Privacy Policy

Processing of personal data

Updated October 2026

Bellagroup is a hotel, conference, exhibition and hospitality company that processes all personal data in accordance with applicable law. Bellagroup enters into agreements with guests, customers, tenants and suppliers concerning the provision, purchase and sale of various services and products.

Bellagroup believes that all processing of personal data should be transparent. The following therefore explains how Bellagroup processes personal data collected in connection with your stay at one of Bellagroup’s hotels, your lease, your participation in conferences, exhibitions or other events at our facilities, and your use of our websites, including, but not limited to, www.bellagroup.dk and www.ciff.dk.

Data controller

As a general rule, the legal entity with which you enter into an agreement or otherwise have contact is the data controller for the processing of your personal data.

This policy applies to the following companies:

• Bella Operation A/S, CVR No. 37 93 98 38, Center Boulevard 5, 2300 Copenhagen S

  • Including:

    • Copenhagen Marriott Hotel, Kalvebod Brygge 5, 1560 Copenhagen V

    • AC Hotel Bella Sky Copenhagen, Martha Christensens Vej 5, 2300 Copenhagen S

    • CP Hotel A/S (Crowne Plaza Copenhagen Towers), CVR No. 30 54 80 43, Ørestads Boulevard 114-118, 2300 Copenhagen S

The companies are collectively referred to as “Bellagroup” in this policy. The relevant company is the data controller for processing relating to the hotel, venue, event, customer relationship or contractual relationship concerned.

In certain cases, Bellagroup may process personal data jointly with a franchise partner or other business partner. If joint controllership applies, you will receive further information about the allocation of responsibilities in connection with the specific processing.

Collection of personal data

Bellagroup collects and processes personal data in connection with your visits to Bellagroup’s hotels, restaurants and conference facilities, when you enter a lease, visit our websites or subscribe to our newsletter.

You will be informed whether providing the information is voluntary or necessary, for example to complete a hotel booking or meet security requirements

The following information may be collected:

• Name, address, telephone number, email address, date of birth and similar non-sensitive personal data.

• Payment card details as a reservation and payment guarantee for stays.

• Demographic information.

• Photo identification for access cards.

• Photo identification when entering a lease.

• Purchase history and use of Bellagroup apps and/or other digital services.

• Information about use of our websites.

• Data from customer surveys.

• Data from competitions organized by Bellagroup.

• Data from Bellagroup’s social media profiles.

• Information about the businesses of guests, customers, tenants or suppliers and relevant contact persons, including account managers.

You will always be informed whether providing the information is voluntary or necessary to complete the requested action, such as booking a hotel room, or whether it is collected for security reasons.

Personal data is normally obtained directly from you, but we may also receive information from other sources, including third-party providers, travel agencies or booking systems.

Why does Bellagroup process your personal data?

Bellagroup processes your personal data for the following purposes:

Hotel or restaurant reservations

To make hotel or restaurant reservations, we use your personal data to:

• process your enquiry and confirm availability

• complete the reservation

• send you a receipt

In this context, we may process information such as your name, email address, telephone number, details of accompanying guests, and arrival and departure dates.

When you book a hotel stay or restaurant visit on our website, your payment card details will be processed by our payment service provider.

The legal basis is Article 6(1)(b) of the General Data Protection Regulation (GDPR), as processing your personal data is necessary to perform the contract with you. Personal data relating to accompanying guests is processed based on our legitimate interest in performing the contract with you, cf. Article 6(1)(f) GDPR.

Stays at Bellagroup hotels

Bellagroup processes and stores your personal data in connection with your stay at our hotels and any offers or services you have ordered in that connection. The legal basis is performance of the contract concerning your stay.

For all other services, we collect and process your personal data based on our legitimate interest in providing you with the best possible experience during your stay at Bellagroup’s hotels and the best possible service in connection with future stays, cf. Article 6(1)(f) GDPR.

In certain cases, we are required to request identification in the form of a passport or other valid ID. The legal basis is Article 6(1)(c) GDPR, as the processing is necessary for compliance with a legal obligation.

Digital services

During your stay, you may access relevant information, such as opening hours, Wi-Fi passwords and navigation, through our digital services.

If you use our digital services, we may process information such as your name, telephone number, email address, room number, arrival date, details of your orders and entries in our guestbook.

The legal basis is Article 6(1)(b) GDPR, because the processing takes place in order to enter into a contract with you for services made available through digital services, as well as our legitimate interest in giving you the best possible experience during your stay at a Bellagroup hotel, cf. Article 6(1)(f) GDPR.

