Last updated: June 2026 | Version 1.2
1. Who We Are
Herdwick Cottages Ltd (trading as Herdwick Cottages and Fells & Dales Cottages) is the data controller responsible for your personal data when you make or enquire about a holiday booking.
Registered address: Herdwick House, 53a–53b Highgate, Kendal, LA9 4ED
Company number: 11408869
ICO registration number: ZA662425
Email: [email protected]
Telephone: 01539-312290
Website: www.herdwickcottages.co.uk | www.fellsanddalescottages.co.uk
We are registered with the Information Commissioner’s Office (ICO) as a data controller. Our ICO registration number is ZA662425. If you have any questions about how we use your personal data, please contact us using the details above.
2. What Personal Data We Collect
When you enquire about or make a booking with us, we collect the following categories of personal data:
Information you provide to us directly
- Full name
- Home address
- Email address
- Telephone number(s)
- Payment and billing details (processed securely – see Section 6)
- Number of people in your party (adults, children, infants)
- Details of any pets
- Special requests or requirements
- Any complaint or feedback you submit
Information generated by your booking
- Booking reference, dates, and property details
- Records of payments made and amounts outstanding
- Security deposit status
- Correspondence between you and us
Information we receive from third parties
- Booking details passed to us via online travel agents (OTAs) such as Airbnb, Booking.com, VRBO, and Expedia, where you book through those platforms
3. How We Use Your Personal Data
We use your personal data for the following purposes and rely on the legal bases shown:
To process and administer your booking (Contractual necessity)
- Taking and confirming your booking enquiry
- Processing payments and managing deposits
- Sending booking confirmations, pre-arrival information, and departure instructions
- Passing relevant details to the property owner so that they can prepare for your stay and communicate with you if necessary (see Section 5)
- Managing changes, cancellations, and refunds
- Handling damage claims and security deposit deductions
To comply with our legal obligations (Legal obligation)
- Maintaining accurate financial and booking records
- Complying with HMRC requirements and other applicable laws
To pursue our legitimate business interests (Legitimate interests)
- Responding to complaints and resolving disputes
- Improving our services and website
- Protecting ourselves and our property owners against fraudulent or misleading booking information
- Sending you a review invitation after your stay (via Feefo – see Section 5)
Marketing communications (Consent)
When making a booking, you will have the option to subscribe to our e-shots. If you opt in, we will use Mailchimp to send you marketing emails about future offers, properties, and news. We rely on your consent for this processing. You can unsubscribe at any time using the link in any e-shot, or by contacting us directly. Unsubscribing will not affect service-related communications about an existing booking.
4. Legal Bases for Processing
Under UK GDPR, we rely on the following legal bases:
- Contract – processing is necessary to fulfil or enter into a booking contract with you
- Legal obligation – processing is required to comply with a legal duty
- Legitimate interests – processing is in our or a third party’s legitimate interests, provided those interests are not outweighed by your rights (e.g. sending review requests, fraud prevention)
- Consent – where we ask for your agreement before sending marketing communications (e-shots via Mailchimp)
5. Who We Share Your Personal Data With
We will not sell your personal data. We share it only as described below, and only to the extent necessary.
Property owners
As we act as agent for the property owner, we will pass your full name, address, telephone number, and email address to the owner of the property you are booking. This is necessary to enable them to prepare the property and communicate with you about your stay. We have a written agreement with each property owner requiring them to handle your data in compliance with UK GDPR.
SuperControl (Booking system)
When you make a booking on our website, you do so via an embedded booking engine provided by SuperControl. Your personal data is entered directly into SuperControl’s system — it is not stored on our own website. SuperControl is based in Scotland and processes guest data on our behalf as our data processor. We have a written data processing agreement in place with SuperControl. SuperControl mandates two-factor authentication for all users of its system. Their privacy notice is available at www.supercontrol.co.uk/policies/privacy/.
Review service (Feefo / Reviews.io)
After your stay, we will share your name, email address, the property name, and the dates of your stay with our review service provider for the sole purpose of sending you a review invitation by email on our behalf.
From 3 July 2026 our review service is provided by Feefo. Prior to that date, reviews were collected via Reviews.io; reviews submitted through Reviews.io will remain visible after that date. We have written contracts with both Feefo and Reviews.io requiring them to handle your data in compliance with applicable data protection laws.
