Privacy
Policy.

Hulcity Hotels Uganda Limited ("Hulcity Hotels", "we", "us", or "our") operates four properties across Uganda — Hulcity Gold Hotel, Hulcity Silver Hotel, Alex Park Motel, and Valley Hotel. Our registered office is located at 1 Gold Plaza, Kampala Central Division, Kampala, Uganda.

This Privacy Policy explains how we collect, use, disclose, store, and protect personal information when you visit our website, make a reservation, stay at one of our properties, or interact with us in any way. It has been prepared in accordance with the Uganda Data Protection and Privacy Act 2019 and, where applicable to international guests, the EU General Data Protection Regulation (GDPR).

We collect the following categories of personal information:

• Identity data — full name, nationality, passport or national ID number, date of birth.
• Contact data — email address, telephone number, postal address.
• Reservation data — check-in/check-out dates, room type, special requests, number of guests.
• Payment data — billing address, payment method (card details are processed by our PCI-DSS-compliant payment processor; we do not store full card numbers).
• Usage data — IP address, browser type, pages visited, time spent on site, referring URLs.
• Preference data — language preferences, stay history, loyalty programme information.
• Communication data — emails, web-chat transcripts, WhatsApp messages, feedback forms.
• CCTV footage — recorded at our premises for security purposes.

We process your personal data for the following purposes and on the following legal bases:

• Processing and managing your reservation — contract performance.
• Communicating pre-arrival, during your stay, and post-stay — contract performance and legitimate interest.
• Processing payments and preventing fraud — legal obligation and legitimate interest.
• Operating our loyalty programme — consent / contract performance.
• Sending marketing communications about our properties and offers — consent (you may withdraw at any time).
• Improving our website and services through analytics — legitimate interest (analytics cookies require consent).
• Complying with immigration, tax, and other legal obligations under Ugandan law — legal obligation.
• Maintaining security via CCTV — legitimate interest in protecting guests and staff.

We do not sell your personal data. We share your information only with:

• Booking platforms (e.g. Booking.com) — when your reservation originates from these channels.
• Payment processors — to complete financial transactions securely.
• IT and cloud service providers — who process data on our behalf under data processing agreements.
• Immigration authorities — as required by Ugandan law for non-citizen guests.
• Uganda Revenue Authority — for tax compliance obligations.
• Professional advisors — lawyers, auditors, and insurers under strict confidentiality.
• Acquirers — in the event of a business sale or restructuring, subject to equivalent privacy protections.

Some of our service providers are located outside Uganda. Where your data is transferred internationally, we ensure adequate safeguards are in place — including Standard Contractual Clauses approved under applicable data protection frameworks — and that the receiving country provides an equivalent level of data protection.

We retain personal data only for as long as necessary for the purposes described, or as required by law:

• Guest registration records — 7 years (Uganda Revenue Authority and immigration requirements).
• Payment records — 7 years.
• Marketing consents — until withdrawn, plus 1 year.
• CCTV footage — 30 days, unless required for an active security investigation.
• Website analytics — 26 months (aggregated; individual data de-identified sooner).

Under the Uganda Data Protection and Privacy Act 2019, and where applicable the GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate or incomplete data.
• Erasure — request deletion of your data where it is no longer needed.
• Restriction — ask us to pause processing of your data in certain circumstances.
• Portability — receive your data in a structured, machine-readable format.
• Object — object to processing based on legitimate interest, including direct marketing.
• Withdraw consent — at any time, without affecting prior lawful processing.
• Lodge a complaint — with the Personal Data Protection Office of Uganda.

We use cookies and similar technologies on our website. You can manage your cookie preferences at any time using the Cookie Preferences panel accessible from the footer of every page. Please see our Cookie Policy for full details on the cookies we use.

Strictly necessary cookies are always active as they are essential for the site to function. Optional cookies (analytics, marketing, preferences) are only set with your explicit consent.

We implement appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, disclosure, alteration, or destruction. These include encryption in transit and at rest, access controls, regular security assessments, and staff training.

No transmission over the internet is entirely secure. While we do our utmost to protect your data, we cannot guarantee the security of data transmitted to us and any transmission is at your own risk.

Our website and services are not directed at children under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data about a child, please contact us immediately so we can delete it.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The date at the top of this page shows when it was last revised. Material changes will be communicated via a notice on our website or by email to registered guests.

If you have any questions about this Privacy Policy, wish to exercise your rights, or have a complaint, please contact our Data Protection Officer: