Privacy Policy

Last updated: 28th February 2026

Conwy Valley Getaway is committed to protecting and respecting your personal data and privacy.

This privacy policy explains how we collect and use personal data when you: make a booking with us; use our website (www.conwyvalleygetaway.co.uk); contact us by phone, email or through our website; or subscribe to our newsletter.

Please read this policy carefully. Our website is not intended for children under the age of 18, although we may collect personal data about children who are guests at our properties (for example, details relevant to their safety during their stay). We do not knowingly collect data from children directly.

Our website may include links to third-party websites. Clicking those links may allow third parties to collect data about you. We are not responsible for the privacy practices of other sites and encourage you to read their privacy policies.

Contents

Introduction and Important Information
Who We Are and How to Contact Us
The Data We Collect About You
How We Collect Your Personal Data
If You Do Not Provide Personal Data
How We Use Your Personal Data
Lawful Bases for Processing
Third Parties and Sharing Your Data
Information Security
Marketing
Cookies and Tracking Technologies
Data Retention
Your Rights
Changes to this Policy

1. Introduction and Important Information

Conwy Valley Getaway is committed to protecting and respecting your personal data and privacy.

2. Who We Are and How to Contact Us

Conwy Valley Getaway is a trading name of Penelope Orford and Suzanne Orford (a UK Partnership). We are the data controller responsible for your personal data.

Privacy contact: Penny Orford
Address: The Granary, Ffordd Llyn Syberi, Eglwysbach, Colwyn Bay LL28 5SA
Email: bookings@conwyvalleygetaway.co.uk
Telephone: 07745 570005

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk / 0303 123 1113). We would, however, appreciate the chance to address any concerns before you contact the ICO, so please get in touch with us first.

3. The Data We Collect About You

We may collect and process the following categories of personal data:

Identity Data: first name, last name, title.
Contact Data: home address, email address, telephone numbers.
Financial Data: payment card or bank account details (handled by our payment processor – we do not store card details ourselves).
Transaction Data: details of bookings, services purchased, and correspondence relating to your stay.
Technical Data: IP address, browser type and version, time zone, browser plug-in types, operating system, and other technology identifiers when you visit our website.
Usage Data: information about how you use our website.
Marketing and Communications Data: your preferences for receiving marketing from us and your communication preferences.

We do not routinely collect any Special Categories of Personal Data (such as details about your health, race, religion, or sexual orientation), except where you voluntarily provide health information relevant to your stay – for example, a disability or medical condition that affects your use of our facilities. Where we do collect such information, we handle it with additional care and use it only to support your stay.

4. How We Collect Your Personal Data

We collect data through:

Direct interactions: when you make a booking (online, by phone or email), fill in a contact form, subscribe to our newsletter, or correspond with us.
Automated technologies: when you visit our website, we may automatically collect Technical and Usage Data via cookies and similar technologies. Please see our Cookie Policy for further details.
Third parties: we receive data from booking platforms (Airbnb, Booking.com, VRBO), our payment processor (Holiday Rent Payment), our booking management system (SuperControl), and analytics providers (Google Analytics).

5. If You Do Not Provide Personal Data

Where we need personal data to fulfil a booking contract with you and you do not provide it, we may not be able to confirm your booking or provide our services. We will let you know if this applies at the time.

6. How We Use Your Personal Data

We only process your personal data where we have a valid lawful basis for doing so. The table below sets out how we use your data and our lawful basis in each case.

We never sell your personal data to third parties or allow third parties to market to you using your data without your explicit consent.

Purpose / Activity	Type of data	Lawful basis
To register you as a guest and process your booking.	Identity, Contact, Financial, Transaction	Performance of a contract with you.
To provide accommodation and connected services (including access to the pool, hot tubs and EV charger).	Identity, Contact, Transaction, Usage, Marketing & Communications	Performance of a contract with you. Legitimate interests (to recover debts due to us).
To manage our relationship with you (including notifying you of changes to our terms, policies or services).	Identity, Contact, Profile, Marketing & Communications	Performance of a contract with you. Legal obligation. Legitimate interests (to keep records up to date).
To record incidents and accidents at the property.	Identity, Contact, Usage, Health (Special Category – limited to what is necessary)	Legal obligation (health and safety). Legitimate interests (to manage our business).
To assess your compliance with our EV Charging Policy.	Identity, Contact, Usage	Legal obligation (health and safety). Legitimate interests (to keep our property safe).
To send you marketing communications (where you have consented or where permitted by law).	Identity, Contact, Profile, Marketing & Communications	Consent. Legitimate interests (to develop our services and grow our business).
To administer and protect our website.	Identity, Contact, Technical	Legitimate interests (for running our business and IT services). Legal obligation.
To use data analytics to improve our website, services, and marketing.	Technical, Usage, Profile	Legitimate interests (to keep our website updated and relevant).

