1. Data Controller Identity & United Kingdom Scope
This Privacy Policy governs the collection, storage, processing, and protection of personal data across the digital domain achesoncolloids.com (operated under the brand name achesoncolloids) and its associated United Kingdom hospitality, dining, and gaming operations. For the purposes of the United Kingdom General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018 ("DPA 2018"), the primary Data Controller is Acheson Colloids Hospitality & Sanctuary Holdings Ltd, having its registered administrative office at Prince Rock Heritage House, 14 St. James's Square, Westminster, London SW1Y 4JU, United Kingdom, operating in partnership with Heliot Steak House at The Hippodrome Casino, Cranbourn Street, Leicester Square, London WC2H 7JH.
Our appointed UK Data Protection Officer ("DPO") oversees compliance with all statutory privacy obligations and may be contacted directly via electronic mail at [email protected] or by telephone on +44 20 7769 8888.
2. Statutory Framework (UK GDPR, DPA 2018 & PECR 2003)
All personal data processing conducted via achesoncolloids.com adheres strictly to the domestic legal framework of England and Wales, comprising:
- The United Kingdom General Data Protection Regulation (Retained Regulation (EU) 2016/679 as amended by the Data Protection, Privacy and Electronic Communications Regulations 2019);
- The Data Protection Act 2018 (c. 12) enacted by the Parliament of the United Kingdom;
- The Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR") as amended;
- The Gambling Act 2005 and the Licence Conditions and Codes of Practice ("LCCP") issued by the UK Gambling Commission ("UKGC").
3. Categories of Personal Data Collected
Depending on how you interact with achesoncolloids.com, our Westminster Sanctuary Suites, or Heliot Steak House at Cranbourn Street, we collect the following structured categories of personal data:
- Identity & Age Verification Data: Full legal name, title, date of birth, and photographic identification metrics verified under our mandatory Challenge 25 admission protocol;
- Contact & Concierge Lead Data: UK or international email address, telephone number, residential postcode, and preferred contact windows submitted through our Lead Test reservation forms;
- Hospitality & Booking Data: Arrival dates, party size, Heliot Steak House table
allocation preferences, suite category selections, and generated booking reference codes (e.g.,
AC-UK-XXXXXX); - Technical & Device Telemetry: Internet Protocol (IP) address, browser user-agent string, viewport resolution, time-zone offset, and local storage consent flags.
4. Heliot Steak House Reservations & Special Category Dietary Data
When you submit a reservation request for Heliot Steak House at The Hippodrome Casino (Cranbourn Street, London WC2H 7JH), you may voluntarily disclose food allergies, religious dietary observances, or medical intolerances in the concierge notes field. Under Article 9 of the UK GDPR, information concerning health or religious beliefs may constitute Special Category Data.
We process such dietary disclosures solely on the basis of your explicit consent (Article 9(2)(a) UK GDPR) and solely for the purpose of safeguarding your culinary wellbeing in our kitchen and private dining rooms. Dietary notes are purged within thirty (30) days following completion of your dining visit.
5. Westminster Sanctuary Hotel Suite Registration Records
Pursuant to the Immigration (Hotel Records) Order 1972 applicable in the United Kingdom, all overnight guests aged 16 or over staying at our Westminster Sanctuary Suites (14 St. James's Square, London SW1Y 4JU — though our house policy restricts occupancy strictly to adults aged 18+) are legally required to register their full name and nationality. Foreign nationals must additionally provide their passport or identity document number and next destination. These statutory hotel register records are retained securely for a minimum period of twelve (12) months and made available only to authorised UK law enforcement officers upon lawful statutory demand.
6. Casino Admission, Challenge 25 & Photographic ID Verification
Because Heliot Steak House and the Cranbourn Street gaming rotunda operate within a licensed United Kingdom land-based casino venue, admission is strictly prohibited to anyone under the age of 18. At the door reception on Cranbourn Street, electronic document scanners may verify the authenticity of your Passport, UK Photocard Driving Licence, or PASS card and cross-reference the SENSE (Self-Enrolment National Self-Exclusion) land-based casino register.
7. Lawful Bases for Processing Under Article 6 UK GDPR
We never process personal data without a documented lawful basis under Article 6(1) of the UK GDPR:
- Performance of a Contract — Article 6(1)(b): Processing your name, email, telephone number, and booking preferences to confirm and fulfil your Heliot Steak House table reservation or Westminster Sanctuary Suite stay;
- Compliance with a Legal Obligation — Article 6(1)(c): Enforcing 18+ age verification under the UK Gambling Act 2005, maintaining statutory hotel registers, and fulfilling anti-money laundering checks;
- Legitimate Interests — Article 6(1)(f): Maintaining network security, preventing fraudulent booking submissions, and preserving the physical safety of guests via CCTV across Cranbourn Street and St. James's Square;
- Consent — Article 6(1)(a): Storing non-essential analytical cookies or dispatching bespoke gastronomic invitations where you have actively opted in.
