Privacy policy

Last updated: 24 September 2026

1. Who we are

This website is operated by Hidden Voyage Ltd, trading as AA+G Hospitality Management, a company registered in England and Wales under number 08629374, with registered office at 14th Floor, 33 Cavendish Square, London W1G 0PW, United Kingdom (“we”, “us”).

We are the controller of the personal data described in this policy. For any question about it, please write to info@aaghospitality.com or call +44 20 3772 0894 (UK) or +39 02 8294 1409 (Italy).

2. The data we collect

We collect only the data needed to deal with you professionally:

• Enquiries. When you use our contact form or write to us: name, surname, email, telephone, company, role, and the details you choose to share about your hotel or project (location, number of rooms, stage of the asset, services of interest, message).
• Business relationships. Contact details and correspondence of owners, investors, lenders, operators, suppliers and advisers we work with.
• Applications. CVs and information sent to us by candidates and specialists who wish to work with us.
• Website use. Technical data and, only with your consent, statistics and marketing cookies, as described in our Cookie Policy.

3. Why we use it and on what legal basis

• To reply to your enquiry and to take steps before entering into an engagement (performance of a contract or pre contractual steps, Article 6(1)(b) UK GDPR and EU GDPR).
• To deliver our services and manage our client and supplier relationships (performance of a contract and our legitimate interests, Article 6(1)(b) and (f)).
• To send business contacts occasional updates relevant to their role, which you can refuse at any time (legitimate interests, Article 6(1)(f)).
• To assess applications (pre contractual steps and legitimate interests).
• To comply with accounting, tax and other legal obligations (Article 6(1)(c)).
• To measure the use of the website and run marketing tools, only where you have given consent through the cookie banner (Article 6(1)(a)).

4. Who receives the data

We do not sell personal data. We share it only with parties that help us run our business, under confidentiality and data processing terms:

• HubSpot, our CRM and form provider (data hosted in the European Union);
• SiteGround, our website hosting provider;
• Google, for spam protection (reCAPTCHA) and, with consent, website statistics;
• specialists engaged on a specific project, professional advisers, banks and auditors, where necessary;
• public authorities, where required by law.

5. International transfers

Our data is processed mainly in the United Kingdom and in the European Economic Area. Where a provider processes data elsewhere, the transfer is covered by adequacy regulations or by appropriate safeguards such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses.

6. How long we keep it

• Enquiries that do not lead to an engagement: up to 24 months from the last contact.
• Client and supplier records: for the duration of the relationship and six years thereafter.
• Applications: up to 12 months, unless you agree to a longer period.
• Cookie data: for the periods stated in the Cookie Policy.

7. Security

We protect personal data with appropriate technical and organisational measures, including encrypted connections, access controls and reputable providers. No system is entirely secure, but we act promptly on any incident, as the law requires.

8. Your rights

You may ask for access to your data, its correction or erasure, the restriction of its processing, its portability, and you may object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time. To exercise these rights, write to info@aaghospitality.com.

You also have the right to complain to the Information Commissioner’s Office (ico.org.uk) or, if you live in the European Union, to your local supervisory authority, such as the Garante per la protezione dei dati personali in Italy.

9. Providing your data

Providing personal data through our forms is voluntary. The fields marked as required are needed to reply to your enquiry; without them we may not be able to respond or to prepare a proposal.

10. Automated decisions

We do not take decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects on you.

11. Applicable law

We process personal data in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 and, for individuals in the European Union, with Regulation (EU) 2016/679 (GDPR) and the applicable national laws, including the Italian Personal Data Protection Code (Legislative Decree 196/2003, as amended).

12. Changes to this policy

We may update this policy from time to time. The current version is always available on this page, with its date of update.