Privacy and Cookie Policy

1. Who we are

This Privacy & Cookie Policy describes how Shout Hotels Limited (“we”, “us”, “our”) collects, uses and protects personal data when you visit www.shouthotels.com (the “Site”).

We are the data controller for the personal data described in this policy.

Company: Shout Hotels Limited (registered in Scotland, company number SC767803)
Registered office: 11 Alexander Street, Clydebank, Scotland, G81 1SQ, United Kingdom
Contact for data-protection enquiries: info@shouthotels.com

2. Summary — what this policy covers

Shout Hotels is an independent travel-information site. We do not take bookings or payments. We process enquiries and page-update suggestions, use technical information to protect the Site, and use Google Analytics for limited cookieless measurement before you make a privacy choice, and for cookie-based analytics after you accept. Google Maps and YouTube embeds load automatically on relevant pages. On pages with an OpenStreetMap map, map images load from the OpenStreetMap Foundation as the map approaches the visible part of the page. Google reCAPTCHA runs when you open a suggestion form. Blog pages also use Google AdSense to fund our guides. These services, advertising partners and the booking platforms you visit have their own privacy policies.

Open Page preferences, then Privacy choices, to manage Analytics. On blog pages where Google's consent message applies, we also use its device-storage consent choice for Google Analytics. This is the choice to store and access information on your device. It updates the Analytics setting in our Privacy choices panel, so you do not need a second banner. Select Manage advertising choices to reopen Google's settings and review its storage, advertising purpose and partner choices. On other pages the Analytics banner remains available. Rejecting Analytics or withdrawing its choice stops further analytics measurement, including cookieless measurement, until you change your choice or it expires. A later rejection in our panel stays effective unless you make a new device-storage choice in Google's message or change Analytics in our panel. Our Analytics buttons do not grant or withdraw advertising consent. Suggestion security checks are separate.

3. Personal data we collect

We collect the following categories of personal data:

Information you give us directly — for example, when you email us at info@shouthotels.com, we receive your email address, your name (if provided) and the contents of your message.
Information collected automatically when you visit the Site — including your IP address, approximate location (city/country), device type, browser type and version, operating system, the pages you view, the time and duration of your visit, the referring URL, and similar technical data.
Page-update suggestions — your message, the page it concerns, the submission date and time, a submission reference, the IP address observed by our server, and the browser/device information supplied by your browser (the User-Agent).
Cookies and similar technologies — see Section 7 below.

Under UK GDPR, IP addresses, online identifiers and behavioural data can be personal data even when we do not know your name.

When you suggest a page update

We store your suggestion privately and send a notification, including the recorded IP address and browser information, to info@shouthotels.com for our review. We use your message to assess whether the page needs correcting. We use the accompanying technical information to detect and prevent spam, repeated submissions and other abuse, investigate misuse, and protect the Site and our visitors.

Our lawful basis for these purposes is our legitimate interests in keeping our information accurate and operating a secure, reliable suggestion service (Article 6(1)(f) of the UK GDPR). These details are not published with a suggestion or used by us to advertise to you. We do not use the recorded suggestion IP address to infer your identity or location. Please do not include sensitive personal information or unnecessary details about yourself or anyone else in your message.

Google reCAPTCHA checks the form for automated abuse when you open it. Google may process IP addresses, browser/device information and interaction data under its own Privacy Policy and Terms of Service. This is separate from the information we retain with your suggestion.

Your right to object: you can object to our use of suggestion information based on legitimate interests by emailing info@shouthotels.com. You can also request access, correction or deletion, subject to the applicable conditions described in Section 9.

4. How we use personal data and our lawful basis

We process personal data on the following lawful bases under Article 6 of the UK GDPR:

Consent (Art. 6(1)(a)) — for optional analytics cookies and, where required, advertising storage and the use of personal data for personalised advertising. Analytics choices use our banner or Privacy choices, and Google's certified consent message on blog pages where it applies. Google's message also manages advertising choices. You can change or withdraw either through the respective controls described in Section 7. See Section 7 for automatically loaded third-party services.
Legitimate interests (Art. 6(1)(f)) — for limited cookieless statistical measurement before a privacy choice, to understand how our guides are used and improve the Site. We do not use this measurement for personalised advertising. You can object free of charge through Reject or Privacy choices; this stops further analytics measurement. We do not send suggestion text, submitter IP or browser records, URL query strings, or URL fragments as analytics event parameters. Google processes technical information when its tag connects; see its privacy policy below.
Legitimate interests (Art. 6(1)(f)) — to operate, secure and improve the Site, to detect and prevent fraud and abuse, and to respond to enquiries. We balance these interests against your rights and freedoms; you have the right to object (see Section 9).
Legal obligation (Art. 6(1)(c)) — to comply with applicable law, including responding to lawful requests from regulators or law-enforcement bodies.