JotForm (Forms and enquiries)
We use JotForm to collect and process certain forms and enquiries. JotForm acts as our data processor under a Data Processing Addendum (DPA). Our JotForm account is configured to store data within the European Economic Area (Germany). Standard Contractual Clauses are in place to safeguard any transfers, and Jotform Ltd (our contracting entity as a UK-based customer) is subject to UK GDPR.
Mailchimp (Email marketing)
If you opt in to receive our e-shots when making a booking, we will share your name, email address, and information about the property you booked with Mailchimp, which we use to manage and send our marketing emails. Mailchimp acts as our data processor. Every e-shot we send includes an unsubscribe link, which you can use at any time to stop receiving marketing from us. Mailchimp is operated by The Rocket Science Group LLC, based in the US; appropriate safeguards are in place for any international data transfers.
Online travel agents (OTAs)
Where you make a booking via Airbnb, Booking.com, VRBO, Expedia, or another OTA, that platform will share your booking details with us. This information is fed directly into SuperControl via API integrations between SuperControl and the relevant OTA — it does not pass through our own website. The OTAs’ own privacy policies govern how they collect and use your data before passing it to us.
Elavon (Payment processing)
Payments are processed by Elavon Financial Services DAC, our appointed payment processor. Elavon processes card payment data securely on our behalf. We do not store full card details ourselves. All payment processing complies with the Payment Card Industry Data Security Standard (PCI DSS). Elavon is regulated by the Central Bank of Ireland and authorised by the FCA to operate in the UK.
Legal and regulatory bodies
We may disclose your data to law enforcement, HMRC, the ICO, or other regulatory bodies if we are legally required to do so.
Professional advisors
We may share data with our solicitors, accountants, and insurers where necessary and subject to appropriate confidentiality obligations.
6. International Data Transfers
Most of our processors store and process data within the UK or EEA. Where data is transferred outside the UK, we ensure appropriate safeguards are in place:
- JotForm – data is stored in Germany (EEA). Standard Contractual Clauses remain in place as a safeguard for any exceptional transfers.
- Mailchimp (The Rocket Science Group LLC) – based in the US. Transfers are covered by Standard Contractual Clauses and/or the UK-US Data Bridge where applicable.
- Elavon – operates within the UK and EEA under FCA authorisation; data is processed within the EEA.
- Google Analytics (Google LLC) – based in the US. Transfers covered by the EU-US Data Privacy Framework and Standard Contractual Clauses.
- Microsoft Clarity (Microsoft Corporation) – based in the US. Appropriate safeguards including Standard Contractual Clauses are in place.
- Meta Pixel (Meta Platforms Ireland Ltd) – EU-based entity; any onward US transfers covered by Standard Contractual Clauses.
- Key Data (Key Data LLC) – based in the US. Appropriate safeguards in place for transfers.
- Beyond Pricing (Ten TwentyFour, Inc.) – based in the US. Transfers covered by Standard Contractual Clauses. A DPA is in place.
- OTA platforms (e.g. Airbnb, Booking.com) – operate globally and apply their own international transfer safeguards. Please refer to their privacy policies.
For further information about our international transfer arrangements, please contact us.
7. How Long We Keep Your Personal Data
We retain personal data only for as long as necessary for the purposes for which it was collected and to comply with our legal obligations:
- Booking records (including correspondence and financial records): 7 years from the date of the booking or final payment, in line with HMRC requirements
- Review data shared with Feefo or Reviews.io: retained by the relevant platform for the period the review remains live, plus a reasonable period thereafter
- Marketing data (Mailchimp): until you unsubscribe or withdraw consent
- Enquiry records (where no booking is made): 12 months
After the relevant retention period, your data will be securely deleted or anonymised.
8. Your Rights
Under UK GDPR, you have the following rights in relation to your personal data:
- Right of access – to receive a copy of the personal data we hold about you (a Subject Access Request)
- Right to rectification – to have inaccurate or incomplete data corrected
- Right to erasure – to request deletion of your data where there is no longer a lawful basis for processing
- Right to restriction – to ask us to pause processing of your data in certain circumstances
- Right to object – to object to processing based on legitimate interests or for direct marketing purposes
- Right to data portability – to receive your data in a structured, machine-readable format and transfer it to another controller
- Right to withdraw consent – where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing prior to withdrawal
To exercise any of these rights, please contact us at [email protected] or in writing to Herdwick House, 53a–53b Highgate, Kendal, LA9 4ED. We will respond within one month. We may need to verify your identity before processing your request.
You will not usually be charged for exercising your rights, unless a request is manifestly unfounded or excessive.
