Butterwell Estate Limited Data Protection Privacy Policy & Notice
Document last reviewed and update: 19th June 2025.
Butterwell Estate Limited (BEL) is committed to protecting the privacy and security of your personal information.
BEL comply with the Data Protection Act 1998 (DPA), the General Data Protection Regulation (GDPR) and the Privacy and Electronic Communications Regulations (PECR). This policy is reviewed and updated on an ongoing basis.
This policy describes how we collect, retain and use personal information of potential, current and former customers. It applies to information collected by BEL about customers either directly or by its service providers, business referrers and intermediaries. We are registered under the Data Protection Act ZA060694
It is important that you read this privacy policy or any other notices or policies we may present to you when we are collecting or processing your personal data so that you are fully aware of how and why we use your data. This privacy policy supplements any other policies or terms and conditions we have and it is not intended to override them.
Data Protection Philosophy
BEL is a “data controller” and is responsible for deciding how we hold and use personal information about you. Data controllers at BEL are all employees and directors.
We will always comply with data protection law, which requires your personal information to be:
– used lawfully, fairly and transparently
– collected for valid purposes which have been explained
– accurately and securely kept
– retained only for as long is necessary
Personal Data We Collect
We need to collect, store, use and transfer different types of personal data about you in order to operate as a self-catering business:
– Identity Data: may include your first name, last name, marital status, title.
– Contact Data: may include emails addresses, telephone numbers, address details.
– We may collect experience & preference data including details of your preferences when staying at our properties and your customer feedback.
– Financial Data: may include your bank account and part of your payment card details, strictly in compliance with PCI DSS.
– Transaction Data: may include details about your stay with us and any associated payments.
– Website Data: May include details of your interaction with our website.
– Marketing & Communications Data: may include your contact preferences and any emails that we may have exchanged.
– Video data: Data collected from ring doorbells located in external, public areas.
It is important that personal data we hold about you is accurate and up to date. Please let us know if your personal data changes during your association and/or contract with us.
We do not collect any particularly sensitive personal information as a matter of policy unless in extreme circumstances to comply with legal obligations. In this eventuality we will always seek consent to do so.
If you decline to provide personal data when we need to collect it by law, or under the terms of contract we have with you, we may not be able to provide you with goods or services in the contract we have, or are trying to enter, with you. In this instance, we may have to cancel your booking, but we will notify you of this at the time.
How We Collect Your Personal Data
We collect personal information from you when you are making an enquiry, making a booking for accommodation and/or fishing, cancelling a booking, giving us feedback or requesting marketing information. We do this either directly or indirectly through our website (contact form and booking form) or via a booking agent or via direct contact by email, post or telephone.
If you use our website, we will automatically collect technical data about your equipment, browsing actions and behaviours. We collect this personal data using cookies and other similar technology. Cookies and website visitor tracking – small files installed in your browser that allow our website and many others to find out about your browsing behaviour. The purpose of BEL using cookies is to better understand visitors and improve their experience. This website has made use of a cookie notice that actively seeks confirmation of your acceptance or denial to the use of cookies.
Contact information, and financial and transaction data may be collected from or shared with providers of technical and payment services.
Links to our property management system for availability, pricing, and booking.
All interaction on our website related to availability, pricing and booking is conducted via our property management system Supercontrol. We will store the details you have supplied (name, address, email address, booking details) in Supercontrol.
Links to our payment gateway for the purposes of payment.
All interactions within our website for the purposes of payment are conducted via our payment gateway provider, Opayo, which is facilitated via integration with Supercontrol.
No payment card details are stored in our website or Supercontrol.
Purpose of collecting data
We only collect data for the purposes of running our business effectively. This data is securely stored in Supercontrol and covers :-
Name, postal address, email address, booking details, paid amounts.
Set out below is a description of the ways we intend to use your personal data and the legal grounds on which we will process such data. We have also explained what our legitimate interests are where relevant.
We may process your personal data for more than one lawful ground, depending on the specific purpose for which we are using your data. Please email us at info@butterwellfarm.com if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.
Purpose / Activity Type of Data Lawful basis for processing
1. To register you as a new customer (a) Identity
(b) Contact (a) Performance of a contract with you
2. To process and deliver your order including:
(a) Manage payments, fees and charges
(b) Collect and recover money owed to us (a) Identity
(b) Contact
(c) Financial
(d) Transaction (e) Marketing and Communications (a) Performance of a contract with you
(b) Necessary for our legitimate interests to recover debts owed to us.
3. To manage our relationship with you which may include: (a) Notifying you about changes to our terms or privacy policy.
(b) Asking you to leave a review or take a survey. (a) Identity
(b) Contact
(c) Marketing and Communications (a) Performance of a contract with you
(b) Necessary to comply with a legal obligation.
(c) Necessary for our legitimate interests to keep our records updated and to study how customers use our products/services
4. To enable you to take part in a prize draw, competition or complete a survey (a) Identity
(b) Contact
(c) Marketing and Communications (a) Performance of a contract with you
(b) Necessary for our legitimate interests to study how customers use our products/services, to develop them and grow our business
5. To administer and protect our business. (a) Identity
(b) Contact
(c) Financial
(d) Transaction (e) Website
(f) Marketing and Communications (a) Necessary for our legitimate interests in running of our business, provision of administration and IT services (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data), network security, and to prevent fraud.
(b) Necessary to comply with a legal Obligation.
