably necessary and subject to appropriate confidentiality and data protection controls.

If an Apex hotel or property is transferred to another operator, information relating to future reservations may be transferred so that:

• reservations can be honoured;

• guests can be contacted;

• contractual obligations can be fulfilled; and

• requested services can be provided.

If Apex Hotels Ltd, or substantially all of its assets, is acquired, relevant customer, employee, supplier, booking and transaction information may form part of the transferred assets.

Any recipient must have its own lawful basis for subsequent processing and provide appropriate privacy information where required.

16. International data transfers

Some recipients, service providers or systems may be located outside the UK.

Where a transfer is a restricted transfer under the UK GDPR, we will use an applicable transfer mechanism.

Where required, we assess the transfer and the protections available in the destination country.

A specific exception may apply where:

• you have explicitly consented after being informed of relevant risks;

• the transfer is necessary to perform a contract with you;

• the transfer is necessary for a contract made in your interests;

• the transfer is necessary for important reasons of public interest;

• the transfer is necessary to establish, exercise or defend a legal claim;

• the transfer is necessary to protect vital interests; or

• another applicable exception applies.

Copies of relevant transfer safeguards may be requested by contacting privacy@apexhotels.co.uk. Where necessary, commercially sensitive information may be redacted before disclosure.

17. California residents

Apex Hotels does not sell or share the personal information of California consumers as those terms are defined under the California Consumer Privacy Act and California Privacy Rights Act.

We do not exchange personal information for monetary or other valuable consideration.

If our practices change, we will update this Privacy Notice and provide the applicable rights and choices.

18. Retaining personal data

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected.

When determining the appropriate retention period, we consider:

• the amount and nature of the information;

• the sensitivity of the information;

• the purposes for which it is processed;

• whether the purpose can be achieved in another way;

• the risks arising from unauthorised use or disclosure;

• legal, regulatory, tax and accounting requirements;

• contractual requirements;

• relevant limitation periods; and

• regulatory guidance.

Relevant contractual, transaction and accounting records may normally be retained for up to seven years after the contractual relationship ends, unless a shorter or longer period is justified.

Marketing information will normally be retained for up to 36 months from the latest relevant interaction, consent or activity, unless:

• you opt out sooner;

• you withdraw consent;

• continued retention is no longer justified; or

• limited information must be retained on a suppression list.

Information may be retained for longer where necessary because of:

• an unresolved complaint;

• actual or anticipated litigation;

• an insurance matter;

• fraud or security concerns;

• a safeguarding matter;

• a regulatory investigation;

• a legal hold; or

• another legal obligation.

At the end of the retention period, information will be securely deleted, anonymised or placed beyond operational use.

Further information about retention periods can be requested from privacy@apexhotels.co.uk.

19. Data security

We maintain appropriate technical and organisational measures designed to protect personal data against:

• accidental or unlawful destruction;

• accidental loss;

• alteration;

• unauthorised disclosure;

• unauthorised access; and

• other unlawful processing.

Our measures may include:

• role-based access controls;

• authentication and password controls;

• encryption where appropriate;

• network and endpoint security;

• physical security;

• backup and recovery controls;

• monitoring and logging;

• supplier due diligence;

• contractual data protection requirements;

• policies and procedures;

• employee training; and

• incident-management procedures.

Access to personal data is restricted to people who need it for an authorised purpose.

Apex Hotels maintains incident management and personal data breach procedures designed to identify, assess, investigate and respond to security incidents. Where a personal data breach occurs, we will comply with our legal obligations, including notification to regulators and affected individuals where required by applicable law.

20. Your data protection rights

20.1 Subject access requests

When responding to a request for access, we will carry out searches that are reasonable and proportionate.

If we reasonably require clarification or further information to identify the information requested, the statutory response period may be paused in accordance with applicable law until that clarification is received.

20.2 Limitations on rights

Data protection rights are not absolute.

We may be unable to comply fully with a request where:

• continued processing is required by law;

• information must be retained for a legal claim;

• disclosure would adversely affect another person’s rights;

• a relevant legal exemption applies; or

• the request is manifestly unfounded or excessive.

20.3 Exercising your rights

You can exercise a right by contacting us:

We do not normally charge a fee.

We may charge a reasonable fee or refuse to act where a request is manifestly unfounded or excessive, as permitted by law.

We may ask for information to confirm your identity. We will request only what is reasonably necessary and proportionate.

If you make a request on someone else’s behalf, we may require evidence of your authority to act.

21. Data protection complaints

If you are concerned about how we have collected, used, disclosed, retained or otherwise processed your personal data, you may make a complaint to Apex Hotels.

You can submit your complaint electronically by emailing our Data Protection Department at privacy@apexhotels.co.uk. Selecting the email address will allow you to contact the department directly.

You can also contact us by telephone or post.

To help us investigate, please provide:

• your name and contact details;

• a description of your concern;

• relevant dates;

• the hotel, service, booking, system or communication involved;

• copies of relevant correspondence; and

• the outcome you are seeking.

We will:

• acknowledge receipt of your complaint within 30 days;

• take appropriate steps to investigate it;

• make appropriate enquiries;

• keep you informed where appropriate;

• respond without undue delay; and

• explain the outcome of our investigation.

A dedicated email address is an acceptable electronic route for making a data protection complaint. Organisations must provide a means to complain, acknowledge complaints within 30 days and respond without undue delay.

You also have the right to complain to the UK data protection regulator. You may do so whether or not you have first complained to us, although we would welcome the opportunity to resolve your concern directly.

Further information is available from the Information Commissioner’s Office.

22. Keeping personal data accurate

Please tell us if personal data you have provided changes or becomes inaccurate.

You can request a correction by emailing privacy@apexhotels.co.uk.

Where account facilities are available, you may also be able to update certain information online.

23. Changes to this Privacy Notice

We keep this Privacy Notice under regular review.

We may update it to reflect:

• changes to products or services;

• changes to systems or suppliers;

• changes to our processing activities;

• legal or regulatory developments;

• updated regulatory guidance; or

• improvements to the clarity of the notice.

The latest version will be published on our website.

Where a change materially affects how we use personal data, we will take reasonable steps to bring it to the attention of affected individuals.

For the Apex Hotels Ltd careers privacy notice, please see Terms & Conditions | Apex Hotels Careers.

Last updated: 25 September 2026