Privacy Policy

Last updated: 23 January 2026

This Privacy Policy explains how Finstock Manor ("we", "us", or "our") collects, uses, stores, and protects personal data when you visit or make a booking through the Finstock Manor website (the "Website"). Finstock Manor is a luxury farmhouse offering accommodation bookings. We are committed to protecting your privacy and handling your data in accordance with UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

Finstock Manor is the data controller responsible for your personal data.

If you have any questions about this Privacy Policy or how we handle your data, you can contact us.

2. Personal Data We Collect

When you use our Website or make a booking, we may collect and process the following personal data:

Identity and contact details, such as your name, email address, telephone number, and billing address
Booking information, including dates of stay, number of guests, special requests, and correspondence
Payment information, such as payment status and transaction references (note: payment card details are processed securely by third‑party payment providers and are not stored by us)
Technical data, including IP address, browser type, device information, and operating system
Usage data, such as pages visited, time spent on the Website, and referring URLs
Cookies and similar technologies (see section 7)

We do not intentionally collect special category personal data.

3. How We Use Your Personal Data

We use your personal data for the following purposes:

To process and manage bookings and reservations
To communicate with you about your stay, including confirmations, changes, or enquiries
To take and administer payments and refunds
To provide customer support before, during, and after your stay
To operate, maintain, and improve the Website and booking system
To ensure the security of the Website and prevent fraud
To comply with legal, tax, or regulatory obligations

4. Lawful Bases for Processing

Under UK GDPR, we rely on the following lawful bases to process your personal data:

Performance of a contract – where processing is necessary to manage your booking or stay
Legitimate interests – to operate and improve our business and Website, provided your rights do not override these interests
Consent – where required, such as for non‑essential cookies or marketing communications
Legal obligation – where processing is required by law

5. How We Share Your Personal Data

We do not sell your personal data. We may share your data with:

Booking and payment service providers who enable reservations and payments
Website hosting, IT, and analytics providers
Professional advisers such as accountants, legal advisers, or insurers
Authorities or regulators where required by law

All third parties are required to respect the security of your personal data and process it in accordance with UK data protection law.

6. International Transfers

If any of our service providers are located outside the UK, we will ensure appropriate safeguards are in place to protect your personal data, such as standard contractual clauses approved under UK GDPR.

7. Cookies

The Website uses cookies to distinguish you from other users and to improve your experience.

Cookies may include:

Essential cookies – required for the Website and booking system to function properly
Analytics cookies – used to understand how visitors use the Website and improve performance

Where required, we will ask for your consent before placing non‑essential cookies. You can manage or disable cookies through your browser settings.

8. Data Retention

We retain personal data only for as long as necessary, including:

Booking and payment records, retained to meet legal and tax obligations
Enquiry correspondence, retained for customer service purposes

When data is no longer required, it is securely deleted or anonymised.

9. Data Security

We use appropriate technical and organisational measures to protect your personal data from loss, misuse, unauthorised access, disclosure, or alteration.

10. Your Data Protection Rights

Under UK data protection law, you have the right to:

Access your personal data
Request correction of inaccurate or incomplete data
Request erasure of your personal data
Object to or restrict processing of your personal data
Request data portability
Withdraw consent at any time (where processing is based on consent)

To exercise your rights, please contact us using the details above.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

Website: https://www.ico.org.uk

11. Third‑Party Links

The Website may contain links to third‑party websites. We are not responsible for their privacy practices or content.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page, and the updated date will be shown at the top.

If you have any questions about this Privacy Policy or how your personal data is handled, please contact us.