Last updated: [DATE]
This policy explains how [LEGAL ENTITY NAME] (“we”, “us”, “our”), which operates The Bridge York at [PROPERTY ADDRESS], collects and uses your personal data when you visit our website, make a booking or stay with us. We are the data controller for this information.
Who to contact
For any privacy questions or to exercise your rights, contact us at stay@thebridgeyork.com or by post at [PROPERTY ADDRESS]. We are registered with the UK Information Commissioner’s Office (ICO) under registration number [ICO NUMBER].
The information we collect
- Booking & guest details — your name, email address, phone number, country/nationality, purpose of visit, stay dates, and the number and make-up of your party.
- Payment information — card payments are processed by our payment provider, Stripe. We do not store your full card number; we retain limited details such as the card brand, last four digits, expiry and a payment reference to manage your booking and any balance or additional charges.
- Reservation records — details of your reservation(s), pricing, deposits and balances, and communications relating to your stay.
- Door access — where self-access is provided, we generate access credentials (such as a PIN and QR code) linked to your reservation and stay dates.
- Partially completed bookings — if you begin a booking but do not finish it, we may retain the details you have entered so we can help you complete it or follow up about your enquiry.
- Website & device data — information collected through cookies and similar technologies (see “Cookies” below).
How and why we use your information
- To take and manage your booking, take payment, collect any balance due and handle additional or incidental charges.
- To provide access to your apartment and communicate practical information about your stay.
- To respond to enquiries and provide customer support.
- To follow up on incomplete bookings and, where you have not opted out (or have consented), to send you relevant offers and updates.
- To keep our website and property secure and to prevent fraud.
- To meet our legal, accounting and tax obligations.
Our lawful bases
We rely on the following lawful bases under UK GDPR: performance of a contract (to provide the booking and stay you request); legitimate interests (to run and improve our business, follow up on incomplete bookings, and keep our services secure — balanced against your rights); legal obligation (for example, accounting records); and consent (for certain marketing and non-essential cookies, which you can withdraw at any time).
Who we share it with
We share personal data only with service providers who help us operate, and only as needed:
- Stripe — payment processing.
- Guesty — our property management and reservation system.
- Ubiquiti / UniFi Access — our door-access system, to issue your access credentials.
- Booking channels — where you book through a third party such as Booking.com or Airbnb, your booking is also governed by their privacy terms.
- IT, hosting and email providers who support our website and communications.
We do not sell your personal data. We may disclose information where required by law.
International transfers
Some of our providers (including Stripe and Guesty) may process data outside the UK/EEA. Where they do, we rely on appropriate safeguards such as UK/EU-approved standard contractual clauses or an adequacy decision.
How long we keep it
We keep booking and payment records for as long as needed to provide our services and to meet legal and accounting requirements (typically [X] years). Details from incomplete bookings and enquiries are kept for a shorter period of [X] and then deleted.
Cookies
We use cookies that are strictly necessary for the website and booking process to work (for example, to hold your booking session and protect our forms), and — with your consent — cookies for functionality and analytics. You can manage your choices at any time via our cookie settings. See our Cookie Policy for details.
Your rights
You have the right to access your personal data; to have it corrected or erased; to restrict or object to its processing; to data portability; and to withdraw consent where we rely on it. To make a request, contact us using the details above. You also have the right to complain to the ICO at ico.org.uk.
Security
We take appropriate technical and organisational measures to protect your personal data, including using reputable providers such as Stripe for payments and restricting access to your information.
Changes to this policy
We may update this policy from time to time. Any changes will be posted on this page with a revised “last updated” date.
