Privacy policy

Huxley House Amsterdam

Version: 1
Last updated: September 17, 2026

Vondel36 propco bv/hotel: Huxley House respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, disclose and protect personal data when you visit our website, make a reservation, stay at our hotel, contact us or otherwise interact with us.

We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable Dutch data-protection legislation, including the Dutch GDPR Implementation Act (Uitvoeringswet Algemene verordening gegevensbescherming, “UAVG”).

The data controller responsible for the processing of your personal data is:

Vondel36 Propco B.V.
Trading as: Huxley House
Address: Schipluidenlaan 4, Amsterdam, The Netherlands
Postal code and city: 1062HE, Amsterdam,
Chamber of Commerce number: 82374082
Email: info@huxleyhouse.com
Website: www.huxleyhouse.com

In this Privacy Policy, “Huxley House”, “we”, “us” or “our” refers to the abovementioned data controller.

If a separate company operates the website, booking platform, hotel services or payment services, the relevant roles and responsibilities may differ. Where applicable, this will be explained in the relevant section below.

Depending on how you interact with us, we may process the following categories of personal data:

• Name and surname;

• Postal and billing address;

• Email address;

• Telephone number;

• Country of residence;

• Preferred language;

• Company name and business contact details, where relevant.

• Reservation number;

• Arrival and departure dates;

• Number of guests;

• Room and rate information;

• Booking preferences;

• Special requests;

• Check-in and check-out information;

• Information relating to services used during your stay;

• Information concerning cancellations, amendments and no-shows;

• Communication relating to your reservation or stay.

• Payment status;

• Invoice and transaction details;

• Billing information;

• Payment method;

• Refund information;

• Information necessary to prevent or investigate fraudulent transactions.

We generally do not store complete payment-card details. Payments may be processed by specialised payment-service providers that process payment information in accordance with their own privacy policies and applicable legal requirements.

When you contact us by email, telephone, online forms, social media or other channels, we may process:

• The content of your communication;

• Your contact details;

• The date and time of communication;

• Information concerning questions, complaints, requests or feedback;

• Information needed to follow up on your request.

When you use our website, we may process:

• IP address;

• Browser type and version;

• Device type;

• Operating system;

• Website interaction data;

• Date and time of access;

• Referring website;

• Cookie identifiers and similar technologies;

• Technical logs and security information.

The processing of cookies and similar technologies is further explained in Section 8.

We may receive personal data from third parties, including:

• Online travel agencies and booking platforms;

• Corporate travel partners;

• Travel agents;

• Group-booking organisers;

• Payment providers;

• Technology and reservation-service providers;

• Other guests or persons making a reservation on your behalf.

Where personal data is obtained from another source, we will process it in accordance with applicable data-protection law and, where required, provide the relevant privacy information.

In limited circumstances, you may voluntarily provide information that qualifies as a special category of personal data under Article 9 GDPR, for example:

• Health-related information necessary to accommodate a request;

• Accessibility or mobility requirements;

• Food allergies or dietary information where this may reveal healthrelated information;

• Other sensitive information voluntarily provided in connection with your stay.

We only process such information where this is necessary, proportionate and permitted under applicable law. Depending on the circumstances, the processing may be based on your explicit consent, the necessity to provide requested services, or another applicable legal exception under Article 9 GDPR.

Please only provide sensitive information where it is necessary for your request or stay.

We may collect personal data:

• Directly from you when you make a reservation;

• When you stay at Huxley House;

• When you contact us;

• When you subscribe to marketing communications;

• When you use our website;

• Through cookies and similar technologies;

• From online travel agencies or booking platforms;

• From travel agents, companies or other persons making a reservation on your behalf;

• From service providers supporting our hotel operations;

• When you provide feedback, submit a complaint or participate in a survey;

• Where permitted by law, from publicly available sources or business partners.

If another person makes a reservation on your behalf, that person should ensure that they are authorised to provide your personal data to us.

We process personal data only for specific and legitimate purposes. The applicable legal basis depends on the nature of the processing.

We use personal data to:

• Create and manage reservations;

• Confirm, amend or cancel bookings;

• Provide accommodation and related services;

• Arrange check-in and check-out;

• Respond to special requests;

• Communicate important information about your booking or stay;

• Prepare invoices and process payments;

• Provide customer support.

The legal basis is generally that processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract.

We may process personal data to comply with legal obligations, including:

• Accounting and tax requirements;

• Bookkeeping obligations;

• Statutory record-keeping requirements;

• Fraud prevention;

• Legal reporting obligations;

• Requests from competent authorities;

• Obligations relating to public safety and security.

The legal basis is compliance with a legal obligation to which we are subject.