5. Who we share personal data with

We use the following providers and platforms. Advertising partners may also receive data as described below. Their roles depend on the service; some process data for their own purposes under their own privacy policies:

OpenStreetMap Foundation — supplies map images on pages that use OpenStreetMap. Your browser connects to its tile servers and sends technical request information, including your IP address, browser information and the referring site. Map images are delivered through a global cache network. This map display is separate from the analytics choice; we do not request your device location or send a live walking-route request. See the OpenStreetMap Foundation privacy policy.
Google LLC (Google Analytics) — for measurement of Site traffic and usage. Google's privacy policy: policies.google.com/privacy.
Google AdSense and advertising partners — for advertising on blog pages, ad delivery and measurement, and fraud prevention. Information may include IP address, page URL, browser/device information, advertising identifiers and interactions. Personalisation and advertising storage depend on your choices and applicable requirements. Google's message lists the relevant partners, purposes and links to their privacy information. See how Google uses information from sites using its services and Google's Privacy Policy.
Booking.com B.V. — when you click a “Check Availability” or “Book” link, you are redirected to Booking.com which receives your visit and applies its own privacy policy: booking.com/content/privacy.en-gb.html.
Agoda Company Pte. Ltd. — on the small number of property pages that link to Agoda rather than Booking.com, clicking a booking link redirects you to Agoda, which receives your visit and applies its own privacy policy: agoda.com/info/privacy.html.
Google Maps and YouTube (Google LLC) — embedded maps and videos load automatically on relevant pages. Google may receive technical information when these services load or you interact with them, and may use cookies or similar technologies under its Privacy Policy. YouTube terms: youtube.com/t/terms.
Google reCAPTCHA (Google LLC) — helps protect suggestion forms from automated abuse. See the page-update suggestions explanation in Section 3.
Shout Hotels privacy controls — store your Analytics and reading-tool choices in your browser. Google's certified consent system records and communicates advertising choices to participating providers. On blog pages where its message applies, we also use its device-storage consent choice for Analytics and reflect that choice in our privacy controls. Our Analytics checkbox does not grant advertising consent.
Our hosting provider (SiteGround) — server logs (IP, request URL, timestamp, response code) are written for security and operational purposes and retained for a limited period.
Website hosting and email providers — host the Site, store private suggestion records, and deliver and store suggestion notifications in our mailbox. Access to these records is limited to those who need it for review, delivery or security.

When you click a booking link we attach a partner code to the web address so the booking platform knows you came from this Site. That code identifies us, not you. We do not add your name, email address or any other personal information to these links, and we do not pass any personal information about you to the booking platform. Once you arrive there you are on their service, and what they collect is governed by their own privacy policy.

We may also disclose personal data where required by law, in response to a lawful request by a public authority, or to protect our rights, your safety or the safety of others.

6. International transfers

Several of the services above (Google, YouTube, Booking.com, etc.) are operated by companies whose servers are located outside the United Kingdom — including in the European Economic Area and the United States. When personal data is transferred outside the UK, we rely on one of the following safeguards:

Adequacy decisions made by the UK Government for the destination country (where applicable).
UK International Data Transfer Agreements or the UK Addendum to the EU Standard Contractual Clauses, as published by the Information Commissioner's Office (ICO).
The recipient's own approved transfer mechanism (e.g. Google's UK SCCs).

You can ask us for further details of the safeguards in place by emailing info@shouthotels.com.

7. Cookies and similar technologies

A cookie is a small text file stored in your browser when you visit a website. Cookies are used to make the Site work, to remember preferences, and to measure usage.

