Beautiful Mews Cottage privacy policy

Draft for approval | Prepared 7 October 2026

This policy explains how Ovingdowns Limited collects and uses personal information when you visit beautifulmewscottage.co.uk, enquire about or book a stay, stay at Beautiful Mews Cottage or receive our marketing emails. We comply with applicable UK data protection law, including the UK GDPR and Data Protection Act 2018, and the Privacy and Electronic Communications Regulations.

1. Who we are

Beautiful Mews Cottage is operated by Ovingdowns Limited, registered in England and Wales under company number 13337838. Ovingdowns Limited is the controller responsible for the personal information described in this policy.

Business contact address: The Old Wheel House, 31/37 Church Street, Reigate, RH2 0AD.
Privacy contact: Alison Kelly
Email: alisonkelly30@virginmedia.com

2. Information we collect

Booking and contact information: your name, email address, telephone number, any address required for the booking, booking references, stay dates, guest numbers and information needed to administer your stay.

Correspondence: enquiries, requests, arrival arrangements, feedback and communications relevant to a booking, complaint or incident.

Transaction information: amounts payable, payment status, payment references and refund records. Stripe processes payment-card information. We use transaction information to administer bookings, payments and refunds.

Marketing information: your name, email address, marketing preferences and records of how and when you became eligible to receive marketing or opted out.

Technical and website information: information relating to website visits, such as IP addresses in server or security logs, browser and device information, pages accessed and traffic information. Analytics may provide an approximate location derived from technical information. The information processed depends on the service and settings used.

We do not routinely request health information. See section 5 if you need to discuss accessibility or assistance. Please do not provide information that is unnecessary for your enquiry or booking.

3. How we receive information

We receive information when you use our website and Lodgify booking system, or contact us by email, telephone, messaging services, social media or in person. Lodgify receives and manages booking information on our behalf. Stripe provides relevant transaction information when payments and refunds are processed.

We may receive information about accompanying guests from the person making the booking. Please make other guests aware of this policy if you provide their information. We collect information about children only where necessary to administer the booking and stay.

4. Purposes and lawful bases

We use information only where we have a lawful basis. The principal purposes and bases are set out below.

Purpose	Information used	Lawful basis
Respond to booking requests, arrange and administer reservations, communicate about arrival and access, and manage payments/refunds	Booking, contact, correspondence and transaction information	Contract with the person booking, or steps at their request before entering a contract.
Respond to general enquiries and communicate with accompanying guests	Contact and correspondence information; relevant booking details	Legitimate interests in responding to enquiries and providing accommodation.
Resolve complaints, recover debts, prevent fraud and establish or defend legal claims	Relevant booking, contact, correspondence and transaction information	Legitimate interests in protecting the business and resolving disputes; legal obligation where applicable.
Maintain necessary accounting and tax records	Essential booking and transaction information	Compliance with legal obligations.
Send promotional emails about our accommodation	Name, email address and marketing eligibility/preferences	Legitimate interests where the PECR soft opt-in conditions are met; otherwise consent.
Operate and secure the website and booking systems	Technical information and security logs	Legitimate interests in operating reliable, secure services.
Understand website use through Google Analytics	Analytics and device information	Consent for the consent-based analytics setup described in section 10.

Our legitimate interests include managing the property, providing a reliable service, protecting our business and encouraging repeat bookings. We assess these interests against your rights. If you do not provide information needed for a booking, we may be unable to arrange or administer it. Marketing is optional and does not affect your booking.

5. Accessibility and health information

Please contact Alison Kelly directly about accessibility or assistance needs rather than entering health information into the online booking form. Lodgify’s processing terms state that its services are not intended for sensitive information.

Where health information is necessary to respond to an assistance request, we obtain explicit consent and rely on consent under Article 6(1)(a) and explicit consent under Article 9(2)(a) of the UK GDPR. You may withdraw consent at any time, although this may affect our ability to meet the request.

Where health information is necessary to establish, exercise or defend a legal claim, we rely on legitimate interests under Article 6(1)(f) and the legal-claims condition under Article 9(2)(f). We use only necessary information and restrict access. We do not treat these conditions as permission to collect health information for every incident.

6. Bookings and payments

Our direct booking process uses our website, Lodgify and Stripe. Lodgify, provided by Codebay Solutions Limited, processes guest booking information on behalf of Ovingdowns Limited. We access the information needed to administer reservations and communicate about stays. We remain responsible for our use of that information.

Lodgify’s data-processing terms: https://www.lodgify.com/dpa/. Its general website privacy policy is not a replacement for this guest privacy notice.

Stripe processes payments and relevant refunds. We receive transaction information needed to administer your booking. Stripe also processes information for its own purposes, including fraud prevention, security and legal compliance, and acts as a controller for those purposes. Its policy explains these uses and your rights: https://stripe.com/gb/privacy.

7. Marketing emails

We may send occasional emails about availability, future stays and special offers at Beautiful Mews Cottage. We use Mailchimp to manage our mailing list and send these emails.