We may process personal data where this is necessary for our legitimate interests, provided that these interests are not overridden by your fundamental rights and freedoms. Such interests may include:

• Managing and improving hotel operations;

• Maintaining website and IT security;

• Preventing fraud, misuse and unlawful activity;

• Protecting guests, employees, visitors and property;

• Handling complaints and disputes;

• Defending or establishing legal claims;

• Improving customer service;

• Conducting internal administration and reporting;

• Evaluating and improving our services.

Where we rely on legitimate interests, we consider the nature of the processing and its impact on your rights.

Subject to applicable law, we may use your personal data to send:

• Newsletters;

• Information about Huxley House;

• Special offers;

• Invitations or promotional communications;

• Information about services or experiences that may be relevant to you.

Where prior consent is legally required, we will only send marketing communications after receiving your consent.

You may unsubscribe from marketing communications at any time by:

• Clicking the unsubscribe link in the relevant communication;

• Contacting us directly; or

• Using another opt-out method made available to you.

You may continue to receive non-marketing communications that are necessary for your reservation, stay, payment, account or other contractual relationship.

We may contact you after your stay to request feedback, conduct surveys or improve our services. Depending on the circumstances, this processing may be based on our legitimate interests or your consent.

You may object to receiving such communications at any time.

We may process personal data to:

• Monitor and secure our systems;

• Investigate suspected fraud or misuse;

• Protect guests, employees and visitors;

• Investigate incidents;

• Maintain access-control and security records;

• Comply with legal or regulatory requirements.

Any use of CCTV, access-control systems, vehicle-registration information or incident registers is subject to the actual systems used at Huxley House and the applicable legal requirements.

Some personal data is necessary for us to enter into or perform a contract with you.

For example, certain identification, contact, reservation and payment details may be required to:

• Make or administer a reservation;

• Provide accommodation;

• Process payment;

• Issue an invoice;

• Comply with legal obligations;

• Communicate essential information concerning your stay.

If you do not provide information that is necessary for these purposes, we may be unable to process your reservation or provide certain services.

Other information, such as optional marketing preferences or non-essential feedback, is voluntary.

We may disclose personal data to the following categories of recipients where necessary and lawful:

We may use third-party service providers supporting our business, including providers of:

• Reservation and booking systems;

• Property-management systems;

• Website hosting;

• IT and cloud services;

• Email and communication services;

• Payment processing;

• Accounting and financial administration;

• Customer-service systems;

• Marketing distribution;

• Security and maintenance;

• Data storage and backup;

• Legal, audit and professional services.

Where a service provider processes personal data on our behalf, we require appropriate contractual arrangements in accordance with Article 28 GDPR, where applicable.

Where you make a reservation through an online travel agency, booking platform, travel agent or other intermediary, personal data may be exchanged with that party as necessary to administer the reservation and provide the requested services.

Depending on the circumstances, the relevant platform or partner may act as an independent controller of your personal data. In that case, its own privacy policy may also apply.

Payment-related information may be shared with payment-service providers to process payments, refunds, deposits and fraud-prevention checks.

We may disclose personal data:

• Where required by law;

• In response to a lawful request from a competent authority;

• To establish, exercise or defend legal claims;

• To prevent fraud or serious unlawful activity;

• To protect the rights, safety or property of Huxley House, our guests or others.

Where relevant to the operation of Huxley House, personal data may be shared with affiliated companies, property owners, operators or group entities, provided that the sharing is lawful and necessary for the relevant purpose.

The precise entities involved should be confirmed internally and reflected in the hotel’s records of processing activities.

Some of our service providers or business partners may process personal data outside the European Economic Area (“EEA”).

Where personal data is transferred outside the EEA, we will ensure that the transfer is carried out in accordance with Chapter V GDPR. This may include:

• A European Commission adequacy decision;

• Standard Contractual Clauses approved by the European Commission;

• Binding Corporate Rules;

• Another legally recognised transfer mechanism;

• A permitted derogation under applicable data-protection law, where appropriate.

Where relevant, information about the applicable safeguards may be obtained by contacting us using the details in Section 15.

We do not transfer personal data internationally unless the transfer is lawful and appropriate safeguards are in place where required.

Our website may use cookies and similar technologies.

Cookies may be used for purposes such as:

• Ensuring that the website functions properly;

• Remembering preferences;

• Measuring website performance;

• Understanding website usage;

• Improving website functionality;

• Maintaining security;

• Supporting marketing activities, where permitted.

Cookies may be divided into categories such as:

• • Strictly necessary cookies;

• Preference or functionality cookies;

• Analytics cookies;

• Marketing or advertising cookies.

Where consent is required, non-essential cookies will only be placed after you have provided consent through our cookie-management mechanism.