6. To deliver relevant content and advertisements to you and measure and understand the effectiveness of our advertising (a) Identity
(b) Contact
(c) Website
(d) Marketing and Communications (a) Necessary for our legitimate interests to study how customers use our services, to develop them, to grow our business and to inform our marketing strategy.
7. To use data analytics to improve our website, products/services, marketing, customer relationships and experiences (a) Website
(b) Marketing and communications (a) Necessary for our legitimate interests to define types of customers for our services, to keep our site updated and relevant, to develop our business and to inform our marketing strategy.
8. To make suggestions and recommendations to you about goods or services that may be of interest to you (a) Identity
(b) Contact
(c) Website
(d) Marketing and communications (a) Necessary for our legitimate interests to develop our products/services and grow our business.
9. To protect our property and assets, and those of our guests. (a) Video (c) Necessary for our legitimate interests to keep our property and the property of our guests safe and to aid law enforcement agencies in the recovery of stolen goods.
How We Will Use Your Personal Data
We will only use your personal information when the law permits us to, in the following specific circumstances:
– to complete your booking and contractual services to you
– to keep you updated on BEL through our Newsletters, provided you have confirmed you wish to receive these communications
– to comply with any other legal obligations.
You will receive newsletters from us if you have:
(i) requested information from us or purchased services from us; or
(ii) if you provided us with your details and ticked the box at the point of entry of your details for us to send you marketing communications; and
(iii) in each case, you have not opted out of receiving that marketing.
Your personal information will never be used or provided to a third party for any other purpose.
You have the right to withdraw consent to marketing at any time by contacting us.
Where you opt out of receiving our marketing communications, this will not apply to personal data provided to us as a result of a service purchase, warranty registration, service experience or other transactions.
Which Third Party Service Providers Process Your Personal Data
We may have to share your personal data with the parties set out below for the purposes set out in the table in paragraph 2 above.
The following third parties are authorised by us to process your personal information:
– Service providers who provide IT and system administration services. Supercontrol (booking system), Airbnb (agent), Booking.com (agent)
– Mailchimp to provide newsletters
– Secure payment service provider to facilitate your payments: Opayo/Elavon.
– Professional advisers including lawyers, bankers, auditors and insurers who provide consultancy,
banking, legal, insurance and accounting services.
– HMRC, regulators and other authorities based in the UK who require reporting of processes and activity in certain circumstances.
– If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy policy.
– We require all third parties to respect the security of your personal data and to use it in accordance with the law. We do not allow third-party service providers to use your personal data for their own purposes, and we only permit them to process your personal data for specified reasons and in accordance with our instruction.
– Social Media – by following our Facebook, Instagram or other social media accounts, we process data based on your consent. This includes social media analytics which shows us the demographics of our followers, the information they find most interesting with statistics on reach and engagement.
Data Security
We have in place security measures to prevent your personal information being lost, used, altered, accessed or disclosed in an unauthorised way. Third parties have confirmed their security arrangements and will only process personal information on our instruction and are subject to normal duties of confidentiality.
Our website may link to external sites, plug-ins and applications that are not operated by us. Please be aware that we have no control over the content and practices of these sites, and cannot accept responsibility or liability for their respective privacy policies.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
Data Retention
We will only retain your personal data for as long as necessary to fulfil administrative, accounting, legal or security obligations, although we will retain contact details of customers who have chosen to receive our newsletter until such time as they choose to unsubscribe.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
By law we have to keep basic information about our customers (including contact, identity, financial and transaction data) for seven years after they cease being customers for tax and insurance purposes.
In some circumstances you can ask us to delete your data: see below for further information.
In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.
Customer Rights
Under certain circumstances, you have rights under data protection laws in relation to your personal data. These include the right to:
• Request access to your personal data.
• Request correction of your personal data.
• Request erasure of your personal data.
• Object to processing of your personal data.
• Request restriction of processing your personal data.
• Request transfer of your personal data.
• Right to withdraw consent.
You can see more about these rights at:
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/
If you wish to exercise any of the rights set out above, please email us at info@butterwellfarm.com
You will not have to pay a fee to access your personal
data (or to exercise any of the other rights).
However, we may charge a reasonable fee if your request
is clearly unfounded, repetitive or excessive.
Alternatively, we may refuse to comply with your request
in these circumstances.
We may need to request specific information from you
to help us confirm your identity and ensure your right to
access your personal data (or to exercise any of your
other rights). This is a security measure to ensure that
personal data is not disclosed to any person who has no
right to receive it. We may also contact you to ask you
for further information in relation to your request to
speed up our response.
We try to respond to all legitimate requests within one
month. Occasionally it may take us longer than a month
if your request is particularly complex or you have made
a number of requests. In this case, we will notify you
and keep you updated.
As well as the right to withdraw consent and exercise any of the above rights mentioned under ‘Your rights under the GDPR’, you also have the right to raise a complaint with a regulatory body. In the United Kingdom, this is the Information Commissioner’s Office (ICO).
If you have concerns about the way your data is being processed by an organisation, you can find out more at ico.org.uk. We should be grateful if you would contact us first if you do have a complaint so that we can try to resolve it for you.
Changes To Privacy Policy
We reserve the right to update this policy.
If you want to know more about your rights, and for other information relating to data protection legislation, please visit the ICO website ico.org.uk
Should you have any questions about our Privacy Policy please contact Rachel d’Avigdor-Hamilton on 01208 831 515