Privacy Policy

Cottage Orne Limited (“Cottage Orné”, “we”, “us”, “our”) respects your privacy. This policy explains what personal data we collect, how we use it, and your rights.

1) Who we are (the controller)

Cottage Orne Limited (Company No. 14176527)

Registered office: 16 Portland Close, Broughton, Aylesbury, HP22 7DG, United Kingdom

Contact: info@cottageorne.com

We are the data controller for personal data relating to your booking and stay with us, your use of our facilities, your interactions with our website, and our marketing.

2) Bookings via Inn Style

All accommodation bookings for Cottage Orné are processed via our booking partner, Inn Style (www.innstyle.co.uk).

When you click “Book Now” on our website, you will be redirected to the Inn Style platform (or interact with an embedded Inn Style window).
Inn Style collects and processes your booking and payment information and shares the necessary details with us so that we can manage your stay.
Inn Style acts as our booking agent and data processor, but they may also process data for their own legitimate business/legal purposes (e.g. fraud prevention, regulatory compliance).
You should also review Inn Style’s Privacy Policy for more information about how they handle your data.

The booking contract remains between you and us.

3) What personal data we collect

Data you provide:

Booking & stay data: name, contact details, address, party composition (including number of adults/children/dogs), stay dates, special requests.
Payment details: processed securely by Inn Style and its payment partners. We receive confirmation of payment, but we do not store or have access to full card details.
Health information: where needed for treatments, fitness activities, or where you choose to share information needed for safe use of facilities (e.g. sauna, hot tubs).
Communications: emails, calls/voicemails, texts/WhatsApp, enquiries, complaints/incident reports.
Marketing preferences: newsletter sign-up and consents.

Data we collect automatically:

Website usage: IP address, device/browser, pages viewed, referral source, cookie identifiers (see our Cookie Policy).
CCTV: images/recordings in communal areas of the site for safety and security.

Data we receive from third parties:

Inn Style: booking details, payment confirmation, communications.
Payment processors (via Inn Style): authorisation/fraud checks.
Therapists/instructors: confirmation of class/treatment bookings.

4) Why we use your data and lawful bases

Purpose	Examples	Lawful basis
Manage bookings and your stay	Take payment via Inn Style, confirm bookings, allocate accommodation, communicate with you	Contract (to perform our contract with you)
Provide facilities/services	Pool, sauna, fitness, classes, treatments	Contract; Legitimate interests (site operations/safety)
Treatments/fitness where health data is relevant	Health questionnaires, fitness readiness	Explicit consent (UK GDPR Art. 9(2)(a)); Vital interests in an emergency
Customer service	Respond to enquiries, handle complaints/incident reports	Contract; Legitimate interests (service quality, dispute resolution)
Payments & fraud prevention	Process payments via Inn Style, prevent misuse	Contract; Legitimate interests
Site safety & security (CCTV)	Deter/prevent crime, investigate incidents	Legitimate interests (safety and security)
Legal/insurance	Keep tax records, handle claims, comply with legal duties	Legal obligation; Legitimate interests (establish/exercise/defend claims)
Marketing	Send news and offers by email/SMS	Consent; or legitimate interests (“soft opt-in” where permitted under PECR)
Website operation/analytics	Run the site, measure performance, improve experience	Legitimate interests (running our business); Consent for non-essential cookies under PECR

Withdrawing consent: Where we rely on consent (e.g. marketing, health information), you can withdraw at any time by contacting us or using unsubscribe links.

5) Children

Bookings must be made by persons over 18. We do not knowingly market to children.

6) Who we share your data with

We may share your data with:

Inn Style (our booking platform provider);
Payment processors (via Inn Style);
IT hosting, cloud and email providers;
Therapists/instructors/partners (where needed to deliver classes/treatments you book);
Professional advisers and insurers;
Regulators or law enforcement where required;
Successors in the event of a business sale/reorganisation.

We do not sell your data.

7) International transfers

Some providers may be based outside the UK (e.g. cloud hosting, email, analytics). Where transfers occur, we use lawful safeguards such as:

UK adequacy regulations (where available); or
UK International Data Transfer Agreement (IDTA) / Standard Contractual Clauses with UK Addendum.

8) How long we keep your data

Our typical retention periods are as follows:

Booking and guest records: 7 years (for tax and legal compliance).
CCTV: normally 30 days (longer if reasonably needed to investigate an incident).
Treatment/fitness health questionnaires & consent forms: up to 3 years after your visit (or longer where needed for legal claims).
Marketing data: until you unsubscribe, or after 24 months of inactivity.
Incident/claims files: as needed to establish/exercise/defend legal claims.

9) Security

We take appropriate technical and organisational measures to protect your data. No system is 100% secure; you should keep your devices and booking accounts secure.

10) Your rights

You have the right to:

Access your data and receive a copy;
Rectify inaccurate data;
Erase data (in certain circumstances);
Restrict processing (in certain circumstances);
Data portability (for data you provided to us, processed by consent/contract and automated means);
Object to processing based on legitimate interests or to direct marketing;
Withdraw consent at any time (where relied upon).

To exercise your rights, email info@cottageorne.com. We may need to verify your identity.

You also have the right to complain to the Information Commissioner’s Office (ICO): www.ico.org.uk.

11) CCTV

CCTV operates in communal areas at Cottage Orné for safety and security. Images may be shared with law enforcement or insurers if required. Typical retention is 30 days unless an incident requires longer.

12) Marketing

Email/SMS marketing: sent only with your consent, or under the “soft opt-in” where you’ve booked with us and we’re marketing similar services.
You can opt out any time via unsubscribe links or by contacting us.
We won’t share your data with third parties for their own marketing without your consent.

13) Cookies

We use cookies and similar technologies on our website. Non-essential cookies require your consent and can be managed via our cookie banner. See our Cookie Policy.

14) Third-party links

Our website (and booking process) includes links to third-party sites such as Inn Style. Those sites have their own privacy policies. We are not responsible for their content or practices.

15) Updates to this policy

We may update this policy from time to time. We’ll post the new version on our website and update the “last updated” date. Significant changes may also be notified by email where appropriate.

16) Contact us

Questions or requests about this policy?

Email: info@cottageorne.com

Postal: Cottage Orne Limited, 16 Portland Close, Broughton, Aylesbury, HP22 7DG, UK.

Last updated: September 2025