7. Lawful Bases for Processing

The lawful bases we rely on are:

Contract: processing necessary to perform a contract we have with you (your booking).
Legal obligation: processing necessary to comply with the law (for example, health and safety obligations).
Legitimate interests: processing necessary for our legitimate business interests, provided those interests are not overridden by your rights and interests.
Consent: where you have given us clear consent to process your data for a specific purpose (for example, subscribing to our newsletter). You can withdraw consent at any time.

8. Third Parties and Sharing Your Data

We share your data with third-party service providers (data processors) only where necessary to operate our business and fulfil your booking. These providers are required to keep your data secure and may only use it in accordance with our instructions.

Service Provider	Location
SuperControl (booking management system)	UK
SuperControl (booking confirmation and guest communication emails)	UK
Holiday Rent Payment (payment processing)	UK
Voltshare (EV charging platform)	UK
Email provider – 20i webmail	UK
Website hosting – 20i	UK
Google Analytics (website analytics)	USA (standard contractual clauses apply)
Upfront Reviews (review aggregator)	UK
Airbnb / Booking.com / VRBO (booking platforms)	UK / EEA / USA (standard contractual clauses apply)
Accountants	UK
Insurers	UK

Some of our third-party service providers (including Google Analytics and booking platforms) process data outside the UK and European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by the UK Information Commissioner. Contact us if you wish to know more.

We may also disclose your data to law enforcement, regulators, or other authorities where required by law, or as part of any sale or transfer of our business.

9. Information Security

We use appropriate technical and organisational measures to protect your personal data from accidental loss, unauthorised access, alteration, or disclosure. Your booking information is held on SuperControl, a GDPR-compliant booking system with robust security measures in place.

We have procedures to deal with any suspected personal data breach and will notify you and the ICO where we are legally required to do so.

10. Marketing

We may use your contact details to send you occasional newsletters or updates about our cottages, availability and North Wales inspiration. We will only do this if:

you have subscribed via our newsletter sign-up form and given us your consent; or
you are an existing guest and have not opted out of marketing communications.

You can unsubscribe at any time by clicking the unsubscribe link in any email we send, or by contacting us directly. We will never share your data with third parties for marketing purposes without your explicit consent.

11. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies, including Google Analytics, which processes your IP address and browsing data to help us understand how visitors use our site. This data is used in aggregate to improve our website.

For full details of the cookies we use and how to manage your preferences, please see our Cookie Policy.

12. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements.

By law, we are required to keep basic financial and booking records (including Identity, Contact, Financial, and Transaction Data) for 6 years after the end of the relevant tax year.

Marketing data (newsletter subscribers) is retained until you unsubscribe or ask us to delete it.

Where we no longer need your data, we will securely delete or anonymise it.

13. Your Rights

Under UK data protection law, you have the following rights:

Right to be informed: to know how we use your personal data (this privacy policy fulfils this obligation).
Right of access: to receive a copy of the personal data we hold about you.
Right to rectification: to ask us to correct inaccurate or incomplete data.
Right to erasure: to ask us to delete your data in certain circumstances (the ‘right to be forgotten’).
Right to restrict processing: to ask us to pause processing of your data in certain circumstances.
Right to data portability: to receive your data in a structured, machine-readable format.
Right to object: to object to processing based on legitimate interests, including direct marketing.
Rights in relation to automated decision-making: we do not use automated decision-making or profiling.
Right to withdraw consent: where processing is based on consent, you can withdraw it at any time.

To exercise any of these rights, please contact us in writing:

Email: bookings@conwyvalleygetaway.co.uk
Post: The Granary, Ffordd Llyn Syberi, Eglwysbach, Colwyn Bay LL28 5SA

We may ask you to verify your identity before acting on a request. We aim to respond within one month. If you are unhappy with our response, you have the right to complain to the ICO (www.ico.org.uk).

14. Changes to this Policy

We keep this privacy policy under regular review and will post any updates on this page. Where changes are significant, we will notify you by email where we hold your contact details.