1 · Who we are
Galloway Retreats (“we”, “us” or “our”) is a trading name of Galloway Retreats, a company registered in [Scotland / England and Wales] under company number [COMPANY NUMBER], with its registered office at [REGISTERED ADDRESS].
For the purposes of data protection law, we are the “data controller” — meaning we decide how and why your personal data is processed. This policy covers your use of www.gallowayretreats.co.uk (the “Website”), any booking you make with us, and any other contact you have with us.
You can reach us about anything in this policy at [email protected].
2 · The data we collect
Depending on how you interact with us, we may collect and process the following categories of personal data:
- Identity and contact data — your name, postal address, email address and telephone number.
- Booking data — the retreat or accommodation booked, dates of stay, number of guests, guest names, and any preferences or special requirements you tell us about (for example accessibility or dietary needs).
- Payment data — details needed to process your payment. Card payments are handled by our payment provider; we do not store full card numbers on our own systems.
- Enquiry and correspondence data — the content of messages you send us through our contact or enquiry form, by email, or by phone.
- Marketing data — your preferences for receiving marketing from us and your communication preferences.
- Technical and usage data — your IP address, browser type and version, device information, and information about how you use our Website, collected through cookies and similar technologies.
Where you provide personal data about other people (for example other guests on your booking), you confirm you have their permission to share it with us for the purposes described in this policy.
3 · How we collect your data
We collect personal data when you:
- make or request a booking;
- complete our contact or enquiry form, or email or call us;
- sign up to our newsletter or mailing list;
- browse our Website (through cookies and analytics); and
- correspond with us in any other way.
4 · How we use your data and our legal basis
Under UK GDPR we must have a lawful basis for processing your personal data. The table below sets out what we use your data for and the basis we rely on:
| What we use your data for | Lawful basis |
|---|---|
| Managing your booking, taking payment, and providing your retreat or accommodation | Performance of a contract with you |
| Responding to your enquiries and correspondence | Legitimate interests (to answer your questions and manage our relationship with you) |
| Sending you service messages about your booking (e.g. confirmations, check-in details, changes) | Performance of a contract with you |
| Sending you marketing emails and newsletters | Consent (which you can withdraw at any time) |
| Analysing how our Website is used and improving it | Consent (for non-essential cookies) and legitimate interests |
| Keeping records and complying with legal, accounting and tax obligations | Legal obligation |
| Protecting our business, preventing fraud, and establishing or defending legal claims | Legitimate interests |
5 · Who we share your data with
We do not sell your personal data. We share it only with trusted third parties who help us run our business, and only to the extent necessary. These may include:
- Payment providers (for example [Stripe / PayPal / your provider]) to process payments securely;
- Booking and reservation software we use to manage availability and reservations;
- Email and newsletter providers (for example [Mailchimp / your provider]) to send communications you have signed up for;
- Website hosting and IT providers who host and maintain the Website;
- Analytics providers (for example Google Analytics) to understand how the Website is used;
- Professional advisers such as accountants and legal advisers; and
- Government bodies, regulators and law enforcement where we are legally required to do so.
All third parties who process data on our behalf are required to keep it secure and to use it only for the purposes we specify.
6 · Cookies and analytics
Our Website uses cookies and similar technologies. Cookies are small text files placed on your device that help the site function and let us understand how visitors use it.
- Essential cookies are necessary for the Website to work and cannot be switched off.
- Analytics cookies (such as Google Analytics) help us measure and improve how the Website performs. These are only set with your consent.
- Marketing cookies, where used, help us measure the effectiveness of our advertising. These are only set with your consent.
When you first visit the Website you can accept or reject non-essential cookies, and you can change your preferences at any time. You can also control cookies through your browser settings. Blocking some cookies may affect how the Website works.
7 · Marketing communications
We will only send you marketing emails if you have asked us to or otherwise consented. You can unsubscribe at any time by clicking the “unsubscribe” link in any marketing email, or by contacting us at [email protected]. Opting out of marketing will not stop service messages that relate to a booking you have made.
8 · How long we keep your data
We keep your personal data only for as long as necessary for the purposes we collected it for, including to satisfy any legal, accounting or reporting requirements. In general:
- Booking and payment records are kept for up to 7 years to meet tax and accounting obligations.
- Enquiry correspondence is kept for as long as needed to deal with your query and for a reasonable period afterwards.
- Marketing data is kept until you unsubscribe or ask us to delete it.
When we no longer need your data, we will securely delete or anonymise it.
9 · How we keep your data safe
We have appropriate technical and organisational measures in place to protect your personal data against unauthorised access, loss, misuse or alteration. We limit access to your data to those who need it, and our third-party providers are chosen for their security standards. Where you are required to create login details, please keep them confidential.
10 · International transfers
Some of our service providers may be based outside the UK. Where we transfer your personal data outside the UK, we ensure a similar degree of protection by relying on an approved safeguard, such as an adequacy decision or the International Data Transfer Agreement (or Standard Contractual Clauses with the UK Addendum).
11 · Your rights
Under UK data protection law you have the following rights, free of charge in most cases:
- Access — to request a copy of the personal data we hold about you.
- Rectification — to have inaccurate or incomplete data corrected.
- Erasure — to ask us to delete your data in certain circumstances.
- Restriction — to ask us to limit how we use your data.
- Objection — to object to processing based on our legitimate interests, and to direct marketing at any time.
- Portability — to receive certain data in a portable format.
- Withdraw consent — to withdraw consent at any time where we rely on it.
To exercise any of these rights, contact us at [email protected]. We will respond within one month. We may need to verify your identity before acting on a request.
12 · Children’s privacy
Our Website and services are not directed at children, and we do not knowingly collect personal data from children. Bookings must be made by an adult aged 18 or over. If you believe a child has provided us with personal data, please contact us so we can remove it.
13 · Changes to this policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page with a revised “Last updated” date. We encourage you to review it periodically.
14 · How to contact us and complain
If you have any questions about this policy or how we handle your data, please contact us:
- Email: [email protected]
- Post: Galloway Retreats, [REGISTERED ADDRESS]
If you are not satisfied with our response, you have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection:
- Website: ico.org.uk
- Helpline: 0303 123 1113
We would, however, appreciate the chance to address your concerns before you approach the ICO, so please do contact us first.