This Privacy Policy explains how personal data is used when you book through First Hotels, make a payment through our booking channels, use First Member, visit our website or app, or contact customer service. It also explains your choices and rights.
The hotel provides your accommodation and local services. Its own privacy information covers processing for which the hotel is responsible. Accepting booking or membership terms, or verifying your account, does not in itself mean that you consent to marketing or optional tracking.
A controller is the organisation that decides why and how personal data is processed. The First Hotels controller responsible for each activity is identified below. In this policy, “we”, “us” and “First Hotels” refer to the relevant controller.
Booking channels and payments: First Hotels Franchise AB, company registration number 556580-9422, Vallgatan 9, 170 64 Solna, Sweden. Privacy contact: firstmember@firsthotels.com.
First Member and FirstCoins: First Hotels International AS, company registration number 914 505 356, Søndre Tollbodgate 17, 9008 Tromsø, Norway. Privacy contact: firstmember@firsthotels.com.
The legal entity operating your hotel is responsible for processing it carries out for its own purposes, such as providing the stay, administering local purchases and complying with hotel record-keeping obligations. Its identity and privacy contact are available from the hotel. Sharing a brand or a booking system does not give every First Hotels hotel unrestricted access to your information.
Depending on the services you use, we process the following information:
We receive information directly from you, from the person or organisation making a booking for you, from the hotel, from payment providers and from a loyalty partner when you use a linked programme. Technical information is received through your use of our digital services. If you provide another person’s details, please give them this policy and provide only the information needed for the booking.
Special requests may reveal health information or other sensitive details. Please contact the hotel directly and avoid including unnecessary sensitive information in general booking or customer service messages. First Hotels does not ask you to provide special-category personal data as part of an ordinary booking or membership registration. If you voluntarily provide health or other sensitive information because it is necessary to handle a specific request, we use only the information needed for that purpose and, where GDPR Article 9 applies, only where a valid Article 9 condition is available, such as your explicit consent. Where the request concerns the stay itself, the information should normally be provided directly to the hotel.
Bookings and customer service
We use contact, reservation and payment-status information to process your booking, communicate with you, send confirmations, manage changes and cancellations, and answer questions. Where necessary to provide our agreed service to you, the legal basis is performance of a contract or steps you request before entering into one, under GDPR Article 6(1)(b).
When someone books for another guest, we use the guest details needed to administer that reservation on the basis of our legitimate interest in handling bookings requested for those guests, under Article 6(1)(f). General enquiries that do not concern a contract with you are handled on the same basis: our legitimate interest in responding to people who contact us.
Payments and financial records
We use transaction information to collect payments, reconcile them with bookings, process refunds and handle payment queries. The basis is performance of the relevant contract under Article 6(1)(b). Records required for accounting, tax or other applicable financial obligations are processed under Article 6(1)(c). For First Hotels Franchise AB, accounting records are retained as required by the Swedish Bookkeeping Act, normally for seven years after the end of the calendar year in which the relevant financial year ended. For First Hotels International AS, accounting material subject to Norwegian bookkeeping requirements is retained for the applicable statutory period, generally five years after the end of the financial year for primary accounting documentation..
First Member and FirstCoins
We use account, verification and eligible booking and stay information to register and administer your membership, apply member rates, calculate qualifying nights and tier status, credit and redeem FirstCoins, and resolve account queries. Necessary membership administration is based on the membership agreement under Article 6(1)(b).
If you are not already a member, booking a member rate and accepting the First Member Terms creates your membership and account. Verifying your mobile number activates the account for FirstCoins. To earn FirstCoins for the qualifying stay through which you joined, verification must be completed no later than 12 hours after check-out, subject to the technical-issue exception in the First Member Terms. Missing that deadline does not change the member rate already booked or automatically close your membership.
We use your contact details for necessary service messages, including verification instructions and information about bookings, account security, FirstCoins and programme changes. These messages are separate from marketing.
Marketing
We use contact details and communication preferences to send newsletters and offers where you have consented, under Article 6(1)(a). If applicable law permits marketing of our own similar services to existing customers without separate consent, the basis is our legitimate interest in keeping those customers informed, under Article 6(1)(f), subject to the required opportunity to opt out.
You can stop marketing at any time through the unsubscribe instructions in the message, your available account settings or the privacy contact in section 1. This does not affect your membership, FirstCoins, member benefits or booking price. Where we rely on consent, withdrawing it does not affect the lawfulness of earlier processing.
Personalised marketing: Where you have agreed to receive marketing, we may use information such as your membership tier, FirstCoins activity, booking and stay history, selected destinations, language and stated preferences to select offers and content that are more relevant to you. Where this involves profiling for direct marketing, the processing is based on your marketing consent under Article 6(1)(a). You may withdraw that consent or object to direct marketing at any time using the unsubscribe link, available account settings or the privacy contact in section 1.
Security and legal claims
We use relevant account, transaction, technical and correspondence records to investigate misuse, protect our services and customers, and establish or defend legal claims. The basis is our legitimate interest in preventing fraud, maintaining secure services and protecting legal rights under Article 6(1)(f). Where disclosure or retention is required by a specific law, Article 6(1)(c) applies instead.
