Privacy notice

We keep the personal information used by Coylumbridge Weeks to a minimum. We do not handle rental payments, identity documents or private conversations between owners and guests.

What we collect and why

Owner accounts: name, email address, approval status, temporary ownership-verification information, lodge/week registrations and listing details. We use this to approve owners and provide the owner account.

Lodge detail suggestions: owners may optionally suggest a lodge name, capacity or bedroom count. They may also give explicit permission for their listing photograph to become the lodge’s default photograph. We keep the suggestion while it is reviewed. If accepted, we retain an anonymised record of the applied details and, where relevant, the photograph permission.

Rejected owner registrations are retained for up to 30 days by default so that the rejection can be enforced.

Rental enquiries: the name and email address from your approved owner account, together with the message you provide when contacting an owner. We use this to moderate the enquiry and, if approved, pass it to the owner of the relevant listing. We also record when you acknowledged this disclosure and the version of the notice shown to you.

Availability alerts: your email address, chosen month/year and the records needed to manage your alert and avoid duplicate emails. Public alerts are sent only after email verification.

Owner and administrator messages: account identity, conversation subject, message text and read timestamps. We use these records to provide private operational correspondence about owner accounts, registered weeks and listings.

Security/administration: short-lived authentication tokens, sessions and non-content audit records are used to secure and administer the service. Cloudflare Turnstile processes technical browser and request information to distinguish people from automated abuse on registration and public alert forms. The application does not intentionally store visitor IP addresses for these checks. We retain short-lived, keyed hashes of email addresses to enforce email sending limits; these cannot be used to send email or recover the original address without the separate application secret.

Who receives personal information

An approved rental enquiry, including the name, email address and message supplied, is disclosed to the independent owner associated with that listing. The owner receives a copy in their email account and can reply to you directly. We also use Neon for database hosting, Netlify for site hosting, Resend for transactional email and Cloudflare Turnstile for abuse prevention.

International transfers

Some service providers may process personal information outside the UK. Where this is a restricted international transfer, we rely on the provider’s applicable contractual safeguards or another lawful transfer mechanism.

How long we keep information

• Pending authenticated enquiries: up to 30 days from submission.
• Legacy unverified enquiries: up to 7 days.
• Forwarded enquiries: up to 30 days after forwarding.
• Rejected enquiries: up to 7 days after rejection.
• Pending owner registrations with no listing: normally up to 30 days.
• Rejected owner registrations with no listing: normally up to 30 days after rejection.
• Temporary owner verification notes: erased when the owner is approved.
• Approved owner accounts/listings: while needed to provide the service, or until the owner deletes the account.
• Rejected lodge detail suggestions: normally up to 30 days. Accepted suggestions are anonymised when the owner account is erased and retained as an administrative and photograph-permission record.
• Availability alerts: until the requested month ends or the subscriber unsubscribes; expired alerts are removed after a short administrative period.
• Administrative audit records: up to 365 days and designed not to contain message content or email addresses.
• Closed owner and administrator conversations: normally up to 365 days. They are also removed when the owner account is erased.
• Email abuse-control records: up to seven days.

Old records are removed automatically in line with these retention periods.

Your rights

Depending on the circumstances, UK data-protection law gives you rights to ask for access to your personal information, correction, erasure, restriction or objection, and to withdraw consent where consent is the lawful basis. Owners can delete their account directly from the owner dashboard. For any other request, contact info@coylumbridgeweeks.uk. We may need enough information to verify that the request relates to you.

Cookies and tracking

The site does not use advertising or behavioural-analytics cookies. Signed-in owners/admins receive a strictly necessary session cookie used to keep the account signed in securely.