Privacy Policy

Pennar Isaf — Privacy Policy Last updated: 9 October 2026 We respect your privacy and take care of the personal information you share with us. This policy explains how we use your information when you enquire, book or stay at Pennar Isaf, submit a review or use our website. 1. Who we are Pennar Isaf is a family-run holiday cottage, operated by Carys Flynn trading as Pennar Isaf. We are responsible for the personal information described in this policy. For privacy questions or requests, please email pennarisaf@gmail.com 2. Information we collect Depending on how you contact us or use our services, we collect: - Enquiries: your name, email address, optional telephone number and message. - Bookings: your contact details, arrival and departure dates, guest numbers, pets, cot or highchair requests, messages, booking price, payment status and acceptance of our terms. - Guest register: each occupier’s name, main home address and arrival and departure dates, including children and infants. We also record whether guests are aged 16 or over and collect nationality information for guests aged 16 or over. Where legally required, we collect passport or identity-document numbers, place of issue and details of the next destination. - Optional requests: information you choose to provide to help us prepare for your stay, such as children’s approximate ages and interests when requesting toys. Please avoid providing unnecessary sensitive information. - Payments: payment references, amounts, dates and refund information. Card details are entered directly into Stripe’s secure checkout and are not stored by our website. - Reviews: the display name, rating and review text, together with permission to publish and an internal link to the relevant booking. - Marketing preferences: whether you have opted in, when and how you gave consent, the wording shown and any later withdrawal. - Website use: the referring page address recorded when you book and functional preferences stored in your browser. [Before publication, confirm any additional technical information recorded by hosting or email providers, such as IP addresses, security logs and email-delivery information.] We receive information directly from you, from the lead guest on behalf of their party and, where relevant, from booking or payment services. If you supply information about other guests, please share this policy with them. 3. Why we use your information We use personal information to: - Respond to enquiries and arrange bookings. - Process payments, balances, cancellations and refunds. - Prepare the cottage and communicate about your stay. - Maintain required guest records and financial records. - Deal with problems, complaints and reasonable claims. - Invite feedback and display reviews where publication has been agreed. - Record your marketing choices and, if introduced, send offers to people who have opted in. - Keep our website and booking services secure. We do not sell your personal information. 4. Our lawful bases We rely on: - Contract: to arrange and fulfil your booking, including steps you ask us to take before booking. - Legal obligation: to maintain required guest records, meet applicable planning conditions and keep necessary tax and accounting records. - Legitimate interests: to manage our business, communicate with other members of a booking party, deal with enquiries and disputes, invite feedback and protect our services. We consider your rights when relying on this basis. - Consent: for optional email marketing and publishing guest-submitted reviews where we ask for permission. Optional toy requests help us prepare for your stay. We will try to accommodate them, but availability cannot be guaranteed. Information needed to manage your booking or fulfil record-keeping obligations must be provided. Optional requests and marketing consent are not conditions of booking. 5. Who receives your information We share relevant information with services needed to operate the cottage and website: - Emergent: website hosting, application services, database and file storage. - Stripe: payment processing and refunds. - Our email-delivery services: booking and other service messages are sent through Emergent’s managed email integration, reported to use Resend. [Confirm the legal entities operating these services and any additional providers before publication.] We may also share necessary information with professional advisers, insurers or public authorities where required by law or reasonably necessary to deal with a claim. Our guest register is private. Register details, payment information and private booking-management links are not intended for public display. Published reviews show the agreed display name and review content. 6. Where information is stored Information is held in our booking and guest-record systems and by the service providers listed above. [Insert verified hosting and database locations, countries where providers process information, any transfers outside the UK, the applicable transfer safeguards and how guests can obtain information about those safeguards.] 7. How long we keep information We keep information only for as long as needed for its purpose. - Guest register: normally 12 months after departure, unless a specific legal requirement or an unresolved matter requires longer retention. - Optional toy-preparation notes: deleted 14 days after departure. - Enquiries: [confirm implementation of deletion 12 months after the last contact, unless the enquiry becomes a booking or an unresolved matter requires retention]. - Booking and financial records: [insert the confirmed retention period and the date from which it runs]. Only information necessary for accounting, legal obligations or outstanding claims is retained for that purpose. - Published reviews: retained while displayed, subject to requests for removal and periodic review. - Marketing records: kept while consent remains current and needed for the stated purpose. We review these records periodically. If you unsubscribe, we may retain a minimal record of your preference to avoid contacting you again. - Provider logs and backups: [insert confirmed retention and deletion arrangements]. Where information must be retained longer, we limit its use to the reason for retaining it. 8. Marketing You can choose whether to receive occasional Pennar Isaf news and offers using a separate, optional checkbox. Marketing emails are not currently being sent. If we introduce them, we will use the details of people who have opted in for this purpose. You can withdraw consent at any time through the booking-management page, by emailing us or through the unsubscribe link in any future marketing email. Withdrawing consent does not affect your booking or the lawfulness of earlier use. Booking confirmations, payment reminders and other messages needed to manage your stay are separate from marketing. 9. Cookies and browser storage Our website currently has no analytics or advertising tools enabled. It uses browser storage to remember your language choice and whether you have dismissed the review pop-up. Owner login information is stored only when the owner signs in. Stripe may use cookies and similar technologies on its checkout pages to operate payments and prevent fraud. [Confirm storage durations and any hosting-layer cookies before publication. Update this section and the cookie policy before adding visitor analytics.] The Facebook link is an ordinary link. If you follow it, Facebook’s own privacy and cookie policies apply. 10. Your rights Depending on the circumstances, you can ask us to: - Provide a copy of your personal information. - Correct inaccurate or incomplete information. - Delete information where we no longer have a valid reason to keep it. - Restrict certain uses of your information. - Transfer eligible information to you or another organisation. You can object to processing based on legitimate interests and to the use of your information for direct marketing. You can also withdraw consent where we rely on it. These rights are subject to legal conditions. For example, we may need to retain some records to meet legal obligations. Please contact pennarisaf@gmail.com. We normally respond within one month and may need to confirm your identity. You can also complain to the Information Commissioner’s Office: Website: https://ico.org.uk/make-a-complaint/ 11. Security and changes We use access controls and private management links to help protect guest information. Please keep your booking-management and registration links private. We may update this policy when our services or data handling change. The date at the top shows when it was last updated.