Privacy

About this policy

Cotswoldcohost Ltd (company number 12312916, registered office: 33 Station Road, Andoversford, Cheltenham, GL54 4LA, United Kingdom), trading as Cotswold Cohost, is the data controller for personal data collected through this website. This policy describes what we collect, why we collect it, how long we keep it, and what rights you have over it. Questions or requests: kirsteen@cotswoldcohost.co.uk.

What we collect

We collect personal data in one place: the inquiry form at /inquire. The fields you provide are your name, email, phone number (optional), the village or town where your property sits, the property's nightly rate band, current arrangement, and any free-text message you send. We also store your browser's user-agent string and a one-way hash of your IP address (not the IP itself) for rate-limiting and spam protection.

Why we collect it

Our lawful bases under Article 6 of the UK GDPR are:

• Article 6(1)(b) — for replying to your inquiry and assessing whether your property is one we can manage well, the processing is necessary for steps taken at your request prior to entering into a contract.
• Article 6(1)(f) — legitimate interest — for rate-limiting, anti-spam protection, and security logging. The legitimate interest is keeping the inquiry form usable for genuine senders and protecting our infrastructure.

We do not use your data for marketing unless you separately and explicitly opt in.

How long we keep it

Inquiries are retained for 24 months in our secure submissions log, then deleted. Audit-log entries (a record of every form attempt, used for failure-rate monitoring and security) are retained for 90 days. If you become a managing client, your contact information transfers to our customer relationship management system under a separate contractual agreement.

Who we share it with

Your inquiry is delivered to Kirsteen's email inbox and stored in a database hosted on our infrastructure. Specifically:

• Cloudflare: hosts the website, the submission worker, and the submissions database (D1). Subject to Cloudflare's privacy policy.
• Resend: sends the auto-acknowledgement email to you and the inquiry email to Kirsteen. Subject to Resend's privacy policy.
• Plausible Analytics: aggregate-only page-view analytics, cookieless. Plausible does not collect personal data; see our cookie policy.
• Sanity: content management system that powers the rest of the site. Does not handle inquiry data.

We do not sell, share for advertising, or transfer your data to any other third party.

International transfers

Most of your data stays in the UK and EU: Cloudflare operates infrastructure in UK and EU regions, and Plausible Analytics is hosted in Germany. Our transactional email provider, Resend, is based in the United States. We rely on the UK Extension to the EU-US Data Privacy Framework and, where unavailable, the UK International Data Transfer Addendum to Standard Contractual Clauses to ensure that data transferred to the US is afforded protection equivalent to UK GDPR.

Security

Personal data is encrypted in transit (HTTPS/TLS). Data at rest is stored on Cloudflare's infrastructure with encryption at rest. Access to the submissions database is limited to Kirsteen and a small number of named technical operators.

Your rights

You have the right to:

• Ask for a copy of the data we hold about you (subject access)
• Correct anything that's wrong (rectification)
• Ask us to delete your data ("right to be forgotten")
• Ask for your data in a portable format
• Object to processing based on legitimate interest (Article 21)
• Withdraw consent for any processing where consent was the basis
• Complain to the Information Commissioner's Office (ICO) if you think we've handled your data wrongly

We do not use your personal data for automated decision-making or profiling under Article 22 of the UK GDPR.

Email kirsteen@cotswoldcohost.co.uk for any of these requests. We aim to respond within one calendar month.

Breach notification

Personal data breaches notifiable under UK GDPR will be reported to the Information Commissioner's Office within 72 hours of becoming aware, and, where required by Article 34, to affected individuals.

Cookies

Our cookie practice is documented separately at /cookies. Short version: no marketing or tracking cookies are set; analytics is cookieless.

Changes to this policy

Material changes to this policy will be reflected here with an updated "last updated" date at the top. Substantive changes affecting how we handle existing inquiry data will be communicated by email to anyone with an active inquiry on record.