Privacy Policy

Privacy Policy

Last updated: 31 May 2026

This Privacy Policy explains how we collect, use, and protect your personal information when you visit our website or make a booking enquiry for our holiday cottage accommodation at Hutton-le-Hole, North York Moors National Park.

1. Who we are

This website is operated by the owners of the holiday cottage at Hutton-le-Hole, North York Moors (referred to as "we", "us", or "our"). If you have any questions about this policy or how your data is handled, please contact us using the details on our website.

2. Information we collect

We may collect and process the following information about you:

  • Contact details you provide when you enquire or book — name, email address, phone number, and postal address.
  • Booking details — dates of stay, number of guests, dog details (if applicable), and any special requests.
  • Payment information — processed by our third-party booking provider (Bookalet). We do not store your card details on this website.
  • Technical data — IP address, browser type, device information, pages visited, and referral source, collected automatically via cookies and analytics.
  • Communications — any messages you send to us by email, phone, or contact form.

3. How we use your information

We use your personal information to:

  • Process and manage your booking or enquiry.
  • Communicate with you about your stay, including check-in details and any changes.
  • Respond to questions and provide customer support.
  • Comply with our legal and tax obligations.
  • Improve our website and understand how visitors use it.
  • Send you occasional updates or offers — only if you have specifically opted in.

4. Legal basis for processing

Under UK GDPR, we process your data on the following lawful bases:

  • Contract — to fulfil your booking.
  • Legitimate interests — to run our business, respond to enquiries, and improve our service.
  • Legal obligation — to meet tax, accounting, and regulatory requirements.
  • Consent — for non-essential cookies and any marketing communications.

5. Sharing your information

We do not sell your personal data. We share it only with trusted third parties who help us operate the business:

  • Bookalet — our booking and payment platform.
  • Google Analytics — for anonymised website usage statistics (if you have accepted analytics cookies).
  • Hosting and email providers — to operate the website and communicate with you.
  • Authorities — where required by law (e.g. HMRC, law enforcement).

6. Cookies

Our website uses cookies to function correctly and to understand how visitors use the site. You can accept or reject non-essential cookies via the cookie banner shown on your first visit. Essential cookies cannot be disabled, as the site cannot function without them. For more information, see our Cookie Policy or your browser settings.

7. Data retention

We keep your personal information only as long as necessary:

  • Booking records — retained for 7 years to comply with UK tax law.
  • Enquiries that do not lead to a booking — deleted after 12 months.
  • Marketing data — kept until you unsubscribe.
  • Analytics data — anonymised and retained per Google Analytics defaults (up to 14 months).

8. Your rights

Under UK GDPR you have the right to:

  • Access the personal information we hold about you.
  • Request correction of inaccurate data.
  • Request deletion of your data (where we are not legally required to keep it).
  • Object to or restrict processing.
  • Withdraw consent at any time (for activities based on consent).
  • Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any of these rights, please contact us using the details on our website.

9. Data security

We take appropriate technical and organisational measures to protect your data, including HTTPS encryption, secure hosting, two-factor authentication for admin access, and limited internal access to personal information. Payment information is handled directly by Bookalet under their own security standards.

10. International transfers

Some of our service providers (e.g. Google Analytics) may process data outside the UK. Where this happens, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

11. Children

Our website and booking service are not directed at children under 16. We do not knowingly collect personal data from children.

12. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the latest version. Significant changes will be highlighted on the website.

13. Contact

If you have any questions about this Privacy Policy or how we handle your data, please contact us using the phone number or email address listed on our website.