Privacy policy

Version 1.1 (October 2025)

Introduction and important information

The Old Granary (“we”, “us” or “our”) are committed to protecting and respecting your personal data and privacy. This privacy policy relates to how we use and collect personal data from you when you book with us as a guest or visitor to our self-catering accommodation (the Property), use our services or access our website www.theoldgranary.net It also relates to our use of any personal information you provide to us by telephone (including SMS or WhatsApp), in written correspondence (including letter and email), through our social media channels and in person.

Our website is not intended for children under the age of 18, but we may collect personal data belonging to children who are guests of the Property. Our website may also include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements.

WHO WE ARE AND HOW TO CONTACT US

For the purposes of the Data Protection Laws, the data controller is Amanda Brown.

Email: mail@theoldgranary.net

Telephone: 07988 793763

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.

THE DATA WE COLLECT ABOUT YOU

We collect and process personal data such as:

Identity Data (name, title, date of birth, gender, images)

Contact Data (email, telephone, address)

Transaction Data (details of services purchased or visits)

Financial Data (payment details)

Technical Data (IP address, browser info, login data)

Profile Data (preferences, feedback, survey responses)

Usage Data (information on how you use our property, website, services)

Marketing and Communications Data (preferences for receiving communications)

We do not routinely collect special categories of personal data, except limited health information required to provide special assistance or record incidents.

HOW IS YOUR PERSONAL DATA COLLECTED?

We collect data through direct interactions (eg, booking, enquiries), automated technologies (eg. cookies), visits to the Property and third parties (eg. analytics providers, payment providers).

HOW YOUR DATA WILL BE USED

We use your personal data to:

Provide self-catering accommodation and related services

Manage payments and recover debts

Provide special assistance services

Communicate with you, including service changes and feedback

Record incidents for legal and safety reasons

Run competitions or surveys

Administer and protect our business and website

Measure marketing effectiveness and improve services

Send relevant recommendations or offers

We never sell your data to third parties or allow third parties to contact you without permission.

LAWFUL BASIS FOR PROCESSING

We process your data where we have identified a valid lawful basis:

Contractual obligation

Legitimate interests

Consent

Legal obligation

Vital interests or public task (rare)

We may process your personal data without your knowledge or consent where this is required or permitted by law.

THIRD PARTIES AND SHARING INFORMATION

We share data with trusted third-party service providers (data processors) to supply and support our services, including IT support, email, website hosting, payment processors, accountants, insurers, solicitors, software providers, couriers and marketing agencies. These processors are required to keep your data secure and only process it according to our instructions.

DATA SECURITY

We have appropriate technical and organisational measures to prevent accidental loss, unauthorised access, alteration or disclosure of your personal data. Access is limited to individuals and entities who have a business need to know and are bound by confidentiality obligations. We have procedures to deal with any suspected personal data breach and will notify you and regulators where required.

DATA RETENTION

We retain personal data only for as long as reasonably necessary to fulfil the purposes we collected it for, including legal, regulatory, tax, accounting, or reporting requirements. Typically, basic information is retained for 6 years after the relationship is retained for 6 years after the relationship ends. We may anonymise data for research or statistical purposes indefinitely.

YOUR RIGHTS

Under data protection laws, you have the rights to:

Be informed (via this policy)

Access your data

Rectify inaccuracies

Request erasure

Restrict processing

Port your data

Object to processing

Withdraw consent

You may need to provide identification to exercise these rights.

Requests can be made using the contact details above.