Within the Even Hotels agreement, who is considered the 'Controller' of Hotel Personal Data?

According to Even Hotels' 2025 Franchise Disclosure Document, the Hotel is considered an independent Controller of the Hotel Personal Data and the sole Controller of the Excluded Personal Data. IHG (InterContinental Hotels Group) is an independent Controller of IHG Personal Data to the fullest extent permitted by Privacy Laws and the sole Controller of IHG Marketing Data.

For an Even Hotels franchisee, this means the hotel owner is primarily responsible for ensuring compliance with privacy laws regarding the personal data collected and processed at their specific hotel location. This includes data from hotel guests and other hotel customers, excluding IHG Marketing Data. The franchisee has the autonomy to determine the purposes and means of processing this data.

However, IHG maintains control over personal data related to its marketing and loyalty programs. Therefore, the franchisee must understand the distinction between Hotel Personal Data and IHG Personal Data to ensure they handle each type of data according to the appropriate privacy regulations and agreements.

This division of responsibility is important because it dictates who is accountable for responding to data requests, implementing security measures, and adhering to privacy laws like GDPR. The franchisee should consult with legal counsel to fully understand their obligations as a data controller under the franchise agreement.