Privacy and cookies

Last updated: 13 October 2026

1. Who we are

15 New Street Trading Ltd, trading as City Rooms by Hiive (company number 16973194), is the controller of your personal data. Contact for privacy questions: our contact form or 01905 964700, or by post to 15 New Street, Worcester, WR1 2DP.

2. What we collect

• Booking details: name, email, phone number, address, dates, room, number of guests, special requests and booking history.
• Payment details: processed by our booking system and its payment provider. We see only limited card details (for example the last four digits).
• Guest registration details: for guests who are not British, Irish or Commonwealth nationals, the law requires us to record nationality and passport details (Immigration (Hotel Records) Order 1972).
• Messages: contact-form submissions, emails, phone calls and WhatsApp messages you send us.
• Website data: if you accept analytics cookies, information about how you use our website (pages visited, device type, approximate location).
• Optional advertising: with your separate advertising-cookie consent, Google ad click IDs (GCLID, GBRAID or WBRAID) and verified, matched booking data, as described below.
• Security: CCTV images from the building's communal areas and exterior (there are no cameras in guest rooms), and smart-lock entry logs showing when access codes are used.

3. How and why we use it

4. Who we share it with

We share only what is needed with:

• Cloudbeds – our booking, property management and payment system
• Online travel agents (e.g. Booking.com, Expedia), if you booked through them
• Our smart-lock provider, to create your access code
• Meta (WhatsApp), if you message us on WhatsApp
• Resend, to deliver messages submitted through our contact form
• Google (Analytics 4 if you accept analytics, Google Ads conversion measurement if you separately accept advertising cookies, and Business Profile). Ad exports contain click ID, reservation ID, booking time, GBP value and currency—not guest name, email, phone or payment-card details.
• Our email and IT providers, accountants and professional advisers
• The police or other authorities, where the law requires it

Some of these providers process data outside the UK. Where they do, appropriate safeguards are in place, such as the UK International Data Transfer Agreement or an adequacy decision.

Google Ads booking measurement

With your advertising-cookie consent, we store Google advertising click IDs (GCLID, GBRAID or WBRAID) for up to 90 days in a cookie and in our advertising records. We include a booking in Google Ads measurement only when a click ID saved on the Cloudbeds reservation matches a click recorded with your consent. We never match bookings solely by how close they are in time to a website visit.

For qualifying bookings, we share the matched click ID, reservation/order ID, booking date and time, booking value and currency with Google Ads to measure ad performance. We do not include your name, email address, phone number or payment-card details in these exports. Advertising acceptance grants Google's ad-storage, advertising-data and ad-personalisation consent settings. Our current measurement setup does not enable Google Signals or GA4 ad-personalisation signal collection; offline booking exports also restrict ad personalisation.

If you decline advertising cookies, we do not save ad click IDs, create advertising booking records or send booking conversions to Google Ads. Only necessary cookie-preference records are kept, and normal booking records remain in Cloudbeds to fulfil your stay. Analytics-only acceptance is not advertising consent.

You can withdraw consent in Cookie settings. We remove our stored visitor click data, delete advertising booking copies that have not been delivered, and stop new conversion sharing. If a conversion was already shared, we retain the minimum order and consent information needed to request a correction where Google supports it. Withdrawal does not guarantee deletion of data already held by Google.

Live chat

If you use our guest chat, we store your messages and, if you ask for a colleague to reply, your first name, email address and optional booking reference. We use this information to answer enquiries, arrange a human reply and improve our hotel information. Anthropic processes chat questions to generate answers, and Resend sends confirmed referrals and acknowledgement emails. Do not share card details or door access codes in chat. Card-number-like data is redacted before storage and AI processing. Conversations and related referral records are automatically deleted after 12 months; contact us if you would like to exercise your data rights sooner.

Chat uses browser-session storage to remember your conversation, not for advertising or analytics. Chat administration uses a strictly necessary, HTTP-only sign-in cookie lasting up to eight hours. Using chat does not enable analytics or change your cookie choice.

5. How long we keep it

• Booking and payment records: 6 years after your stay (tax and accounting requirements)
• Guest registration records: at least 12 months, as required by law
• Enquiries that didn't lead to a booking: 12 months
• Marketing list: until you unsubscribe
• Analytics data: 14 months
• Ad click IDs: up to 90 days. Withdrawal removes visitor click data and advertising booking copies that have not been delivered, and stops new conversion sharing. For conversions already shared, minimum order and consent information is retained to request corrections where Google supports them.
• CCTV footage: 30 days, unless needed to investigate an incident or requested by the police

6. Your rights

You have the right to access your data, correct it, ask us to delete it, restrict or object to how we use it, and receive it in a portable format. You can withdraw consent at any time, for example by unsubscribing or changing your cookie settings. To use any of these rights, use our contact form or write to the postal address above. We will respond within one month.

If you are unhappy with how we handle your data, please tell us first. You also have the right to complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).

7. Cookies

We use cookies and similar technologies on hiiverooms.com. Analytics and advertising are separate optional choices. Earlier analytics-only acceptance does not enable advertising. Earlier measurement-only acceptance is not upgraded to ad-personalisation permission; we ask you to choose again.

“Analytics only” enables optional analytics if configured, without advertising consent. “Accept analytics & advertising” also allows the ad-attribution cookies, Google advertising consent settings and server-side Google Ads sharing described above. “Reject optional” enables neither. No advertising consent is inferred from an earlier analytics choice. You can change your choice at any time using the Cookie settings control here or in the website footer. Cloudbeds' booking functionality is not controlled by the optional choices.

8. Changes

We may update this notice. The date at the top shows when it last changed.