Privacy Policy
Who we are
Brickhaven Property Ltd, a company registered in England and Wales under company number 16561425, whose registered office is 7 Seaborn Drive, Witham, CM8 1ZD, trading as Bower & Beck. We operate three holiday lodges in the Lake District and South Lakeland.
For the information described here we are the data controller — we decide what is collected and why. Where that is not true, this policy says so explicitly: see Where we are not the controller.
To reach us about anything in this policy, use our contact page.
What we collect, why, and on what basis
Under UK GDPR every use of personal information needs a lawful basis. Ours are set out in full below, so you can see exactly which one applies to which activity.
| What | Why | Lawful basis |
|---|---|---|
| Booking details — name, email, phone, party size, dates, and whether a dog is coming | To take and honour your booking, get you into the lodge, and message you about your stay | Contract — we cannot provide the stay without it |
| Payment information | To take payment for a stay or an add-on | Contract, and legal obligation for the accounting record |
| Enquiry form — your name, email and message | To answer you | Legitimate interests — replying to someone who asked us a question |
| Newsletter — your email address, plus which lodge you stayed at and how you found us, where we know it | To send occasional emails about the lodges and the area | Consent — only ever after you tick the box |
| Add-on purchases — the reservation code you enter, and what you bought | To fulfil the extra you paid for and attach it to the right stay | Contract |
| Visit statistics — pages viewed, referring site, country, device type. No cookies, no identifiers, nothing that singles you out | To see which pages help people book | Legitimate interests — measuring our own website without tracking anyone |
| Google Analytics — cookies that recognise a returning browser | To understand which routes into the site lead to bookings | Consent — loaded only if you press Accept, never before |
We do not sell your information, we do not use it to make automated decisions about you, and we do not profile you. We ask children for nothing; a booking is made by an adult.
What we deliberately do not collect
- We never store full card numbers. Card details go straight to Stripe and we never see them.
- Our analytics events carry no name, email address or reservation code.
- Our price-checking endpoint is asked only for a lodge, two dates and a number of guests. It is never told who you are.
Who processes it for us
These companies handle information on our behalf and under our instructions. Each is bound by a contract that limits them to what we ask, and each has its own privacy policy covering how it operates.
| Service | What it does for us | Where |
|---|---|---|
| Netlify | Hosts this website and receives what you type into its forms | United States |
| Hospitable | Runs bookings, availability and guest messaging | United States |
| Stripe | Takes payment for add-ons | United States and Ireland |
| Resend | Stores newsletter subscribers and sends the emails | United States |
| Plausible Analytics | Counts visits without cookies or personal data | European Union |
| Google Analytics | Measures visits, but only for people who accept cookies | United States |
We share your information with no one else. We do not pass it to advertisers, and there are no advertising trackers on this site.
Where we are not the controller
Two things happen alongside this website that are not ours to control, and it would be wrong for this policy to imply otherwise.
- Booking through Airbnb, Booking.com or Vrbo. That platform is its own data controller. It decides what it collects from you and holds it under its own privacy policy. We receive only the booking information it passes to us.
- Hospitable's checkout pages. When you press the booking button you leave this site for booking.hospitable.com. Those are Hospitable's pages, running Hospitable's own technologies under their policies. Any measurement tools configured there load independently of the cookie choice you made on this site.
How long we keep it
We would rather tell you what is actually true than publish a tidy table of periods we do not enforce.
- Newsletter subscribers — until you unsubscribe. One click in any email removes you, and after that we keep only the record needed to make sure we do not email you again.
- Booking and payment records — kept for at least six years after the end of the relevant financial year, because UK tax law requires it.
- Enquiries and form submissions — held in Netlify for as long as we may need them to deal with your enquiry.
- Analytics — Plausible holds no personal data at all. Google Analytics retention is a setting on the account.
Still to be set by us. Two of the periods above are not yet fixed to a specific number: how long enquiry submissions stay in Netlify, and the Google Analytics retention window. Until they are, this policy says what it can honestly say. If you want your enquiry deleted sooner, ask us and we will delete it.
Information leaving the UK
Most of the services above are based in the United States, so your information is transferred outside the UK. Those transfers rely on the safeguards UK data protection law provides for — the UK Addendum to the European Commission's Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework, depending on the provider. Plausible stores its data inside the European Union.
To be confirmed by us: the exact transfer mechanism each provider relies on, recorded provider by provider. If you need that detail now, ask and we will get it for you.
Your rights
Under UK GDPR you have the right to:
- Access — ask for a copy of the personal information we hold about you.
- Rectification — have anything inaccurate corrected.
- Erasure — ask us to delete it, where we have no obligation to keep it.
- Restriction — ask us to pause using it while something is being sorted out.
- Portability — receive what you gave us in a machine-readable form.
- Objection — object to us relying on legitimate interests.
- Stop marketing — an absolute right. Unsubscribe from any email, or ask us.
- Withdraw consent — at any time, for anything we do on the basis of consent. It does not undo what was done beforehand. "Cookie settings" in the footer of every page reopens the cookie choice and switches it off.
Ask through our contact page. We will respond within one month, and we will not charge you for it.
Complaints
If you think we have handled your information badly, tell us first through the contact page — we would rather fix it.
You also have the right to complain directly to the UK's data protection regulator, and you can do that without coming to us first. The Information Commissioner's Office: ico.org.uk/make-a-complaint, or by telephone on 0303 123 1113.
Review status
This policy was written from an audit of what this website and its connected services actually do. It is intended to be factually complete and is not legal advice. It has not yet been reviewed by a solicitor, and it should be before it is relied on as a compliance document. The two items flagged above still need a decision from us.