Privacy Policy
Last updated: 23 September 2025
1) Who we are
Abode Retreats Limited ("Abode Retreats", "we", "us") is the data controller for personal data collected via our website and any direct booking or enquiry channels we operate in the UK.
2) Scope
This policy explains what we collect, why we collect it, how we use it, who we share it with, how long we keep it and the rights you have under UK GDPR and the Data Protection Act 2018.
3) Data we collect
We collect the following categories of information:
a) Device & usage data (when you visit our site): IP address, browser type, time zone, device identifiers, pages viewed, referring URLs, and interactions with our site. Some of this is captured via cookies and similar technologies (see Cookies & analytics).
b) Contact & enquiry data: Information you provide via forms (e.g., name, email address, phone number, message content, preferred dates, party size), plus timestamps and communication logs.
c) Booking & payment data (for direct bookings): Guest names, contact details, stay details, pricing, payment status, and transaction references. Card details are processed by our payment providers; we do not store full card numbers.
d) Operational data: Communications related to your stay, housekeeping or maintenance requests, incident reports, and feedback/reviews.
e) Marketing preferences: Your choices about receiving updates, offers, or newsletters.
We do not intentionally collect special category data (e.g., health, religion) via our website. Please do not include such data in free‑text fields.
4) Legal bases for processing (UK GDPR)
We use your data on the following lawful bases:
Contract: to respond to enquiries, take and manage bookings, and deliver our services.
Legitimate interests: to run and protect our business (e.g., site analytics, fraud prevention, security, improving guest experience). We balance these interests against your rights.
Consent: for optional cookies/marketing where required. You can withdraw consent at any time.
Legal obligation: to comply with laws (e.g., tax, accounting, public safety requests).
5) How we use your data
Provide and manage bookings, guest communications, check‑in/out and customer support.
Send service messages (e.g., booking confirmations, updates).
Improve our website, services and guest experience (analytics and troubleshooting).
Personalise content/offers where legally permitted.
Detect, investigate and prevent fraud or misuse.
Comply with legal and regulatory requirements.
6) Cookies & analytics
We use cookies and similar tools to operate the site, remember preferences and understand usage. Where required, we will present a cookie banner so you can accept or reject non‑essential cookies. You can change preferences at any time via your browser settings or our cookie controls. See our Cookie Notice for details.
7) Sharing your data
We share personal data with trusted service providers acting under contract, including:
Technology and hosting providers (website, email, CRM, analytics, security).
Payment processors (for direct bookings).
Channel and booking platforms (if you book via a third‑party marketplace, they act as an independent controller for their use of your data).
Professional advisers (lawyers, accountants), insurers, and public authorities where required.
We require processors to safeguard your data and use it only on our instructions. If the law requires, we may disclose data to regulators or law enforcement.
8) International transfers
Some providers may process data outside the UK/EEA. Where this happens, we rely on legally recognised safeguards (e.g., the UK International Data Transfer Agreement/Clauses or adequacy regulations) to protect your information.
9) Retention
We keep personal data only as long as necessary for the purposes described above:
Enquiry data: typically up to 24 months.
Booking and financial records: typically 6–7 years to meet legal obligations.
Device/analytics data: per our Cookie Notice and provider settings.
When no longer needed, data is securely deleted or anonymised.
10) Your rights (UK GDPR)
You have the right to: access, rectify, erase, restrict or object to processing, and port your data. Where we rely on consent, you may withdraw it at any time. We do not use your data for automated decision‑making that produces legal or similarly significant effects.
How to exercise your rights: Use the Contact Us form on our website and select the relevant privacy option. We may need to verify your identity before responding. We aim to respond within one month.
11) How to contact us
For privacy queries, requests, or complaints, please use the Contact Us form on our website. Messages submitted through that form are routed to our privacy team for prompt handling.
12) Complaints
You can raise concerns with us first (preferred). You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk.
13) Security
We use administrative, technical and physical safeguards appropriate to the risk (access controls, encryption in transit, backups, monitoring). No method of transmission or storage is 100% secure; we continually improve our controls.
14) Children
Our services are not directed to children. If you are under 13, please do not submit personal data via our site. If we learn we have collected data from a child, we will delete it.
15) Links to other sites
Our site may link to third‑party websites. Their privacy practices are their responsibility; we encourage you to review their policies.
16) Changes to this policy
We may update this policy from time to time. Material changes will be highlighted on this page. The "Last updated" date shows the most recent revision.
Cookie Notice (summary)
We use:
Essential cookies: required for site operation and security.
Analytics/performance cookies: to understand usage and improve the site (set only with your consent, where required).
Preference cookies: to remember choices you make.
You can control cookies via your browser and our cookie settings. Blocking some cookies may affect site functionality.