Privacy Policy

Last updated: 7 September 2026

Helmsley Hideaway respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, use, store and protect personal information when you visit https://helmsleyhideaway.com/, contact us, make an enquiry, make or manage a booking, or otherwise interact with Helmsley Hideaway.

This policy is intended to provide information in accordance with applicable UK data protection and electronic communications legislation, including the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (“PECR”), as applicable.

1. Who we are

For data protection purposes, the organisation responsible for your personal information is:

Helmsley Hideaway
Overdale Cottage
Main Street
Harome
Helmsley
YO62 5JF
North Yorkshire
UK

Telephone: 07973 255279
Email: rossbayretreat@aol.com

Our correspondence address is:

Ross Farm
Borgue
Kirkcudbright
DG6 4TR
Scotland, UK

References to “Helmsley Hideaway”, “we”, “us” or “our” in this Privacy Policy mean the organisation responsible for the processing of your personal information.

2. What personal information we collect

The information we collect depends on how you interact with us.

Information you provide directly

This may include:

• your name;
• email address;
• telephone number;
• postal address;
• booking and reservation details;
• arrival and departure dates;
• number of guests;
• information about pets accompanying you;
• payment and transaction information where relevant;
• information contained in enquiries or correspondence;
• information you provide through our website contact form;
• information you provide when submitting feedback or reviews; and
• any other information you choose to provide to us.

Please do not provide sensitive personal information unless it is genuinely necessary for us to deal with your enquiry or booking.

Information collected when you use our website

Depending on the technologies and services operating on our website, we may automatically collect certain technical information, including:

• IP address;
• browser type and version;
• device type;
• operating system;
• approximate location derived from an IP address;
• referring website;
• pages visited;
• date and time of visits;
• website interactions; and
• technical information relating to website security and performance.

Where this information is collected using cookies or similar technologies that require consent, those technologies will only be used after the appropriate consent has been obtained.

3. Information provided through our contact form

Our website contains a contact form which asks for information including your name, email address, subject and message.

We use this information to:

• respond to your enquiry;
• provide information about Overdale Cottage and Helmsley Hideaway;
• answer questions about availability and bookings;
• deal with requests or complaints; and
• maintain a record of relevant correspondence where reasonably necessary.

The lawful basis will generally be that processing is necessary to respond to your request or to take steps at your request before entering into a contract.

4. Booking information

Our website provides an online booking and availability facility. The booking page currently uses a third-party booking widget.

When you make or enquire about a booking, we may process information such as:

• your name;
• contact details;
• booking dates;
• number of guests;
• accommodation requirements;
• pet information;
• payment or transaction details;
• correspondence concerning the booking; and
• information reasonably necessary to provide the accommodation.

The specific third-party booking provider should be identified in our final website privacy information once the current booking-system provider has been confirmed.

Where a third party processes booking information on our behalf, we will take appropriate steps to ensure that appropriate data protection and security arrangements are in place.

5. How we use your personal information

We may use personal information to:

• respond to enquiries;
• provide information about Helmsley Hideaway;
• check availability;
• administer bookings;
• provide accommodation and related services;
• communicate with you about your booking;
• process or administer payments where applicable;
• provide arrival or departure information;
• deal with customer service matters;
• handle complaints;
• maintain appropriate business records;
• maintain and secure our website;
• prevent fraud, misuse or unlawful activity;
• improve our website and services;
• comply with legal obligations;
• establish, exercise or defend our legal rights; and
• send marketing communications where we are legally permitted to do so.

6. Our lawful bases for processing

We will only process personal information where we have a lawful basis under applicable data protection law.

Contract

We may process your personal information where this is necessary to enter into or perform a contract with you, including administering your holiday booking and providing accommodation.

Pre-contractual steps

We may process information where you have asked us to provide availability, prices or other information before deciding whether to make a booking.

Legal obligation

We may process information where necessary to comply with a legal, tax, accounting or regulatory obligation.

Legitimate interests

We may process information where this is necessary for our legitimate interests, provided those interests are not overridden by your rights and interests.

Examples include:

• responding to enquiries;
• managing our business;
• maintaining website security;
• keeping appropriate business records;
• improving our services;
• protecting our property and legal rights; and
• dealing with disputes.

Consent

Where consent is required, we will ask for it before processing your information for the relevant purpose.

This may include certain marketing activities and certain non-essential cookies or similar technologies.

You can withdraw consent at any time.

7. Marketing

We may occasionally wish to send information about Helmsley Hideaway, special offers, local information or other marketing communications.

We will only send electronic direct marketing where we have a lawful basis to do so under applicable law.

Where consent is required, we will obtain your consent before sending marketing communications.

You can unsubscribe at any time by following the unsubscribe instructions in the relevant communication or by contacting us.

You have an absolute right to object to the processing of your personal information for direct marketing.

8. Cookies and similar technologies

Our website may use cookies and other technologies that store information on, or access information from, your device.

These technologies may include:

• cookies;
• pixels;
• scripts;
• tags;
• browser storage; and
• similar technologies.

Some technologies may be strictly necessary for the website or a service you have specifically requested.