8. Informational Hotel & Venue Overview — Zero Online Wagering Data
achesoncolloids.com operates strictly as an informational hotel, spa, restaurant, and land-based casino floor overview and concierge booking portal. We do not host online gambling games, do not open remote betting accounts, and do not collect online wagering or payment card deposits through this website.
9. Anti-Money Laundering (AML), Source of Funds & UKGC Reporting
For guests participating in physical real-money gaming on the premises at Cranbourn Street, The Hippodrome Casino is a regulated entity under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017. Where statutory thresholds are met, enhanced customer due diligence ("EDD") and source-of-funds verification records are collected and held under strict statutory confidentiality.
10. Automated Browser Storage & Cookie Identifiers
To comply with UK age-gating laws and PECR 2003 without intruding on your privacy,
achesoncolloids.com stores two primary first-party keys in your browser's local storage:
achesoncolloids_uk_age_verified_v1 (recording that you have confirmed you are aged 18 or
older) and achesoncolloids_uk_cookie_consent_v1 (recording whether you selected "Accept All
Cookies" or "Essential Only"). Full technical specifications are set out in our separate 15-clause Cookie Policy.
11. Authorised Recipients, Venue Partners & Sub-Processors
We do not sell, rent, or trade your personal data to third-party data brokers or external marketing lists. Personal data is shared strictly on a need-to-know basis with:
- The reception maitre d' desk at Heliot Steak House at The Hippodrome Casino to honour your dining reservation;
- Our Westminster Sanctuary Suite front-of-house concierge team at St. James's Square;
- Vetted UK-hosted cloud infrastructure providers bound by written Article 28 Data Processing Agreements;
- Statutory bodies including the UK Information Commissioner's Office ("ICO"), the UK Gambling Commission, and HM Revenue & Customs where required by law.
12. International Data Transfers & UK Adequacy Safeguards
All primary reservation databases and web servers for achesoncolloids.com are hosted within the United Kingdom and the European Economic Area (which benefits from UK adequacy regulations). In the event any technical sub-processor processes data outside the UK or EEA, we enforce the UK International Data Transfer Agreement ("IDTA") or the UK Addendum to the EU Standard Contractual Clauses approved by the Information Commissioner's Office.
13. Data Retention Schedules & Secure Destruction
We retain personal data only for as long as necessary to fulfil the specific purpose for which it was collected:
- Concierge & Heliot Dining Lead Inquiries: Retained for twelve (12) months from the date of your visit or inquiry, then permanently anonymised;
- Statutory Hotel Guest Registers: Retained for exactly twelve (12) months under the Immigration (Hotel Records) Order 1972;
- Financial & AML Compliance Records: Retained for five (5) to seven (7) years in accordance with HM Revenue & Customs and Money Laundering Regulations 2017 mandates;
- Premises CCTV Footage: Overwritten automatically after thirty-one (31) days unless preserved for an active Westminster City Council or Metropolitan Police investigation.
14. Technical, Organisational & Cryptographic Safeguards
In accordance with Article 32 of the UK GDPR, achesoncolloids.com enforces Transport Layer Security (TLS 1.3) encryption across all data in transit, AES-256 encryption at rest, strict Content Security Policy headers, role-based access control ("RBAC") with multi-factor authentication for concierge staff, and regular penetration testing of our web infrastructure.
15. Your UK Data Subject Rights & Right to Complain to the ICO
Under Chapter III of the UK GDPR, you possess enforceable statutory rights over your personal data:
- Right of Access (Article 15): Obtain a complete copy of the personal data we hold about you via a Subject Access Request ("SAR") free of charge within one calendar month;
- Right to Rectification (Article 16): Request immediate correction of inaccurate or incomplete contact or booking details;
- Right to Erasure (Article 17): Request deletion of personal data where no overriding statutory retention obligation applies;
- Right to Restriction & Objection (Articles 18 & 21): Restrict processing or object to processing based on legitimate interests;
- Right to Data Portability (Article 20): Receive your provided data in a structured, machine-readable format.
To exercise any of these rights, email [email protected]. You also have the statutory right to lodge a complaint at any time with the UK supervisory authority: Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom (Telephone: 0303 123 1113 • Website: ico.org.uk).