We rely on the products-and-services soft opt-in under PECR only where we obtained your details directly, including through Lodgify acting on our behalf, during a booking or genuine negotiations about a booking; offered a clear, simple opportunity to opt out when collecting the details; and provide an easy opt-out in every marketing email. These emails concern only our own similar accommodation services. Our UK GDPR basis is our legitimate interest in promoting our accommodation and encouraging repeat bookings.

Where those conditions are not met, we send marketing only with your affirmative consent, and consent is our lawful basis. We do not assume that providing an email address, accepting booking terms or reading this policy gives marketing consent.

You have an unconditional right to object to direct marketing. Use the unsubscribe link in any marketing email or email alisonkelly30@virginmedia.com. We stop sending promotional emails when you opt out. Withdrawal of consent does not affect the lawfulness of earlier processing.

Opting out does not stop necessary communications about an enquiry, booking or stay. We keep a minimal suppression record to respect your choice.

8. Who receives information

We share only information needed for the relevant purpose with Lodgify for bookings, Stripe for payments and Mailchimp for permitted marketing. Website hosting, email and IT providers may process information needed to operate those services. Google processes relevant website analytics information when analytics is enabled in accordance with your choice.

Accountants, professional advisers and insurers may receive necessary information for accounting, advice or claims. We may disclose information to public authorities where legally required.

Providers acting as processors handle information under appropriate processing terms. Some providers, including Stripe for certain purposes, act as independent controllers and apply their own privacy policies. We do not sell your personal information or share it for other organisations’ marketing.

9. International processing

Using online providers can involve processing outside the UK. Overseas processing is relevant even though our business and property are UK-based.

Mailchimp’s processing terms allow processing in the United States and other countries where its affiliates or sub-processors operate. They provide for the UK Extension to the EU–US Data Privacy Framework where applicable, and Standard Contractual Clauses with the UK International Data Transfer Addendum where required. See https://mailchimp.com/legal/data-processing-addendum/.

Stripe operates internationally. Its applicable transfer arrangements and safeguards are explained in its privacy policy and Privacy Center: https://stripe.com/gb/privacy.

Contact Alison Kelly for further information about relevant international transfers or copies of applicable safeguards, subject to appropriate redaction of confidential information.

10. Cookies and website analytics

Our website uses a cookie to remember your cookie preferences and uses Google Analytics to help us understand visits and improve the website. Analytics information can include pages visited, traffic sources, device/browser information and approximate geographic information.

For the consent-based configuration covered by this draft, analytics cookies are used only after you choose to accept them. You can reject analytics cookies and later withdraw consent through the website’s cookie controls. Rejecting analytics cookies does not prevent you from making a booking.

You can also change browser settings to block or delete cookies. Blocking cookies needed for requested booking or payment functions may affect those functions. Browser settings are an additional control, not a substitute for the website’s analytics choice.

11. How long we keep information

We keep information only for as long as needed for its purpose. We do not retain all guest information for the lifetime of the property.

Marketing contact details: until you opt out or up to three years after your last booking or genuine booking enquiry, whichever is sooner. A new affirmative subscription is assessed separately. Opt-out records are not overridden by a later booking.

Enquiries that do not lead to bookings: up to 12 months after the last contact, unless needed for an unresolved matter or lawfully retained separately for marketing.

Routine guest correspondence and incidental stay information: up to 12 months after the stay, unless required as part of an essential booking record, complaint or claim.

Essential booking, payment and accounting records: for the applicable accounting and tax retention period and, where necessary, while relevant legal claims may be brought or remain unresolved. The period depends on the record, the applicable statutory rules and the circumstances of any dispute.

Health information provided for assistance: deleted when no longer necessary for the request and stay, unless a separate lawful reason requires retention. Claim-related records are retained only while needed for the claim and applicable legal requirements.

Suppression records: minimal information needed to honour marketing opt-outs while we continue the relevant marketing activity.

We review longer-held complaint, incident and claim records and delete information when no longer needed. When the property business ceases, we review remaining information and retain only records still necessary for legal obligations, outstanding matters or other lawful purposes.

We manage deletion with processors in accordance with their contractual arrangements and backup cycles. Independent controllers, including Stripe for its own purposes, apply their own retention rules.

12. Your rights and complaints

Depending on the circumstances, you have rights to access your personal information, correct inaccuracies, request erasure, restrict processing and receive or transfer certain information in a portable form. You can object to processing based on legitimate interests and object to direct marketing at any time.

Where we rely on consent, you can withdraw it at any time. Some rights are subject to legal conditions; for example, we may need to retain accounting records despite an erasure request.

Email Alison Kelly at alisonkelly30@virginmedia.com or write to our business contact address to exercise your rights. We normally respond within one month, subject to lawful extensions or other permitted adjustments. We may need proportionate information to verify your identity. Requests are normally free of charge.

You can complain to the Information Commissioner’s Office: https://ico.org.uk/make-a-complaint/. We welcome the opportunity to address concerns, but this does not remove your right to complain to the ICO.

13. Security and policy updates

We use appropriate technical and organisational measures to protect personal information and limit access to people who need it. No online service can guarantee complete security. Please tell us if your contact or booking details change.

Third-party websites have their own privacy policies. We may update this policy when our services or legal requirements change. The current version and update date will appear on our website. We will notify you of material changes in how we use your information where required.