Customer satisfaction surveys

If you provided your email address when booking a stay, we may, in certain circumstances, send you an email after your stay with a link to a customer satisfaction survey. This processing is based on Article 6(1)(f) GDPR, as we have legitimate interests in improving our services.

Marketing and newsletters

If you have given your consent, Bellagroup will use your personal data to send emails and newsletters from Bellagroup, including information about events and Bellagroup offers and discounts. If you no longer wish to receive these emails and newsletters, you may request removal from the mailing list by emailing info@bellagroup.dk or by using the unsubscribe link at the bottom of the newsletter. The legal basis is your consent, cf. Article 6(1)(a) GDPR.

Where you have given your consent, Bellagroup uses pixels and similar technologies from providers such as Meta and LinkedIn. These technologies may be used to measure the effectiveness of our marketing, compile statistics and show you more relevant advertisements on social media and other digital platforms.

The technologies are activated only after you have given consent through our cookie banner. The legal basis for the subsequent processing of personal data is your consent, cf. Article 6(1)(a) GDPR.

Video surveillance

Bellagroup carries out video surveillance in selected areas at our hotels, venues and other facilities. Clear signs are displayed in areas covered by surveillance.

The purposes are to prevent and investigate crime, increase security for guests, customers, tenants, employees and other visitors, and document specific security incidents.

The processing is based on Bellagroup’s legitimate interest in protecting people, buildings and assets and in preventing and investigating crime, cf. Article 6(1)(f) GDPR. Information concerning criminal offences is processed in accordance with the relevant provisions of the Danish Data Protection Act.

Only specifically authorized employees and relevant suppliers have access to recordings. Access is limited to people with a work-related need.

Recordings may be disclosed to the police for the purpose of investigating crime where the statutory conditions are met. Recordings may also be disclosed where Bellagroup is legally required to do so or where necessary for the establishment, exercise or defense of legal claims. Disclosure for other purposes takes place only where there is a separate lawful basis.

Recordings made for crime-prevention purposes are generally deleted no later than 30 days after recording. They may be retained for longer where necessary because of a specific dispute, police report or other ongoing matter. Affected people will be informed of longer retention where required by law.

Whistleblower scheme

Bellagroup’s whistleblower scheme may be used to report breaches of EU law, serious offences and other serious matters covered by the Danish Act on the Protection of Whistleblowers.

When we receive a report, we may process information about the whistleblower, the person concerned by the report and other people mentioned in it. The information may include names, contact details, position, working relationship, a description of the reported matter, documentation and information about possible crime or other serious matters.

The purpose is to receive, investigate and follow up on the report and take any necessary measures.

Processing is based on Bellagroup’s legal obligations under whistleblower legislation, cf. Article 6(1)(c) GDPR and section 22 of the Danish Act on the Protection of Whistleblowers. Special categories of personal data and information concerning criminal offences are processed under the specific rules applicable to such information.

Reports are handled confidentially. Information that may directly or indirectly reveal the whistleblower’s identity is disclosed only with the whistleblower’s consent or where disclosure is exceptionally permitted or required by law.

You may submit an anonymous report through the whistleblower portal. The portal enables Bellagroup to communicate with the whistleblower without knowing the whistleblower’s identity. If you provide your name, email address or other identifying information, the report is no longer anonymous.

Information is retained only for as long as necessary to investigate and follow up on the report and comply with Bellagroup’s legal obligations. Reports outside the scope of the scheme are deleted as soon as possible. Information in investigated cases is retained until the case and any subsequent legal or employment-law steps have been concluded. Information transferred to a personnel file or another case is retained according to the periods applicable to that case.

Customer enquiries and communication

When you contact a Bellagroup hotel or venue or otherwise communicate with Bellagroup, we collect and process the information you provide in order to handle your enquiry. Please do not send special categories of personal data unless necessary for handling your enquiry. If we receive such information, access is restricted to employees with a work-related need, and the information is protected by appropriate security measures.

The legal basis depends on the nature of your enquiry. In most cases, processing is necessary either to enter into a contract, cf. Article 6(1)(b) GDPR, or for our legitimate interest in handling your enquiry, cf. Article 6(1)(f) GDPR.

AI Assistant on our websites

On selected websites, Bellagroup may provide an AI-powered assistant. You will be informed that you are interacting with an AI assistant before the conversation begins. The assistant is used to answer questions, help you find relevant information and support our customer service activities.

When you use the AI assistant, we may process the content of your messages and any information you choose to provide, as well as technical information such as your IP address, device and browser information, the time of your enquiry and a pseudonymous device identifier. The information is processed in order to provide and improve the functionality of the assistant, respond to your enquiry and ensure and document the operation and security of the service.

