1. Who we are
Stockton Studios is run by Napton Lettings Limited, a private limited company registered in England and Wales under company number 10751694. Our registered office is Brooklands Cottage, Folly Lane, Napton, Southam, CV47 8NZ. The studios and apartments are at 8 High Street, Stockton, Southam, Warwickshire, CV47 8JZ.
We are the controller of the personal information described in this policy. That means we decide how it is used and we are responsible for looking after it.
If you have any question about this policy or about your information, email [email protected] or call 01926 830 618.
We have written this policy in plain English. It explains what we collect when you visit our website, enquire, book a stay with us directly or through a booking site, and stay with us.
2. What we collect and where it comes from
When you enquire through our contact form
Your name, your email address, the dates you are interested in (if you give them) and your message. The form sends these to us as an email. The website itself does not keep a copy.
When you book directly on our website
Your first and last name, email address, phone number, the number of guests, your dates, the property you are booking, the price, and any note you add for us. Before you can book, we email you a six-digit code to check your email address is yours.
Your card payment is taken by Stripe. Your card details go straight from your browser to Stripe and never reach our website or our staff. We receive confirmation of the payment, not your full card number.
While you are part way through booking, the details you have typed are held on our web server so that you do not lose them if the page reloads. They are removed when the booking is made or the session ends.
When you book through Airbnb or Booking.com
Airbnb and Booking.com pass us the details we need to arrange your stay, such as your name, your contact details or a contact method through their site, your dates, the number of guests, the price and any messages you send us through them. They take any payment you make through them. They collect your information under their own privacy policies and are responsible for what they do with it.
When you complete one of our online forms
We use Jotform for online forms we may ask you to fill in. They ask for your contact details and your address, which we use to arrange and look after your stay.
When you email, phone or message us
Your contact details and whatever you tell us, so that we can reply and look after your stay.
When you visit our website
Our website is delivered through Cloudflare, which keeps it fast and protects it from attack. Your device's IP address and basic technical details (such as your browser, the page you asked for and the time) pass through Cloudflare and our web server. Our server keeps technical records of errors and of booking problems so that we can put things right, and error reports are also sent to Flare, an error-tracking service, for the same reason.
If our analytics are switched on, Google Analytics counts how the website is used. See section 5 and our Cookie Policy.
The text on our website is displayed using fonts from Bunny Fonts, so your browser fetches them from BunnyWay d.o.o. in Slovenia, which receives your IP address to send them.
3. Why we use it, and our legal basis
| What we do | Our legal basis |
|---|---|
| Take, manage and look after your booking and your stay, including taking payment and sending you booking information | It is necessary to perform our contract with you, or to take steps you have asked for before entering into one |
| Reply to your enquiry | Taking steps at your request before a booking, and our legitimate interest in answering enquiries about our accommodation |
| Check your email address before a direct booking, and protect our website, bookings and payments from fraud and attack | Our legitimate interest in making sure bookings are genuine and our website is secure |
| Keep financial and booking records | To comply with our legal obligations, including tax and company accounting rules |
| Count how our website is used, if analytics are switched on, so that we can improve it | Our legitimate interest in understanding how the website is used. You can turn this off at any time (see section 5) |
| Deal with complaints, claims and requests from you or from the authorities | Our legitimate interest in running our business properly, and our legal obligations |
We do not use your information for automated decision-making or profiling, and we do not sell it.
4. Marketing
We do not send marketing emails or messages at present. If we start to, we will only send them to people who have actively said yes, and you will be able to unsubscribe from every message. We will update this policy before we begin.
5. Google Analytics
If our analytics are switched on, we use Google Analytics to count visits, where visitors came from, how long they stay and which pages are most popular. It records page views only. We have set it up so that:
- it is not linked to any advertising and Google signals and ad personalisation are off;
- Google does not share the data with other Google products for its own purposes;
- no name, email address or booking detail is sent to Google, and our page addresses carry no personal information;
- the detailed data is deleted after two months.
Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA, provides it as our service provider. When you first visit, a notice tells you about it. You can turn it off at any time with "Cookie settings" at the foot of any page, and it then stops loading on that browser. Turning it off does not affect anything else on the website.
