Privacy Policy 2018
Your privacy is important to us and we are committed to protecting your personal data.
This privacy notice will tell you who we are; how and why we collect, store, use and share your personal data; your rights in relation to your personal data and how to contact us and the supervisory authorities in the event that you have a complaint.
Who we are
We are Ecosse Unique Limited, trading as Unique Cottages (company number SC465865), a company incorporated and registered in Scotland. The terms “we” or “our” or “us” in this policy are all to be taken as being references to us. Our registered office and trading address is Monksford Road, Newtown St Boswells, Roxburghshire TD6 0SB and you can write to us there, telephone us on 01835 822277 or contact us by email at dpo@unique-cottages.co.uk. We have appointed a Data Protection Officer who will be happy to handle your enquiries.
Our website is www.unique-cottages.co.uk (website) and this privacy notice is published on our website but you can also obtain a copy by contacting us. This privacy notice is issued on 4 May 2018 but we reserve the right to amend it any time by publishing the amended policy on our website. Where necessary we shall provide you with an updated privacy notice through any contact details you may have provided to us.
Your personal data
Personal data means any information about an individual from which that person can be identified (personal data). It does not include data where the person's identity has been removed.
In the course of our business, we collect, use and are responsible for certain personal data about you and, by doing so, we are regulated under UK data protection laws (including the General Data Protection Regulation) (Data Laws) as the ‘controller’ of your personal data for the purposes of Data Laws.
The personal data we collect and use
We may collect, use, store and transfer different kinds of personal data about you, which we group together under different headings, as follows:
- Identity Data includes your title, first name, last name, age group and any special requirements.
- Contact Data includes your home address, email address, phone number and mobile number.
- Financial Data includes your bank account and payment card details.
- Transaction Data includes details about payments to and from you and other details of products and services you have purchased.
- Technical Data includes your internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website.
- Profile Data includes purchases or orders made by you, feedback and survey responses.
- Usage Data includes information about how you use our website, products and services.
- Marketing/Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.
When you book accommodation through us, we will ask for Identity Data about any person or persons who are in your party for that booking. You confirm to us that you have authority to provide us with the Identity Data of that person or persons and you are responsible for ensuring that they are aware of the content of this privacy policy. Their personal data is also subject to this privacy policy.
We also collect, use and share data which has been aggregated (Aggregated Data), such as statistical or demographic data for any purpose. Aggregated Data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific feature of our website. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we will treat the combined data as personal data which will be used in accordance with this privacy notice.
We do not collect any special categories of personal data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.
If you fail to provide us with personal data
Where we need to collect personal data by law, or under the terms of a contract and you fail to provide that personal data when requested, it may not be possible to perform the contract or to enter into that contract (for example, to provide you with holiday accommodation). In this case, we may have to cancel a product or service but we will notify you if this is the case at the time.
How your personal data is collected
Normally, we would collect personal data when you wish to make a booking through us or to make an enquiry about a property or if you let your holiday accommodation with us or if you have sent us a CV.
We use different methods to collect data from and about you including through:
Direct interactions. You may give us your Identity Data, Contact Data and Financial Data by filling in forms or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you:
- apply to book holiday accommodation;
- make an enquiry regarding accommodation;
- subscribe to our newsletter;
- enter a competition, promotion or survey;
- give us some feedback.
- request an occupancy and rental projection;
- let your accommodation through us; or
- create an owners account on our website.
Automated technologies or interactions. If you interact with our website, we may automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. Please see our cookie policy for further details.
Third parties or publicly available sources. We may receive personal data about you from various third parties and public sources as set out below:
- Technical Data from analytics providers such as Google, based outside the EU.
How we use your personal data
We will only use your personal data when permitted to do so by law. Most commonly, we will use your personal data in the following circumstances:
- Where we need to perform the contract you are about to enter into or have entered into.
- Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
- Where we need to comply with a legal or regulatory obligation.
The purposes for which we will use your personal data
We set out below:
- how we plan to use your personal data,
- the legal basis or bases we are relying upon in order to do so, and
- our legitimate interests in doing so.