You can manage or withdraw your cookie preferences through the cookie banner or cookie settings available on our website. You can also adjust your browser settings, although disabling certain cookies may affect website functionality.

Our cookie notice or cookie settings tool may provide further information about the specific cookies used, their purposes, providers and retention periods.

We do not intend to make decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you.

If this changes, we will provide the information required by applicable dataprotection law, including information about:

• The existence of the automated decision-making;

• The logic involved;

• The significance and envisaged consequences for you;

• Your applicable rights.

We may use limited analytics or segmentation for service improvement or marketing purposes where permitted by law. Such activities will not result in solely automated decisions producing legal or similarly significant effects unless permitted under the GDPR and appropriately disclosed.

We retain personal data only for as long as necessary for the purposes for which it was collected, unless a longer period is required or permitted by law.

Retention periods depend on the type of data and the purpose of processing.

The following retention framework applies or should be confirmed for Huxley House:

Where exact retention periods cannot reasonably be specified, we use appropriate criteria, including:

• The purpose for which the data was collected;

• Whether an ongoing relationship exists;

• Legal, accounting or regulatory obligations;

• Limitation periods for legal claims;

• Security and fraud-prevention requirements;

• Whether the data is needed for dispute resolution.

When personal data is no longer required, it will be securely deleted, anonymised or otherwise disposed of in accordance with our retention procedures.

We implement appropriate technical and organisational measures designed to protect personal data against:

• Unauthorised access;

• Unlawful processing;

• Accidental loss;

• Destruction;

• Damage;

• Alteration;

• Disclosure.

Depending on the nature of the processing, these measures may include:

• Access controls;

• Role-based permissions;

• Password and authentication controls;

• Confidentiality obligations;

• Secure systems and networks;

• Backup and recovery procedures;

• Supplier due diligence;

• Staff awareness and training;

• Security monitoring;

• Incident-management procedures;

• Physical security measures.

No method of transmission or storage is completely secure. Nevertheless, we take reasonable and appropriate measures to protect the personal data entrusted to us.

Subject to applicable legal conditions and exceptions, you may have the following rights:

You may request confirmation as to whether we process your personal data and, where applicable, request a copy of that data.

You may request correction of inaccurate or incomplete personal data.

You may request deletion of your personal data where, for example:

• The data is no longer necessary;

• You withdraw consent and there is no other legal basis;

• You successfully object to the processing;

• The data has been unlawfully processed;

• Deletion is required by law.

This right is not absolute and legal exceptions may apply.

You may request that we restrict processing in certain circumstances, for example while the accuracy of data is being verified or where you have objected to processing.

You may object to processing based on our legitimate interests.

You have an unconditional right to object to the processing of your personal data for direct marketing purposes.

Where applicable, you may request to receive personal data that you provided to us in a structured, commonly used and machine-readable format, or request that it be transmitted to another controller.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

You have the right to lodge a complaint with a supervisory authority, in particular in the country where you live, work or believe that an infringement has occurred.

In the Netherlands, the relevant supervisory authority is:

Autoriteit Persoonsgegevens
Website: www.autoriteitpersoonsgegevens.nl

You can submit a privacy request by contacting:

Email: info@huxleyhouse.com
Postal address: Schipluidenlaan 4, 1062HE, Amsterdam, The Netherlands

To protect personal data, we may need to verify your identity before processing your request.

We will respond to a valid request without undue delay and, in principle, within one month of receiving the request. This period may be extended by up to two additional months where necessary, taking into account the complexity and number of requests. If an extension is required, we will inform you within the initial one-month period.

We generally do not charge a fee for exercising your rights. However, where requests are manifestly unfounded or excessive, particularly because of their repetitive character, we may charge a reasonable administrative fee or refuse to act, where permitted by law.

Our website may contain links to third-party websites, booking platforms, social-media pages or other external services.

We are not responsible for the privacy practices, content or security of thirdparty websites or services. We recommend reviewing the privacy policies of those third parties before providing personal data.

Where you use an external booking platform or service, that platform may process your personal data under its own terms and privacy policy.

If you have questions about this Privacy Policy, our processing of personal data or the exercise of your rights, please contact us:

Huxley House
Data Controller: Vondel36 Propco B.V.
Address: Schipluidenlaan 4, 1062HE
Amsterdam, The Netherlands
Email: info@huxleyhouse.com
Telephone: 020-7220326
Website: www.huxleyhouse.com

We may update this Privacy Policy from time to time to reflect changes in:

• Our services;

• Our systems or processing activities;

• Applicable legislation;

• Regulatory guidance;

• Our business operations.

The most recent version will be published on our website. The “Last updated” date at the top of this document indicates when the policy was most recently revised.

Where required by law, we will notify you of material changes through appropriate channels.

End of Privacy Policy