When relying on legitimate interests, we assess whether the processing is necessary and whether your interests and rights override ours. You can request further information about that assessment and object as explained in section 11.
Information identified as required in the booking process is needed to arrange the reservation and, where relevant, payment. Without it, we may be unable to complete the booking or provide the requested service. Required fields are distinguished from optional preferences.
A mobile number and its verification are needed to activate a First Member account for FirstCoins under the membership rules. Optional marketing consent is not required to create the membership, retain the booked member rate or use benefits for which you otherwise qualify.
We share information relevant to the purpose with:
Providers acting on our instructions are subject to data-processing agreements. Hotels, banks, payment providers and loyalty partners may also act as controllers for their own activities and explain those activities in their own privacy information. Adyen describes its controller activities at https://www.adyen.com/privacy-policy. The precise role depends on the processing involved.
Using providers outside the European Economic Area, including remote support from those countries, can involve an international transfer of personal data. Such transfers require a valid mechanism under GDPR Chapter V, in addition to a legal basis for the processing itself.
Some service providers and their subprocessors may process personal data outside the EEA, including where technical support or cloud services are provided from another country. We use a transfer mechanism permitted by GDPR Chapter V. Where the European Commission has not adopted an adequacy decision for the destination, this will normally include the European Commission’s Standard Contractual Clauses together with supplementary safeguards where required. You may request information about the relevant destination and safeguards using the privacy contact in section 1..
You can request details of the relevant safeguards, including a copy where applicable, using the privacy contact in section 1.
Our website, booking engine and app may use cookies or similar technologies to provide functions such as a booking session, sign-in and security. Technologies that are strictly necessary for a service you request are distinguished from optional analytics or marketing technologies.
Optional technologies that require consent are used only after you have made that choice. You can refuse or withdraw consent without losing your membership or the member rate already booked. Withdrawal applies to future use and does not change the lawfulness of earlier processing.
The current cookie notice and consent settings are available through the cookie settings link on www.firsthotels.com. The notice identifies the cookies and similar technologies in use, their providers, purposes and durations, and is updated when the website, booking engine or app changes. Strictly necessary technologies are used to provide functions requested by you and to maintain security. Optional analytics and marketing technologies are used only after consent and the resulting personal-data processing is based on Article 6(1)(a). Any international transfers connected with those providers are handled as described in section 6. Where the app uses SDKs or equivalent tracking technologies, they are covered by the same consent and information requirements..
We delete or irreversibly anonymise personal data when its purpose and any applicable retention obligation have ended. Keeping a membership open does not justify retaining every detailed stay or transaction record indefinitely.
The retention periods or criteria are:
Information (Retention period or specific criterion)
Cookie and similar technology durations are stated in the notice referred to in section 7. Records needed for an outstanding legal claim may be retained until the claim is resolved and the applicable retention or limitation period ends, with access limited to that purpose.
The 12-hour activation deadline determines eligibility for FirstCoins from the first qualifying stay. It is not a deadline for deleting an unverified member account. An account closure request also does not require deletion of records we must retain for a separate lawful purpose.
FirstCoins and membership tiers are calculated using the eligibility rules, qualifying activity and verification status set out in the First Member Terms. If you believe a result is incorrect, contact First Member support so the underlying information and calculation can be reviewed.
First Hotels does not use solely automated decision-making with legal or similarly significant effects to determine First Member eligibility, tier status or ordinary marketing eligibility. Payment providers may use automated fraud and security controls when a payment is attempted, which can contribute to a transaction being accepted, challenged or declined. Where a decision falls within GDPR Article 22 and First Hotels is responsible for that decision, you have the right to request human intervention, express your point of view and contest the decision by contacting the privacy contact in section 1. Payment providers may also act as independent controllers for their own fraud-prevention activities, as described in their privacy information..
Any marketing profiling is described separately in section 3, and optional tracking in section 7.
We apply technical and organisational measures appropriate to the information and risks involved. These include limiting access to people who need it for their work and requiring providers to protect the information they handle for us. Please do not send full payment-card details or unnecessary sensitive information in ordinary email or general customer service messages.
Depending on the processing and the conditions in the GDPR, you can:
Contact the relevant controller in section 1 to exercise your rights. We may ask for proportionate information to confirm your identity. We respond without undue delay and normally within one month. If the complexity or number of requests permits an extension, we explain the reason within that first month; the extension may be up to two additional months.
Some rights have exceptions. For example, we may need to retain an accounting record even after you close your membership. If we cannot comply with a request, we explain why and how you can challenge the decision. You may also contact the hotel or another independent controller directly about its processing.
You may raise a concern with the privacy contact in section 1. You also have the right to complain directly to a data protection supervisory authority, in particular where you live or work or where you believe an infringement occurred. Relevant authorities include:
13 Changes to this policy
We update this policy when our processing or relevant requirements change. The date at the top identifies the latest version. We provide additional notice where a material change affects you and obtain new consent where required. An update to this policy does not itself authorise a new use of your information or replace a consent request.