top of page
Ffynnon-logo

Privacy Policy

Last updated: 12 May 2026

1. Who we are

This privacy notice explains how we look after your personal information when you book and stay at Ffynnon, and tells you about your privacy rights.

 

Ffynnon is the “data controller”, which means we are responsible for deciding how and why we use your personal data.

 

Contact details

  • Email: sspringthorpe87@googlemail.com

  • Postal address: Ffynnon, Forest Hill, Sardis, Thuston Lane, Sardis, Milford Haven, Pembrokeshire, SA73 1LD

 

If you have any questions about this notice or how we use your data, you can contact us using the details above.

2. When we collect your data and from where

We collect and receive personal data about you when you:

 

Make a direct booking with us (for example by email, phone or via a direct booking page)

 

Book through third‑party platforms, including:

  • Airbnb

  • Booking.com

  • Vrbo

  • Hotels.uk (which uses an online booking system provided by Queensborough Group)

 

In these cases, the platform you use is also a data controller and will process your data under its own privacy notice, which you should read separately.

3. The personal data we collect

Depending on how you book, we may collect the following information:

  • Name

  • Email address

  • Postal address

  • Telephone number

  • Booking details (dates of stay, number of guests, any special requests)

  • Payment‑related information (for example what you paid, when and for which booking – card details are processed securely by the platform or payment provider, not stored by us)

  • Names or details of guests travelling with you, where this is needed for the booking

 

We only collect information that we need to manage your booking, your stay and our business properly.

4. How and why we use your information (our legal bases)

Under UK GDPR, we must have a legal reason (“lawful basis”) to use your personal data. We use your information for the purposes below:

To take and manage your booking, and provide your stay

  • So we can confirm your booking, communicate with you about arrival and departure, and provide your accommodation.

  • Legal basis: necessary to perform the contract we have with you.

To respond to enquiries, changes or complaints

  • For example if you message us through Airbnb, Booking.com, Vrbo, Hotels.uk or directly.

  • Legal basis: performance of our contract and our legitimate interest in running Ffynnon and providing good customer service.

To process and record payments, refunds and invoices

  • We receive payment information from booking platforms (for example payout amounts and references) and from any direct payment arrangements.

  • If we take card payments directly, these are processed securely by our chosen payment service provider (currently Sage Pay/Opayo), and they give us only the information we need to confirm and reconcile the payment, not your full card details.

  • Legal basis: performance of our contract, our legitimate interests in running our business, and our legal obligations for tax and accounting.

To manage and protect our business, website and booking systems

  • For example to help prevent fraud, resolve disputes or manage over‑bookings.

  • Legal basis: our legitimate interests in operating a secure and efficient business.

To keep financial records in Qbooks (accounting software)

  • We use Qbooks to record bookings, invoices, payments and refunds, including those from Airbnb, Booking.com, Vrbo, Hotels.uk, direct bookings and Sage Pay/Opayo payments.

  • This usually includes your name, booking reference, dates of stay and amounts paid.

  • Legal basis: legal obligation (tax and accounting laws) and our legitimate interests in keeping proper business and financial records.

 

We do not use your personal data to send you marketing emails or newsletters.

5. Cookies and website information

If you use an online booking form or direct booking page for Ffynnon, the site may collect technical data such as your IP address, browser type and pages visited, as well as cookies to make the site work and to keep the booking process secure.

 

If you book through Airbnb, Booking.com, Vrbo or Hotels.uk, those platforms use their own cookies and tracking technologies under their own cookie and privacy policies, which we do not control.

6. Who we share your information with

We share your information only when we need to and only with organisations that are required to protect it. These include:

  • Queensborough Group – provides and administers the online booking system used for Hotels.uk and may be used for direct bookings.

  • HotelHost Company and Rackspace – sub‑processors that provide hosting and storage for the booking system used by Queensborough Group.

  • Qbooks (accounting software) – we input booking and payment information (including bookings from Airbnb, Booking.com, Vrbo, Hotels.uk, direct bookings and Sage Pay/Opayo payments) into Qbooks so we can raise invoices, record payments and keep our accounts.

  • Sage Pay/Opayo (payment service provider) – if we take card payments directly, Sage Pay/Opayo processes your card details securely on our behalf to complete the transaction. They act as an independent data controller for the card data they handle and have their own privacy notice explaining how they use and protect that information.

 

We may also share information, where necessary, with:

  • Payment providers and banks (for example to process payments or refunds, or prevent fraud)

  • Our professional advisers (e.g. accountants or legal advisers)

  • Insurers (for example if there is a claim relating to your stay)

  • Public authorities such as HMRC, the police or regulators, where we are legally required to do so

 

We do not sell your personal data, and we do not share it with third parties for their own marketing.

 

The platforms Airbnb, Booking.com, Vrbo, Hotels.uk and Sage Pay/Opayo are also separate data controllers and will use your data in line with their own privacy notices.

7. International transfers

Our intention is to keep your personal data in the UK or European Economic Area (EEA) wherever possible. Some platforms or service providers (for example hosting or cloud services used by booking platforms, Sage Pay/Opayo or Qbooks) may process data outside the UK/EEA.

 

Where this happens, we expect appropriate safeguards to be in place, such as standard contractual clauses or other protections required by UK data protection law.

8. How long we keep your information

We keep your personal data only for as long as we reasonably need it for the purposes set out in this notice. Typically this means:

  • Booking and stay records (including data received from Airbnb, Booking.com, Vrbo, Hotels.uk, Sage Pay/Opayo and direct bookings): up to 6 years after the end of the financial year in which your stay took place, to meet tax and accounting requirements and to respond to any queries.

  • Emails and messages: kept for as long as needed to manage your booking and any follow‑up, normally no longer than the booking retention period unless needed for legal reasons.

 

When we no longer need your data, we will securely delete it or anonymise it.

9. How we keep your information safe

We take reasonable steps to keep your personal data secure and to prevent it from being lost, used or accessed in an unauthorised way. This includes:

  • Limiting access to your personal data to people who need it to provide your stay or support our business

  • Using passwords and security measures on systems that store personal data

  • Using reputable third‑party providers (such as Queensborough Group, Hotels.uk, Airbnb, Booking.com, Vrbo, Sage Pay/Opayo and Qbooks) who are required to keep your data secure and confidential

 

If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will act in line with UK GDPR, including notifying you and the ICO where required.

10. Your data protection rights

You have a number of rights under UK data protection law. You can:

  • Ask for a copy of your personal data that we hold (subject access request).

  • Ask us to correct personal data you think is wrong or incomplete.

  • Ask us to delete your personal data in certain circumstances (the “right to be forgotten”).

  • Ask us to limit how we use your data in certain situations.

  • Object to us using your data where we rely on “legitimate interests” as our reason for processing.

  • Ask for your data to be transferred to you or another organisation in a structured, commonly used format, where our processing is based on a contract with you and is carried out by automated means (data portability).

 

If you want to exercise any of your rights, please contact us using the details in section 1. We may need to ask for proof of identity before we act on your request.

 

If you made your booking or payment through Airbnb, Booking.com, Vrbo, Hotels.uk or Sage Pay/Opayo, you may also need to contact them directly to exercise your rights in relation to data they hold as separate controllers.

11. Complaints

If you are unhappy with how we use your personal data, please contact us first so we can try to resolve the issue.

 

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator.

 

  • Website: https://ico.org.uk

  • Phone: 0303 123 1113

12. Changes to this privacy notice

We may update this privacy notice from time to time, for example if the law changes, if we start using new systems (such as new booking or payment platforms) or if we change how we use personal data. The most up‑to‑date version will always be available on our website or on request.

bottom of page