Privacy policy
Version 1.0 · Effective 16 October 2026 (draft)
This policy explains how we collect and use your personal information when you visit our website, contact us, or book and stay at Spring Cottage.
1. Who is responsible for your information
The controller of your personal information is Alexander Bruce Thomas, trading as Spring Cottage, Trawden, a sole trader. Postal address: 34 Barn Field Close, Colne, BB8 0QB. Email: hello@thespringcottage.co.uk.
2. What we collect
When you book: your name, email address, mobile number, postcode/address, the number of adults, children, infants and pets (and pet type, breed and size), your arrival time and any message you send us; your booking details (dates, price, reference); payment details processed by Stripe (we receive only the card type, last four digits, expiry, and the payment and refund status, never your full card number); and the version of the booking terms you accepted. When you contact us: your name, email address and what you tell us. If you leave a review: your first name, the month of your stay, your rating and your comments. When you use the website: basic technical information (IP address, browser type, pages visited) collected by our hosting and security provider for security and to keep the site running, plus anonymous, cookieless visit statistics (see the Cookie Policy). During checkout, Stripe collects device and payment information to prevent fraud. Guest details you give us about other people (for example, other guests' names): please only share these with their knowledge. We do not knowingly collect information from children except names you choose to give us as part of your party.
3. How and why we use it (and our lawful basis)
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Taking and managing your booking, payment, refunds and cancellation; sending your confirmation, arrival information and essential messages about your stay | Contract: needed to provide your booking |
| Answering your enquiries before you book | Legitimate interests (responding to you) / steps before a contract |
| Keeping financial and tax records | Legal obligation (HMRC record keeping) |
| Preventing fraud, keeping the website and booking system secure, and preventing double bookings | Legitimate interests |
| Handling complaints, damage claims and legal claims | Legitimate interests |
| Asking for a review after your stay | Legitimate interests / soft opt-in. You can opt out at booking or in any email |
| Occasional emails about free dates and offers | Consent (the unticked box at booking), or the soft opt-in for previous guests. You can unsubscribe at any time |
| Publishing your review on our website | Consent. For reviews you left on Airbnb, we only quote them with your permission |
We do not use your information for automated decision-making that has legal or similarly significant effects on you.
4. Who we share it with
We share only what each needs, with:
- Stripe Payments UK Ltd: payment processing and refunds (Stripe is an independent controller for some data it collects for fraud prevention and regulatory purposes; see stripe.com/gb/privacy).
- Cloudflare (D1 database): our booking-system database (processor).
- Cloudflare: website hosting, security and cookieless analytics (processor).
- Resend: sending booking emails (processor).
- Cleaners or maintenance help acting for us: only your arrival and departure dates and party size, never your contact or payment details unless needed.
- Other booking channels via calendar sync: only blocked dates are shared, with no personal information.
- Professional advisers (e.g. our accountant), insurers, and the police or authorities where required by law. We do not sell your information.
5. International transfers
Some of our providers (for example Stripe, Cloudflare and Resend) may process data outside the UK, including in the USA or EU. Where that happens, the transfer is protected by UK adequacy regulations (including the UK–US Data Bridge for certified companies) or by the International Data Transfer Addendum / standard contractual clauses that these providers offer.
6. How long we keep it
- Booking and payment records: 6 years after the end of the tax year in which the stay took place (HMRC requirement).
- Enquiries that do not lead to a booking: 12 months.
- Marketing preferences: until you unsubscribe, then a suppression record so we don't contact you again.
- Published reviews: while they are relevant and you have not asked us to remove them.
- Security logs: up to 90 days.
- Abandoned checkout details: 30 days.
7. How we protect it
Data is stored with reputable providers using encryption in transit and at rest, access controls (row-level security on our database), and two-factor authentication on our accounts. Your Manage booking link contains a long random code. Please don't share it.
8. Your rights
You have the right to: access your information; have inaccurate information corrected; have it erased (unless we must keep it, e.g. for tax records); restrict or object to our use of it (including an absolute right to object to marketing); data portability; and to withdraw consent at any time. To use any of these rights, email hello@thespringcottage.co.uk. We'll respond within one month. If you are unhappy with how we have handled your information, please tell us first. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.
9. Changes
We may update this policy. The current version and its effective date will always be on this page.