This notice explains what personal information we collect when you use this website or book a stay, why we need it, and your rights.
Who we are
Harrogate Hidden Stay, The Duchy, Harrogate, is responsible for your personal information (the "data controller"). You can contact us at [email protected] or on 07734 023826.
What we collect
- When you book: your name, email address, mobile number, the dates and number of guests, any extras, discount code and notes you give us, and the amount you paid. The last 4 digits of your mobile number are used as your personal door code during your stay.
- When you buy a gift voucher: your name and email address, the name and email address of the person it is for if you ask us to email it to them, your message, and the voucher amount. We use the recipient's details only to deliver the voucher and to let them use it.
- When you send an enquiry: your name, email address, preferred dates and your message.
- When you use live chat: your name, email address and the messages you send. Your browser stores a private chat code so you can carry on the conversation later.
- Payments: handled by Stripe. Your card details go directly to Stripe and never reach us. Stripe keeps your card on file so that we can take the balance on the date you agreed (if you paid a deposit) and place the Good Housekeeping Bond hold before you arrive.
- Newsletter: if you sign up on this website, your email address, name (if you give it) and the interests you choose. You are only added once you click the link in our confirmation email.
- Reviews: if you leave a review, we keep your rating, what you wrote and the name you give us. We may show your review and that name on this website.
- Technical information: our hosting provider processes your IP address and basic browser information to deliver the website and protect it from abuse.
Why we use it
- To take and manage your booking or gift voucher, send your confirmation and arrival details, and look after you during your stay. The legal basis is that it is necessary for our contract with you.
- To answer your enquiries. The legal basis is our legitimate interest in responding to people who contact us.
- To keep financial records we are required to keep by law, such as for HMRC.
- To prevent fraud and keep the website secure, which is in our legitimate interests.
We do not sell your information.
Offers and news by email. We only send these if you tick the box when you book, or sign up on this website and confirm by email. The legal basis is your consent, and we keep a record of when and how you gave it. Every one of these emails has an unsubscribe link that stops them straight away, and you can also just reply and ask.
Emails about your stay, such as your confirmation, payment and bond notices, arrival details and, after your stay, a one-off thank you with a link to leave a review, are sent to every guest as part of your booking.
Who we share it with
Only the service providers that help us run the website and your booking, under contracts that protect your data:
- Stripe, to take payments and issue refunds.
- Cloudflare, which hosts this website and our booking database.
- Resend, which delivers our booking and enquiry emails.
- Franks Media, the web studio that built and looks after this website and booking system, which can access booking records only to support and maintain them.
The typefaces on this website are served from our own site, so no third party is contacted when a page loads.
Some of these providers are based in, or process data in, the United States. Where that happens, the transfer is protected by recognised safeguards such as the UK International Data Transfer Addendum or the UK-US data bridge.
We share your booking dates, but no personal details, with Airbnb so that our calendars stay in step.
Cookies
This website does not use advertising or tracking cookies. If you use live chat, your browser stores a private chat code so the conversation can carry on; it is needed for the chat to work. Stripe may set cookies on its own payment page to prevent fraud. The owner's dashboard keeps a sign-in token in the owner's browser for the current session only.
How long we keep it
- Booking and payment records: six years after your stay, as required for tax and accounting. After that, your name and contact details are removed automatically and only the anonymous financial record remains.
- Enquiries and chat conversations: deleted automatically 12 months after the last message.
- Newsletter and offers list: until you unsubscribe. Sign-ups that are never confirmed are deleted after 30 days.
- Reviews: for as long as they are shown on this website, or until you ask us to remove them.
- Unsubscribe requests: we keep just your email address on a do-not-email list, so we never email you again by mistake.
Your rights
You can ask us for a copy of the information we hold about you, and ask us to correct it, delete it, restrict how we use it, or object to our using it. Just email us. We will reply within one month and there is no charge.
If you are unhappy with how we have handled your information, please tell us first. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.