Other technologies, including certain analytics, advertising or preference technologies, may require your consent before they are used.

Our separate Cookie & Tracking Policy explains how these technologies are used and how you can manage your choices.

9. Google Analytics and analytics

Our existing website Privacy Policy states that Google Analytics is used.

However, the current website configuration should be checked before this statement is treated as definitive.

If Google Analytics or another non-essential analytics service is active:

• the relevant analytics technology will be identified in our cookie information;
• consent will be obtained before non-essential analytics technologies are activated where required by law; and
• analytics information will be used to understand website usage and improve the website.
• We will not rely on this Privacy Policy alone as a substitute for the appropriate cookie-consent mechanism.
• 10. Who we share personal information with
• We do not sell your personal information.
• We may share personal information where reasonably necessary with:
• booking and accommodation-management providers;
• payment service providers;
• website hosting and technical service providers;
• email and communications providers;
• IT and security providers;
• professional advisers;
• insurers;
• contractors and suppliers assisting us in operating the accommodation;
• government bodies, regulators or law-enforcement authorities where legally required or permitted; and
• other parties where necessary to establish, exercise or defend our legal rights.

Where another organisation processes information on our behalf, we will take appropriate steps to ensure that suitable data protection arrangements are in place.

11. International transfers

Some of our technology or service providers may process information outside the United Kingdom.

Where personal information is transferred internationally, we will ensure that an appropriate lawful transfer mechanism and suitable safeguards are in place where required by applicable data protection law.

These may include an adequacy decision, approved contractual safeguards or another lawful mechanism.

12. How long we keep your information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected.

Different types of information may be retained for different periods.

For example:

• booking and financial records may be retained for the period necessary to satisfy tax, accounting, insurance and legal requirements;
• enquiry correspondence may be retained for as long as reasonably necessary to deal with the enquiry and any resulting relationship or dispute;
• information relating to complaints or disputes may be retained for as long as reasonably necessary to resolve the matter and protect our legal interests; and
• marketing information may be retained while you remain subscribed or until you withdraw consent, subject to applicable law.

When information is no longer required, we will take reasonable steps to securely delete or anonymise it.

13. Security

We take reasonable technical and organisational measures to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.

These measures may include appropriate access controls, secure systems, software updates, backups and other security measures appropriate to the risks involved.

No internet transmission or electronic storage system can be guaranteed to be completely secure.

14. Your data protection rights

Subject to applicable legal conditions and exemptions, you may have the following rights:

• Right to be informed about how your personal information is used;
• Right of access to the personal information we hold about you;
• Right to rectification of inaccurate or incomplete information;
• Right to erasure in certain circumstances;
• Right to restriction of processing in certain circumstances;
• Right to data portability in certain circumstances;
• Right to object to certain processing; and
• Rights concerning automated decision-making and profiling, where applicable.

You also have an absolute right to object to direct marketing.

Where we process information on the basis of consent, you can withdraw your consent at any time.

These rights are subject to certain legal exceptions and limitations.

To exercise your rights, contact us using the details in Section 1.

We may need to request reasonable information to verify your identity before responding to a request.

15. Complaints

If you have concerns about how we use your personal information, please contact us first so that we can investigate and try to resolve your concern.

You also have the right to complain to the UK’s data protection regulator:

Information Commissioner’s Office (ICO)

Website: https://ico.org.uk/

The ICO provides information about your data protection rights and how to make a complaint.

16. Third-party websites

Our website contains links to third-party websites and services, including tourism organisations, attractions, social-media services and other websites.

We are not responsible for the privacy practices, security or content of third-party websites.

You should read the privacy information of any third-party website before submitting personal information to it.

17. Embedded content and social media

Pages on our website may contain links, images or embedded content associated with third-party services.

Depending on how those services are implemented, visiting or interacting with embedded content may result in information being shared with the third party.

Where third-party embedded content uses non-essential cookies or similar technologies, we will seek to control those technologies through our consent mechanism where required by law.

18. Children’s information

The accommodation is intended to be booked by adults.

We do not knowingly seek to collect children’s personal information through the website unless it is necessary for a legitimate purpose connected with a booking or enquiry.

19. Automated decision-making

We do not currently use your personal information to make solely automated decisions that produce legal or similarly significant effects on you.

If this changes, we will update this Privacy Policy and provide any information required by applicable law.

20. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• changes to our website;
• changes to our services;
• changes to the third-party providers we use;
• changes to how personal information is processed;
• changes in technology; or
• changes in applicable law or regulatory guidance.

The latest version will be published on this page with the date it was last updated.

We will review the policy periodically and update it when necessary. The ICO recommends that privacy information is regularly reviewed and updated when processing changes.

21. Contact us

If you have questions about this Privacy Policy, wish to exercise your data protection rights, or have concerns about how your personal information is used, please contact:

Helmsley Hideaway
Overdale Cottage
Main Street
Harome
Helmsley
YO62 5JF
North Yorkshire
UK

Telephone: 07973 255279
Email: rossbayretreat@aol.com

Correspondence address:

Ross Farm
Borgue
Kirkcudbright
DG6 4TR
Scotland, UK

Last updated: 7 September 2026