The Site uses the following browser storage and services:

Preferences and security — browser storage remembers your privacy and reading-tool choices. Security checks and temporary form records help prevent automated or repeated abuse.
Statistics / analytics — Google Analytics uses Advanced Consent Mode. Before you choose, its tag loads with analytics and advertising storage denied and can send limited cookieless measurement to Google to help us understand and improve the Site. This may include the page viewed, time, consent state and technical connection or device information. Cookieless does not mean that no information reaches Google. Analytics cookies are enabled only after you accept Analytics through our controls or give device-storage consent in Google's message, which we also use for Analytics. Rejecting analytics or withdrawing consent stops further measurement. Advertising storage, advertising user-data consent, ad personalisation and Google Signals remain off for this Analytics integration. AdSense has its own separate advertising consent controls.
Advertising on blog pages — AdSense code loads when the page opens. In the UK, EEA and Switzerland, Google's certified message offers Consent, Do not consent and Manage options, including device-storage consent, which we also use for Analytics, as well as advertising purpose and partner choices. You can review storage, advertising purposes and partners in Manage options. Personalised ads require the relevant consent. Non-personalised ads can still require advertising storage consent. Depending on your choices and available demand, limited ads may be served; these can still process connection information and use fraud-prevention storage. Declining does not stop you reading our guides and does not guarantee that every ad disappears. See Google's explanation of limited ads.
Automatically loaded third-party services — Google Maps and YouTube on relevant pages, OpenStreetMap tile images as its map approaches the visible part of the page, and Google reCAPTCHA when you open a suggestion form. These services may process technical information and use their own cookies or similar technologies. They are not controlled by the analytics choice. Booking-platform cookies are governed by that platform when you follow a booking link.

You can:

Adjust or withdraw Analytics at any time through Page preferences → Privacy choices. Select Reject analytics, save with Analytics switched off, or Withdraw analytics choice to stop further measurement. This Analytics choice is remembered for 60 days. On a blog page, select Manage advertising choices in the same panel, or the Advertising privacy choices link beside the adverts, to change or withdraw advertising consent in Google's settings when available in your region. Changing the device-storage choice in Google's message also updates our Analytics setting. You can review partners and purposes there. The Analytics buttons in our panel do not accept, reject or withdraw advertising consent.
Delete or block cookies in your browser settings — note that the Site may not function fully if essential cookies are blocked.
Opt out of Google Analytics across all sites at tools.google.com/dlpage/gaoptout.

8. How long we keep personal data

Email correspondence: retained for as long as necessary to handle your enquiry and for a reasonable period afterwards (typically up to 24 months) for record-keeping, then deleted.
Suggestion records and associated IP/browser details: we determine retention according to the time needed to assess and follow up the proposed correction, resolve any related dispute, and investigate or prevent related abuse. We keep identifiable details only while needed for these purposes or a legal obligation. This covers private submission records and copies in our mailbox; it is not an indefinite retention period.
Server logs: retained for up to 90 days for security and troubleshooting purposes, then deleted or anonymised.
Analytics data (Google Analytics): retained according to the configured Google Analytics retention settings.
Privacy-choice records: our Analytics record expires after 60 days and can be changed or withdrawn earlier through Privacy choices. Google's consent system stores its own consent records where its message applies. We also use its device-storage choice for Analytics. These Google choices can be changed or withdrawn using Manage advertising choices on a blog page. Google and the listed advertising providers describe their storage and retention in their privacy information; the 60-day Analytics period does not apply to those records. Browser settings also let you remove stored cookies and site data.

9. Your rights under UK GDPR

If we hold personal data about you, you have the following rights, subject to the conditions set out in the UK GDPR and the Data Protection Act 2018:

Right of access — to ask for a copy of the personal data we hold about you.
Right to rectification — to ask us to correct inaccurate or incomplete personal data.
Right to erasure (“right to be forgotten”) — to ask us to delete personal data in certain circumstances.
Right to restriction of processing — to ask us to limit how we use your personal data in certain circumstances.
Right to data portability — to receive personal data you have provided to us in a structured, commonly used, machine-readable format.
Right to object — to object to processing carried out on the basis of legitimate interests, or to direct marketing.
Right to withdraw consent — where we rely on your consent, you can withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, email info@shouthotels.com. We will respond within one calendar month, in line with UK GDPR.

If you are not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

Website: ico.org.uk/make-a-complaint
Helpline: 0303 123 1113

10. Security

We use appropriate technical and organisational measures to protect personal data from unauthorised access, accidental loss, alteration or destruction. These include HTTPS encryption across the Site, server-side safeguards, validated form submissions, rate limits, reCAPTCHA checks and private storage for suggestions. No system is 100% secure; if a personal-data breach occurs and is likely to result in a risk to your rights, we will notify the ICO and (where required by law) affected individuals.

Privacy & Cookie Policy