What I do with your information

I am the data controller for the personal information described here. I am Lisa, the owner of The Bath Stay, 35 Brassmill Lane, Bath BA1 3JE.

You can reach me about anything on this page at hello@thebathstay.co.uk. I read that address myself.

I am registered with the Information Commissioner's Office; the registration number will be shown here once the registration is confirmed.

When you send an enquiry: your name, your email address, your telephone number if you give me one, the dates and party size you are asking about, and whatever you write in the message.

When you book: the above, plus your postal address, the names of the other people in your party, your arrival and departure details, any access or dietary requirements you choose to tell me, and a record of what you have paid.

When you pay: the payment is handled entirely by Stripe. I receive confirmation that the payment succeeded, the amount, the last four digits of the card and the card type. I never see or store your full card number, expiry date or security code.

When you use this website: standard server logs including IP address, browser type and the pages requested, which exist so the site can be operated and kept secure. I do not use advertising cookies or third-party tracking on the public pages.

When you stay: footage from the two Ring doorbell cameras described in section 6, and messages you send me during your stay.

I do not knowingly collect information from children. Where a booking includes children, I hold only their first names and ages, provided by the adult who books.

To answer your enquiry and to prepare a booking, on the basis that it is necessary for steps taken at your request before entering a contract.

To take payment, confirm your stay, send you arrival details and manage the stay itself, on the basis that it is necessary to perform the contract between us.

To keep the property and my neighbours secure, and to investigate damage or a breach of the house rules, on the basis of my legitimate interests in protecting the property, balanced against your privacy, which is why the cameras cover only the approaches to the house.

To keep accounting records and meet my tax obligations, on the basis of a legal obligation.

To send you an occasional email about availability or an offer, if you have asked me to, on the basis of your consent, which you can withdraw at any time by replying and saying so.

I do not sell your information, I do not share it with advertisers, and I do not use it to make automated decisions or to profile you.

Stripe Payments Europe: card payments and refunds. Stripe is a controller in its own right for the payment data it handles, under its own privacy policy.

Supabase: the database and file storage behind the booking system and your stay page, holding booking records and the messages between us.

The channel manager that keeps this site's calendar in step with Airbnb and any other listing site, so that dates cannot be double-booked.

Airbnb, where you have booked through that platform rather than directly with me. In that case Airbnb is also a controller of your information under its own terms.

My email provider, through which I write to you, and the hosting provider that serves this website.

Ring, which provides and stores the doorbell camera footage described below.

Each of these acts on my instructions under a written agreement, other than where I have said they are a controller in their own right. Some of them process data outside the UK; where they do, the transfer relies on UK adequacy regulations or on the International Data Transfer Agreement or Addendum.

Enquiries that do not become bookings: twelve months, then deleted.

Booking and payment records: seven years from the end of the tax year in which the stay took place, which is the period HMRC requires.

Messages between us about a stay: three years from the end of the stay, in case of a later query or dispute.

Doorbell camera footage: thirty days on a rolling basis, after which it is overwritten automatically, unless a specific clip has been retained because of a reported incident.

Marketing consent and the emails sent under it: until you withdraw consent, and then a minimal record that you have asked not to be contacted.

Server logs: no more than ninety days.

There are two Ring cameras at the property: one at the front door and one at the rear of the house, covering the gate and the approach to the back garden.

They exist for security. The property is empty between stays, and the rear garden is where guests leave bicycles. They face the approaches only. There is no camera anywhere inside the house, and none covering the patio, the seating area or any part of the garden where you would sit.

They record video and, at the front door, audio when motion is detected. Footage is stored by Ring for thirty days and then overwritten. I am the only person with access to it.

I do not watch the cameras during your stay and I do not use them to monitor guests. I would only look at footage for a specific reason (a reported break-in, damage, a parcel, or a complaint from a neighbour), and I would tell you if the reason concerned you.

If you have a concern about the cameras, tell me before you book and I will explain exactly what they see.

Under UK GDPR you have the right to ask me for a copy of the information I hold about you; to have anything inaccurate corrected; to ask me to delete it where I have no continuing reason to keep it; to ask me to restrict how I use it while a question is resolved; to object to my using it on the basis of legitimate interests; and to receive information you gave me in a portable form.

Where I rely on your consent, you can withdraw it at any time, and doing so does not affect anything done before you withdrew it.

To exercise any of these, email me at hello@thebathstay.co.uk. I will respond within one month, and there is no charge.

If you are not satisfied with how I have handled a request, you can complain to the Information Commissioner's Office at ico.org.uk, by telephone on 0303 123 1113, or in writing to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. I would be grateful for the chance to put it right first.

The site is served over HTTPS. Booking records are held in an access-controlled database, and the areas of the site that show your details are protected by a link that is unique to your booking. Payment card data never reaches my systems at all.

If I change this notice I will update the date below. If a change materially affects how I use information about a stay you have already booked, I will email you about it rather than expect you to notice.