The processing takes place where necessary to respond to your enquiry or take steps at your request prior to entering into a contract, cf. Article 6(1)(b) GDPR, or on the basis of our legitimate interest in providing efficient customer service and a well-functioning digital service, cf. Article 6(1)(f) GDPR. We recommend that you do not enter special categories of personal data or other personal data that is not necessary for your enquiry.

The AI assistant may be provided by an external service provider acting as a processor on behalf of Bellagroup. Personal data is retained only for as long as necessary for the purposes described above and in accordance with the retention periods set out in this Privacy Policy.

Where a pseudonymous device identifier is used to recognize your device or link your use of the AI assistant across devices, this will take place only where you have provided consent through our cookie banner. You may change or withdraw your consent at any time through the cookie settings. Further information about the technology, its purpose, provider and retention period is available in our cookie declaration.

Use of our websites

When you visit Bellagroup’s websites, we may process information about your use of the website, including IP address, cookie ID, device and browser information, pages visited, time of visit, navigation and use of website functions.

We use the information to:

• ensure website functionality and security;

• remember your choices and settings;

• compile website usage statistics;

• improve content, functionality and user experience;

• measure the effectiveness of our marketing; and

• show relevant advertisements where you have consented.

Strictly necessary cookies and technologies are used where required for website functionality, security or delivery of a service you have expressly requested.

Preference, statistical and marketing cookies and similar technologies are used only where you have consented through our cookie banner. The legal basis for processing personal data in connection with these technologies is your consent, cf. Article 6(1)(a) GDPR.

You may change or withdraw your consent at any time through the cookie settings. An up-to-date list of the cookies used, their purposes, providers and retention periods is available in our cookie declaration.

Recruitment

If you apply for employment with Bellagroup through our website, we collect the personal data provided with your application, CV and any other attachments in order to assess your application.

The legal basis is your request to enter an employment contract with Bellagroup, cf. Article 6(1)(b) GDPR, and our legitimate interest in processing the personal data you have provided, cf. Article 6(1)(f) GDPR.

We recommend that you do not include special categories of personal data in your application, such as racial or ethnic origin, religion, trade union membership, sexual orientation or health data.

You will receive further information about how we process your personal data during the recruitment process.

Other purposes

In addition to the purposes above, Bellagroup may process your personal data to comply with legal requirements, cf. Article 6(1)(c) GDPR, or to establish, exercise or defend legal claims, cf. Articles 6(1)(f) and 9(2)(f) GDPR.

Who does Bellagroup share your personal data with?

In certain circumstances, Bellagroup may share personal data with our business partners. Recipients may include:

Franchisors: Personal data is shared with franchisors of brands operated by Bellagroup to provide the purchased services.

Service providers: Personal data may be shared with external service providers supplying services such as domain registration, data analytics, payment services, related infrastructure, customer service and surveys.

For further information, please see the privacy policies of Bellagroup’s franchise partners.

Marriott International Privacy Center

IHG Privacy and Cookie Center

Within the limits of applicable law, it may be necessary to disclose personal data to public authorities, cf. Article 6(1)(c) GDPR. Personal data may also be disclosed where it is necessary to enter into a contract to which you are a party, for example in connection with travel bookings. We may also disclose personal data to establish, exercise or defend legal claims, cf. Articles 6(1)(f) and 9(2)(f) GDPR. We may further disclose your personal data to external auditors to comply with statutory audit obligations, cf. Article 6(1)(c) GDPR.

As Bellagroup develops, its corporate structure may change, for example through a partial or complete sale. Where assets, including personal data, are partially transferred, the legal basis will generally be Article 6(1)(f) GDPR, as Bellagroup has a legitimate interest in transferring part of its assets and carrying out commercial changes.

Some Bellagroup suppliers, franchisors or business partners may be established outside the EU/EEA or use sub processors in countries outside the EU/EEA. This may entail transferring personal data to, or allowing access from, a third country.

Transfers may be based on an adequacy decision by the European Commission, the EU-U.S. Data Privacy Framework where the recipient is certified, or the European Commission’s Standard Contractual Clauses. You may contact us for further information about the basis for a specific transfer.

Use of artificial intelligence (AI)

Bellagroup may use artificial intelligence (AI) tools to support customer service, administration, analysis, communication, document preparation, meeting summaries, translations and other internal work processes.

When AI tools are used, personal data is always processed in accordance with applicable data protection law and Bellagroup’s internal guidelines on the use of artificial intelligence.

Personal data is processed only to the extent necessary for the specific purpose and on a valid legal basis under the GDPR. Bellagroup does not make decisions producing legal effects or similarly significantly affecting data subjects solely on the basis of AI systems.