9. Cookies and Website Tracking
Our websites (www.herdwickcottages.co.uk and www.fellsanddalescottages.co.uk) use cookies and similar tracking technologies. When you first visit, you will be given the opportunity to accept or manage your preferences via our cookie banner. Non-essential cookies will only be set with your consent.
The following third-party tools operate on our websites and may collect data about your visit. Each acts as an independent data controller in respect of the data they collect directly from your browser:
Google Analytics
We use Google Analytics (operated by Google LLC) to understand how visitors use our website. It collects information such as pages visited, time on site, and approximate location derived from your IP address. IP addresses are anonymised before storage. Google may transfer data to the US; transfers are covered by the EU-US Data Privacy Framework and Standard Contractual Clauses. You can opt out using the Google Analytics opt-out browser add-on at tools.google.com/dlpage/gaoptout. Google’s privacy policy is available at policies.google.com/privacy.
Microsoft Clarity
We use Microsoft Clarity (operated by Microsoft Corporation) to analyse how visitors interact with our website, including session recordings and heatmaps showing mouse movements and clicks. This helps us identify usability issues and improve the site. Clarity may collect IP addresses, device identifiers, and interaction data. Microsoft may transfer data to the US; appropriate safeguards are in place. You can learn more and opt out at clarity.microsoft.com. Microsoft’s privacy policy is available at privacy.microsoft.com.
Meta / Facebook Pixel
We use the Meta Pixel (operated by Meta Platforms Ireland Ltd) to measure the effectiveness of our advertising on Facebook and Instagram, and to show relevant adverts to people who have visited our website. The pixel may collect information about your browsing behaviour, including pages visited and actions taken. This data is only collected where you have consented via our cookie banner. Meta may transfer data to the US; transfers are covered by Standard Contractual Clauses. You can manage your ad preferences at facebook.com/ads/preferences. Meta’s privacy policy is available at facebook.com/privacy/policy.
Key Data (Analytics and Market Intelligence)
We use Key Data Dashboard (operated by Key Data LLC, based in the US) for market statistics and performance analysis. Key Data integrates with our booking system (SuperControl) and operates a tracking script on our website that collects information about property searches, availability queries, and booking activity. This data is used to produce anonymised, aggregated market benchmarking data and to help us understand our business performance. Key Data’s privacy policy is available at pm.keydatadashboard.com/privacy. Transfers to the US are subject to appropriate safeguards.
Beyond Pricing (Dynamic Pricing)
We use Beyond Pricing (operated by Ten TwentyFour, Inc. d/b/a Beyond, based in the US) as our dynamic pricing tool. Beyond operates a beacon (pixel) on our website that collects data about property search dates and successful bookings. This is used to inform and adjust our pricing in real time. Beyond also integrates with SuperControl to receive booking data. Beyond’s privacy policy is available at beyondpricing.com/legal/privacy. A Data Processing Agreement is in place with Beyond. Transfers to the US are covered by Standard Contractual Clauses.
For a full list of all cookies set on our websites and the ability to manage your preferences, please see our Cookie Policy.
10. Security
We take the security of your personal data seriously and have implemented appropriate technical and organisational measures to protect it against unauthorised access, loss, or misuse. These include password protection, encrypted transmissions (HTTPS/SSL), and restricted staff access. Our booking system provider, SuperControl, mandates two-factor authentication for all users of its platform.
However, no transmission of data over the internet is completely secure. Whilst we take all reasonable steps to protect your data, we cannot guarantee the security of data transmitted to us and any transmission is at your own risk.
If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, contact you directly.
11. Children
Our booking services are intended for adults aged 18 and over. We do not knowingly collect personal data directly from children. Information about children in your party (such as number of children) is provided by the lead booker as part of the booking process.
12. Changes to This Privacy Notice
We keep this privacy notice under regular review and may update it from time to time to reflect changes in our practices or applicable law. The most up-to-date version will always be available on our website. Material changes will be notified to you where we hold valid contact details.
13. How to Make a Complaint
If you are unhappy with how we have handled your personal data, we ask you to contact us first so that we can try to resolve the matter.
If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
- Website: www.ico.org.uk
- Helpline: 0303 123 1113
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
14. Contact Us
For any queries about this privacy notice or how we use your data, please contact:
Herdwick Cottages Ltd
Herdwick House, 53a–53b Highgate, Kendal, LA9 4ED
Email: [email protected]
Telephone: 01539-312290
This privacy notice applies to personal data collected on or after June 2026 and supersedes all previous guest privacy notices.
