Privacy Policy & GDPR Notice

In plain English: When you make a booking or enquiry, we collect your name, email address and phone number so that Tamsin can communicate with you about your stay. We don't sell your data, we don't use it for marketing, and you can ask us to delete it at any time.

1. Who We Are

Poppy Cottage is a self-catering holiday let at 4 St Hilda's Place, Loftus, North Yorkshire, TS13 4HQ, operated by Tamsin Lee ("we", "us", "our").

For the purposes of UK GDPR, Tamsin Lee is the Data Controller for personal data collected through this website. Our website is hosted and maintained by Generative Solutions UK on servers located in the United Kingdom.

To contact us regarding your data: tamsin.lee@talk21.com

2. What Data We Collect

We collect personal data only when you actively provide it to us through our booking request or enquiry forms.

Data	Collected via	Why we need it
Full name	Booking & enquiry form	To identify you and address communications
Email address	Booking & enquiry form	To send booking confirmations and correspondence
Phone number	Booking & enquiry form	To confirm your booking and take payment by phone
Check-in / check-out dates	Booking & enquiry form	To check availability and manage the booking calendar
Number of guests & dogs	Booking & enquiry form	To ensure the property is suitable for your party
Special requests / messages	Booking & enquiry form	To accommodate your requirements and respond to your enquiry

What We Do Not Collect

Payment card details — all payments are taken by phone and we do not store card information
Government-issued identification
Sensitive personal data (health, religion, ethnicity, etc.)
Location or device data beyond standard server access logs

3. How We Use Your Data

We use your personal data solely for the purpose of managing your booking or responding to your enquiry. Specifically:

To respond to your enquiry and provide information about Poppy Cottage
To confirm, manage and administer your booking
To contact you about your stay (check-in details, arrival instructions, payment)
To maintain an accurate booking calendar and avoid double bookings
To send the host (Tamsin) a notification when a new booking request or enquiry is received

We do not use your data for direct marketing, profiling, or any automated decision-making. We will never sell, rent or share your personal data with third parties for their own marketing purposes.

4. Legal Basis for Processing

Under UK GDPR, we rely on the following legal bases to process your personal data:

Contract (Article 6(1)(b)) — processing is necessary to fulfil your booking or take steps at your request before entering into a booking agreement.
Legitimate interests (Article 6(1)(f)) — for enquiries where no booking yet exists, we have a legitimate interest in responding to your message and keeping a record of that correspondence.

5. How Your Data Is Stored

Your data is stored in a MySQL database on a private server operated by Generative Solutions UK, located in the United Kingdom. The server is not publicly accessible and is protected by firewall rules restricting access to authorised systems only.

Access to guest data through the admin panel requires a password. All data in transit between your browser and our website is encrypted using TLS (HTTPS).

Booking and enquiry data may also appear in email notifications sent to the host via Gmail (Google's servers, subject to Google's data processing terms).

6. How Long We Keep Your Data

We retain personal data for as long as it is necessary for the purpose it was collected:

Completed bookings — retained for up to 3 years for financial record-keeping and to handle any post-stay queries or disputes.
Enquiries that did not result in a booking — retained for up to 12 months and then deleted.
Cancelled bookings — retained for up to 12 months.

You may request earlier deletion at any time (see Your Rights below).

7. Sharing Your Data

We do not share your personal data with third parties except in the following limited circumstances:

Email delivery — notification emails to the host are transmitted via Gmail (Google LLC). Google acts as a data processor under Google's Terms of Service and Data Processing Addendum.
Airbnb — if your booking originated via Airbnb, your data may be synchronised from Airbnb's iCal feed (dates only — no personal details are transferred from Airbnb to us via iCal).
Legal obligation — where we are required by law to disclose information to law enforcement or regulatory authorities.

We do not use advertising networks, analytics platforms (such as Google Analytics), or social media tracking pixels on this website.

8. Cookies

This website uses only a single, essential session cookie required for the booking and enquiry forms to function (CSRF protection and form session state). This cookie:

Does not track you across other websites
Does not contain personal information
Is deleted when you close your browser (session cookie)

We do not use advertising cookies, analytics cookies, or any third-party tracking cookies. No cookie consent banner is required for strictly necessary cookies under UK PECR.

9. Your Rights Under UK GDPR

As a data subject, you have the following rights regarding your personal data:

Right of Access You can request a copy of all personal data we hold about you.

Right to Rectification You can ask us to correct inaccurate or incomplete data.

Right to Erasure You can ask us to delete your personal data ("right to be forgotten"), subject to legal retention requirements.

Right to Restriction You can ask us to restrict how we use your data while a complaint is being resolved.

Right to Data Portability You can request your data in a structured, commonly used, machine-readable format.

Right to Object You can object to processing based on legitimate interests.

To exercise any of these rights, please contact us at tamsin.lee@talk21.com. We will respond within 30 days. There is no charge for exercising your rights.

If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint or by calling 0303 123 1113.

10. Children's Privacy

Our website is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has submitted data to us, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The "last updated" date at the top of this page will reflect any changes. We encourage you to review this page periodically.

12. Contact Us

For any questions, requests or complaints relating to your personal data:

Email: tamsin.lee@talk21.com
Address: 4 St Hilda's Place, Loftus, North Yorkshire, TS13 4HQ