Privacy Policy
Privacy and Cookie Policy
Last updated: 8 November 2026
1. Who we are
AYLI Group Ltd, trading as AYLI (company number 16268621), registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, is the controller of the personal data described here. We run serviced apartments at 2 Marloes Road, Kensington, London W8 5LH, and the website ayli.co.uk and our booking website. Privacy questions: contact@ayli.co.uk, or write to the address above. We are registered with the Information Commissioner's Office, registration number ZC007732.
2. What we collect
- Booking details: name, email, phone, address, guest numbers, dates, suite, rate, extras, special requests, arrival time.
- Pre-check-in details for the lead guest and, where we ask, every other guest: full name, date of birth, nationality, address, and a photo of an identity document (passport, national identity card or UK driving licence) with its number, place of issue and expiry date; for guests who are not British or Irish, your next destination if known; your signature on our Terms of Occupation.
- Payment details: your card is handled by our payment provider; we receive only the card type, last four digits, expiry and the result of fraud checks. We never see or store your full card number.
- Messages you send us by email, SMS, WhatsApp, booking platforms or our booking pages. We record calls to our reservation line for quality, training and as a record of what was agreed; we tell you at the start of each call.
- Security data: CCTV images from entrances and shared areas (never inside suites) and the time and door of each electronic entry.
- Stay records: condition photographs taken at turnover and inspection, damage reports, deposit statements and complaints.
- Website data: device, browser and pages visited, through cookies where you allow them (section 10).
- From booking platforms: if you book through Booking.com, Airbnb or another platform, it sends us your booking details and contact details (sometimes a masked email address).
3. Why we use it and our legal basis
| Purpose | Legal basis (UK GDPR) |
|---|---|
| Take and manage your booking, take payment and the deposit, give you access, provide your stay and answer you | Contract |
| Keep the guest register UK law requires (name and nationality of every guest aged 16+; passport details and next destination for guests who are not British or Irish) | Legal obligation |
| Keep booking, payment and VAT records | Legal obligation |
| Check identity and prevent fraud, keep guests, staff and the building safe, investigate incidents, recover money owed, defend claims and chargebacks | Legitimate interests |
| Operate CCTV, the door entry log and call recording | Legitimate interests |
| Improve our service and website using analytics | Consent (cookies) |
| Send offers and news by email | Consent, or as a previous guest about similar stays, with an opt-out in every email |
Where we rely on legitimate interests, we have weighed them against your rights; you may object (section 8).
4. Automated processing
The text on the identity document you upload is read automatically to fill in your details, and our team checks it. We make no decisions about you by automated means alone that have legal or similarly significant effects.
5. Who we share it with
We share only what each needs, under contracts that require them to protect it and use it only for us:
- our booking and property management system, our channel manager and our hosting and database providers;
- our payment provider, which also uses card data to prevent fraud as a controller in its own right;
- email, SMS, WhatsApp and messaging providers we use to contact you;
- the document-processing provider that reads your identity document;
- housekeeping and maintenance contractors (first names, suite and dates only);
- our professional advisers, insurers and, where money is owed, debt recovery agents;
- booking platforms, for bookings made through them (they are separate controllers with their own privacy policies);
- the police, the Home Office or other authorities where the law requires it or to prevent or detect crime;
- a buyer of our business, under the same protections.
We never sell your data.
6. International transfers
Some of our providers process data outside the UK, including in the United States. Where they do, the transfer is protected by UK adequacy regulations (including the UK-US data bridge) or by the UK International Data Transfer Agreement or Addendum. Ask us for details.
7. How long we keep it
| Data | Kept for |
|---|---|
| Guest register details | 12 months after departure |
| Identity document photo and pre-check-in details | 12 months after departure, longer only while needed for a claim, dispute or investigation |
| Condition photographs, damage reports, deposit statements | Until the deposit and any dispute or chargeback are settled, and at least 6 months after departure |
| Booking, payment and invoice records | 6 years after the end of the financial year |
| Messages with us | 2 years after departure |
| Call recordings | 12 months after departure, longer if needed for a complaint or dispute |
| CCTV images | 30 days, longer if needed for an incident |
| Door entry log | 90 days, longer if needed for an incident |
| Marketing preferences | Until you opt out; we then keep your email on a do-not-contact list |
| Website analytics | 14 months |
8. Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict or object to its use, or transfer it to you or someone else, and you can withdraw consent at any time. Some rights are limited where the law requires us to keep data (for example the guest register and tax records). Email contact@ayli.co.uk. There is no fee and we reply within one month. We may need to confirm your identity first.
If you are unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113.
9. Security and other guests' data
We protect data with access controls, encryption in transit and at rest, and staff access limited to what each role needs. If you give us details of other guests, you confirm they know and that you will show them this policy. We do not knowingly collect data from children except as part of a booking made by their parent or guardian.
10. Cookies
We use cookies and similar technologies on our websites. Strictly necessary cookies are always on; everything else is off until you agree in the cookie banner, and you can change your choice at any time from the cookie settings link in the footer.
| Type | What it does | Providers |
|---|---|---|
| Strictly necessary | Keep the booking and payment working, prevent payment fraud, remember your cookie choice | Our booking system, our payment provider |
| Analytics | Count visits and show how pages are used | Google Analytics |
| Maps | Show our location on a map | Google Maps |
11. Changes
We will post any change here with a new date, and tell guests with upcoming stays by email if it affects them materially.
Last updated: 9 November 2026