6. Who we share your information with
Only our own staff see guest details. We do not pass them to outside cleaners, managers or anyone else, apart from the service providers below, who help us run our business and act on our instructions.
| Who | What they do for us |
|---|---|
| Hostaway Opco Oy (Finland, business ID 3472936-9) | Our booking system. It holds reservations from our website, Airbnb and Booking.com, and the messages we exchange with guests |
| Stripe Payments UK Ltd, 9th Floor, 107 Cheapside, London, EC2V 6DN | Takes card payments for bookings made on our website. Stripe also uses some payment information, as a controller in its own right, to prevent fraud |
| Jotform Inc., 4 Embarcadero Center, Suite 780, San Francisco, CA 94111, USA | Online forms |
| Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland | Microsoft 365: email, documents and files |
| Rackspace | Hosts our stocktonstudios.co.uk email inboxes |
| Elastic Email Inc. (Canada) | Sends the emails our website produces: contact form enquiries to our inbox, and booking verification codes to you |
| RH Elite Services Limited | Builds and manages our website and the server it runs on |
| DigitalOcean, LLC | Provides the server our website runs on, in London |
| Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA | Delivers and protects our website |
| Google LLC | Google Analytics, if switched on (section 5) |
| Facade BV, Kruikstraat 22/12, 2018 Antwerp, Belgium (Flare) | Records website errors so that they can be fixed |
| BunnyWay d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia | Supplies the fonts our website uses |
Airbnb and Booking.com are not our service providers. If you book through them, they are separate controllers with their own privacy policies: Airbnb Ireland UC (and Airbnb Payments UK Ltd for payments) and Booking.com B.V., Amsterdam.
We will also share information where the law requires it, for example with HM Revenue & Customs or the police, or where it is needed to bring or defend a legal claim.
7. Information sent outside the UK
Some of our service providers are based in, or use systems in, other countries, including the European Union, the United States and Canada. Where your information is handled outside the UK, we make sure it is protected by a safeguard that UK data protection law recognises, such as a country the UK has approved, the UK Extension to the EU-US Data Privacy Framework, or the Standard Contractual Clauses with the UK Addendum. You can ask us for details of the safeguard that applies, using the contact details in section 1.
8. How long we keep your information
- Bookings and stays. As long as we need it to fulfil your booking and deal with anything that arises from it. The financial part of the record (what was booked, by whom, when and what was paid) is then kept for as long as tax and company law require, which is six years from the end of the financial year it belongs to, and then deleted.
- Enquiries that do not lead to a booking. As long as we need to deal with your enquiry, then deleted.
- Booking details while you are booking on our website. Removed when the booking is made, or when the session expires two hours after your last activity.
- Email verification codes. Stored in scrambled form and expire after ten minutes.
- Technical records on our web server. Deleted automatically, within two months at most.
- Google Analytics data. Deleted after two months.
- Information held by Airbnb, Booking.com and Stripe for their own purposes is kept under their own policies.
9. Do you have to give us your information?
To book, yes: we cannot take or manage a booking without your name, contact details and dates. The contact form needs your name, email address and message so that we can reply. You can always phone or email us instead.
10. Your rights
You have the right to:
- ask for a copy of the information we hold about you;
- ask us to correct it;
- ask us to delete it;
- ask us to restrict how we use it;
- object to us using it where we rely on our legitimate interests, including turning off analytics;
- ask for it in a portable format, where that applies;
- withdraw your consent at any time, where we rely on it. This does not affect anything we did before you withdrew it.
To use any of these rights, email [email protected]. We will reply within one month. If your request is complex we may need up to two further months, and we will tell you why within the first month. We may ask you to confirm who you are before we act.
11. Complaints
If you are unhappy with how we have handled your information, please tell us first at [email protected]. We will acknowledge your complaint within 30 days, look into it, keep you informed and tell you the outcome.
You also have the right to complain to the Information Commission, the UK's data protection regulator (formerly the Information Commissioner's Office), at ico.org.uk.
12. Changes to this policy
If we change how we use personal information, for example by adding a new tool to our website, we will update this policy and the date at the top first, and ask for your consent where the law requires it.