Privacy Policy

1. Who We Are

The Hill Station Hotel is a hospitality business located at 10 Tudun Wada Rd, Jos 930105, Plateau, Nigeria. For the purposes of data protection law, we act as the data controller for personal information processed in connection with our guest services, reservations, events, dining, wellness, and website operations.

For privacy-related enquiries, contact reservations@hillstationjos.com or guestexperience@hillstationjos.com.

2. Information We Collect

We may collect and process the following categories of personal information:

• Identity & contact details: name, title, address, email address, telephone number, nationality, and government-issued identification where required for check-in.
• Reservation & stay information: booking dates, room preferences, arrival and departure details, special requests, loyalty or corporate account references, and guest history.
• Payment & billing information: payment card details, bank transfer references, billing address, invoices, deposits, and incidental charges.
• Event & dining information: event requirements, dietary preferences, allergies, seating arrangements, and catering instructions.
• Communications: emails, phone calls, enquiry forms, feedback, complaints, and correspondence with our team.
• Website & technical data: IP address, browser type, device information, pages visited, referral source, and general usage data collected through cookies or similar technologies.
• Security & CCTV data: footage from CCTV systems operating in public areas of the hotel for safety, security, and incident prevention purposes.

We do not intentionally collect sensitive personal data unless required for a legitimate hospitality purpose, such as health or dietary information you voluntarily provide, or where permitted by law.

3. How We Collect Information

We collect personal information when you:

• make a reservation online, by phone, email, or through a travel partner;
• check in or check out of the hotel;
• register for an event, meeting, or dining experience;
• use our gym, pool, spa, or other resort facilities;
• subscribe to updates or submit an enquiry through our website;
• communicate with our reservations, guest experience, or events teams; or
• visit our premises, where CCTV and security systems may record activity in public areas.

4. How We Use Your Information

We use personal information for legitimate hospitality and business purposes, including to:

• process and manage reservations, payments, check-in, and check-out;
• provide accommodation, dining, events, wellness, and guest services;
• verify identity and comply with legal registration requirements;
• respond to enquiries, requests, complaints, and feedback;
• manage security, safety, incident reporting, and lost-property procedures;
• improve our services, website, and guest experience;
• send booking confirmations, service updates, and operational communications;
• meet accounting, tax, audit, and regulatory obligations; and
• protect the rights, property, and safety of guests, staff, and the hotel.

5. Legal Basis for Processing

Under the NDPA and related data protection principles, we process personal data where one or more of the following applies:

• processing is necessary to perform a contract with you or to take steps at your request before entering into a contract;
• processing is necessary to comply with a legal obligation;
• processing is necessary for legitimate interests pursued by the hotel, such as security, fraud prevention, service improvement, and operational administration, provided those interests are not overridden by your rights; or
• you have given consent, where required, for example for certain marketing communications.

6. Sharing of Information

We do not sell personal data. We may share information with trusted third parties only where necessary and under appropriate confidentiality and data protection safeguards, including:

• payment processors, banks, and financial service providers;
• booking platforms, travel agents, and corporate account partners;
• IT, website hosting, and reservation system providers;
• professional advisers such as lawyers, auditors, and insurers;
• law enforcement, regulators, or government authorities where required by law; and
• event vendors or contractors supporting hospitality operations on our behalf.

Any third party processing personal data on our behalf is expected to handle that data securely and only for authorised purposes.

7. International Data Transfers

Where personal data is transferred outside Nigeria, we take reasonable steps to ensure appropriate safeguards are in place in accordance with applicable data protection requirements, including contractual protections and secure transmission methods.

8. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes described in this policy, including to:

• manage active and past reservations;
• resolve disputes or enforce agreements;
• meet legal, tax, and regulatory record-keeping requirements; and
• maintain security and incident records where appropriate.

Retention periods may vary depending on the type of data and the purpose for which it was collected. CCTV footage is retained only for a limited period unless required for an investigation or legal matter.

9. Data Security

We apply reasonable administrative, technical, and organisational safeguards to protect personal information against unauthorised access, loss, misuse, alteration, or disclosure. These measures may include access controls, secure systems, staff training, and contractual protections with service providers.

While we take data protection seriously, no method of transmission or storage is completely secure. Guests are encouraged to protect their own account details, booking references, and valuables during their stay.

10. CCTV & Security Monitoring

For the safety of guests, staff, and property, CCTV surveillance operates in public areas of the hotel. CCTV is not used in private guest room spaces.

Recorded footage may be reviewed in connection with security incidents, lost property enquiries, investigations, or legal obligations. For more information on security practices, please refer to our Terms & Conditions.

11. Cookies & Website Technologies

Our website may use cookies and similar technologies to support functionality, analyse traffic, and improve user experience. These may include:

• essential cookies required for site operation;
• performance and analytics cookies to understand how visitors use the site; and
• preference cookies to remember settings where applicable.

You can manage cookie preferences through your browser settings. Disabling certain cookies may affect website functionality.

12. Marketing Communications

We may send promotional or service-related communications where permitted by law and, where required, based on your consent or existing customer relationship.

You may opt out of marketing communications at any time by using the unsubscribe option in an email or by contacting us directly. Operational messages relating to bookings, events, or your stay may still be sent where necessary.

13. Children’s Privacy

Our services are not directed at children under 18 without appropriate adult supervision and authorization. Where information relating to minors is provided by a parent, guardian, or accompanying adult, that adult remains responsible for the information supplied and for the conduct and safety of the minor on the resort.

14. Your Rights

Subject to applicable law, you may have the right to:

• request access to personal information we hold about you;
• request correction of inaccurate or incomplete information;
• request deletion of personal information where legally permitted;
• object to or restrict certain processing activities;
• withdraw consent where processing is based on consent; and
• lodge a complaint with a relevant data protection authority where applicable.

To exercise your rights, contact us using the details below. We may need to verify your identity before responding to certain requests.

15. Third-Party Links

Our website may contain links to third-party websites or services, including booking partners, maps, and social platforms. We are not responsible for the privacy practices of those third parties and encourage you to review their policies before providing personal information.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, technology, or our operations. The “Last updated” date at the top of this page will indicate when revisions were made. Continued use of our services after an update constitutes acceptance of the revised policy, where permitted by law.

17. Contact Us

For privacy-related enquiries, data requests, or concerns about how your information is handled, please contact:

Reservations & Guest Services

The Hill Station Hotel

10 Tudun Wada Rd, Jos 930105, Plateau, Nigeria

reservations@hillstationjos.com

guestexperience@hillstationjos.com

+234 (0)701 449 3026