AI tools may be provided by external service providers that process information on Bellagroup’s behalf as processors. Where such providers are established outside the EU/EEA, Bellagroup ensures a lawful transfer basis in accordance with the GDPR.

Withdrawal of consent

You may withdraw any consent you have given to Bellagroup at any time. Withdrawal may, however, mean that we can no longer offer you the same products and services. To withdraw consent, contact us by email or telephone using the details under Contact.

You may also withdraw consent to receive our newsletter by using the unsubscribed link in the newsletter.

Your rights

Under data protection law, you have several rights in connection with Bellagroup’s processing of your personal data.

Depending on the circumstances, you have the right to:

• access the personal data we process about you;

• have inaccurate or incomplete information corrected;

• have your personal data erased;

• restrict the processing of your personal data;

• object to processing based on Bellagroup’s legitimate interests;

• receive personal data you have provided to us in a structured, commonly used and machine-readable format and have it transmitted to another controller where the conditions for data portability are met;

• withdraw consent; and

• lodge a complaint with the Danish Data Protection Agency.

If we process your personal data for direct marketing, you have the right to object at any time. If you object, we will stop processing the data for that purpose.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Your rights may be limited in certain situations, for example where continued processing is necessary to comply with a legal obligation or to establish, exercise or defend legal claims.

For questions about data protection, contact:

Bella Operation A/S

Att.: Jane Blanchet
Center Boulevard 5
2300 Copenhagen S
Denmark

Email: persondata@bellagroup.dk
Telephone: +45 32 52 88 11

Security

Bellagroup has implemented appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access.

The measures are adapted to the nature and risks of the processing and may include access control, authorization management, logging, backups, encryption or other protection during transmission and storage, ongoing system maintenance, employee training and supplier oversight.

Only employees and suppliers with a work-related need are given access to personal data. They are subject to confidentiality requirements and instructions on correct and secure processing.

Bellagroup regularly reviews its security measures and adapts them when risks, technology or processing activities change.

Retention of personal data

Bellagroup retains personal data for as long as necessary for the purposes for which it was collected and for as long as necessary to comply with legal obligations or establish, exercise or defend legal claims.

Retention periods are determined on the basis of the nature of the data, the purpose of processing, the data subject’s reasonable expectations, the risk to the data subject and relevant statutory documentation and limitation periods.

Personal data collected in connection with visits to our restaurants or venues is retained for up to two years from your last visit. Guest data collected in connection with bookings or stays at a Bellagroup hotel is retained for up to two years from your last visit.

If you are a member of IHG Rewards Club and/or Marriott Bonvoy, please refer to their privacy policies on their websites.

The retention period is based on our legitimate interest in providing our services and handling any legal claims.

Documentation of your consent under the Danish Marketing Practices Act is retained for two years from the date on which you withdrew consent to receive direct marketing. This period is based on Bellagroup’s legitimate interest in documenting that direct marketing was carried out in accordance with applicable law.

Video-surveillance recordings made for crime-prevention purposes are deleted or anonymized no later than 30 days after recording, unless Bellagroup needs to retain them to handle a specific dispute, for example to investigate crime or other unlawful conduct. Recordings made for other purposes are deleted when retaining them no longer serves an objective purpose.

Whistleblower reports outside the scope of the scheme or providing no basis for further action are deleted immediately once this is established. Reports that are investigated but do not lead to a police report are deleted two months after the investigation closes. If a report is made to the police or another relevant authority, the information is deleted immediately after the case closes unless transferred to the reported employee’s personnel file. In that case, the personal data is deleted no later than five years and six months after the employment relationship ends.

Personal data forming part of accounting records is retained for the period required by the Danish Bookkeeping Act, calculated from the end of the financial year to which the records relate.

Personal data collected during recruitment is retained while the process is ongoing. If we cannot offer you employment, we will retain your application, CV and attachments for six months after rejection unless you have consented to longer retention.

Personal data may be retained longer where required by law or necessary to establish, exercise or defend legal claims. It may also be retained longer in anonymized form, where it can no longer be linked to you.

Links to other websites

Our website may contain links to other websites or integrated third-party services. We are not responsible for the content of other companies’ websites or their personal-data collection practices. When visiting third-party websites, you should read the provider’s privacy policy and other relevant policies.

Contact

If you have questions or wish to complain about the processing of personal data, contact Bellagroup by email or telephone as stated above. If we do not resolve your complaint, or if you wish to pursue it further, you may complain to the Danish Data Protection Agency:

Danish Data Protection Agency
Carl Jacobsens Vej 35
2500 Valby
Denmark
Telephone: +45 33 19 32 00
Email: dt@datatilsynet.dk