We may use and process your personal data for more than one lawful basis depending upon the specific purpose for which we will be using your personal data. Please contact us if you need details about the specific legal basis we are relying on to process your personal data, where more than one basis has been set out in the table below:
Purpose/Activity: | To book holiday accommodation. | |
Type of Data: | a) Identity, (b) Contact. | |
Lawful basis for processing and our legitimate interest in doing so: | Performance of a contract with you. | |
Purpose/Activity: | To process and deliver your holiday accommodation booking including: (a) Manage payments, fees and charges, (b) Collect and recover money owed. | |
Type of Data: | (a) Identity, (b) Contact, (c) Financial, (d) Transaction, (e) Marketing/Communications. | |
Lawful basis for processing and our legitimate interest in doing so: | (a) Performance of a contract with you, (b) Necessary for our legitimate interests (to recover debts due). | |
Purpose/Activity: | To let holiday accommodation on your behalf including: (a) Manage payments, fees and charges, (b) Collect and recover money owed to you. | |
Type of Data: | (a) Identity, (b) Contact, (c) Financial, (d) Transaction, (e) Marketing/Communications. | |
Lawful basis for processing and our legitimate interest in doing so: | (a) Performance of a contract with you, (b) Necessary for our legitimate interests (to recover debts due to us). | |
Purpose/Activity: | To make any enquiry regarding holiday accommodation. | |
Type of Data: | (a) Identity, (b) Contact | |
Lawful basis for processing and our legitimate interest in doing so: | Necessary for our legitimate interests (in answering your enquiry, to ensure that it derives from a named person). | |
Purpose/Activity: | To deal with your communications with us | |
Type of Data: | (a) Identity, (b) Contact, (c) Financial, (d) Transaction, (e) Marketing/Communications. | |
Lawful basis for processing and our legitimate interest in doing so: | (a) Performance of a contract with you, (b) Necessary for our legitimate interests for running our business. | |
Purpose/Activity: | To manage our relationship with you which will include: (a) Notifying you about changes to our terms and conditions or to our privacy policy, (b) Asking you to leave a review or take a survey. | |
Type of Data: | (a) Identity, (b) Contact, (c) Profile, (d) Marketing/ Communications. | |
Lawful basis for processing and our legitimate interest in doing so: | (a) Performance of a contract with you, (b) Necessary to comply with a legal obligation, (c) Necessary for our legitimate interests (to keep our records updated and to study how customers or owners use our products/services). | |
Purpose/Activity: | To enable you to partake in a prize draw, competition or complete a survey. | |
Type of Data: | (a) Identity, (b) Contact, (c) Profile, (d) Usage, (e) Marketing/Communications. | |
Lawful basis for processing and our legitimate interest in doing so: | (a) Performance of a contract with you, (b) Necessary for our legitimate interests (to study how customers or owners use our products/services, to develop them and grow our business). | |
Purpose/Activity: | To administer and protect our business and our website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data). | |
Type of Data: | (a) Identity, (b) Contact, (c) Technical. | |
Lawful basis for processing and our legitimate interest in doing so: | (a) Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation, (b) Necessary to comply with a legal obligation. | |
Purpose/Activity: | To provide cookies on our website to deliver a page tailored to you on your computer, hard drive, smartphone or tablet. | |
Type of Data: | (a) Identity | |
Lawful basis for processing and our legitimate interest in doing so: | (a) Necessary for our legitimate interests (for running an efficient website to identify you, personalise your experience when you visit our website and to analyse web traffic including providing relevant information based on previous choices or information entered). For information on how to configure your browser not to accept cookies please see our Cookie Policy. | |
Purpose/Activity: | Any personal information you provide in using our "Live Chat" functionality. | |
Type of Data: | (a) Identity | |
Lawful basis for processing and our legitimate interest in doing so: | Necessary for our legitimate interests (in answering your enquiry, to ensure that it derives from a named person). |
Who we share your personal information with
If you book accommodation through us, your Identity Data and Contact Data (and that of anyone else in your party) will be passed to and processed and stored by the owner of the holiday accommodation which you have booked and may be shared with their caretaker and with any other person who acts as their agent on the ground. This data sharing enables each of them to handle your booking efficiently and enables them to contact you, if they consider that that is either necessary or desirable for the purposes of your booking – so, for example, to collect and return keys.
We provide Live Chat and if you use that service then that allows you to message a member of our staff who will answer your queries and provide information to you in real time. Live Chat is provided by a third party whose privacy policy is to be found at https://www.livechatinc.com/privacy-policy. When Live Chat is used, third parties will place cookies on your computer to enable the service to work and then both we and those related third parties will process information which may include information that you have provided about yourself.
Google Analytics features have been implemented on our website and this means that information such as your age, gender, location and interests can be recorded upon visiting our website.
We advertise using Google AdWords and you may have been directed to our site by Google. If you would like more information about the Google AdWords policy then please get in touch with us, or alternatively, information about Google AdWords is available online.
When your booking is completed, then your email address will be sent to Feefo which is a 3rd party customer feedback partner which helps us to provide the best customer service possible. Feefo will email you to ask whether you would like to provide your opinion about your experience with us and the property in which you stayed. Feefo will not use your information for any other purpose or share your information with any 3rd party and you can unsubscribe from the service at any time via the opt-out link on their email. You can read Feefo’s privacy policy at https://en.business.feefo.com/privacy-policy/.
If you call us by telephone, then we may monitor and/or record that phone conversation for training and customer service reasons.
We use Pay360 which provides online credit processing as a safe and secure means of collecting payments via the Internet. When you provide your payment information, we transmit it via an encrypted connection to Pay360 which then uses and processes your payment information in accordance with their privacy policy. All online credit card transactions using the Pay360 gateway are secured payments. Your complete credit card number cannot be viewed by us or by any other outside party.
We may need to collect more sensitive personal data such as information concerning a medical condition, a disability or your special requirements but will only do so in order to take into account your particular needs in relation to a booking.
We will share personal information with law enforcement or other authorities if required by applicable law.
We will not share your personal information with any other third party.
Links to other websites
Our website may contain links to other websites. Once a link is clicked, we do not have any control over these websites and so cannot be responsible for the protection and privacy of any personal data or information which you provide whilst visiting them. You must consider their own privacy policy before providing any personal data or information on such websites.
How long will your personal data be kept
Where you have booked holiday accommodation, we will retain your personal data for a period of 7 years for legal purposes, and so that we can deal with any questions, feedback or issues which arise in connection with your booking and in case any legal issues arise.
Where we have your Identity Data for the purpose marketing communications, then we will contact you at least every 3 years and confirm that you remain happy to receive our marketing communications.
Where you have a contract with us, we will retain your personal data for a period of 7 years for legal purposes, and so that we can deal with any questions, feedback or issues which arise in connection with your booking and in case any legal issues arise.
Where you have made an enquiry of us, we will retain your personal data for a period of 3 years for legal purposes, and so that we can deal with any questions, feedback or issues which arise in connection with your enquiry and in case any legal issues arise.
Your rights
Under UK data protection laws, you have a number of important rights which you can exercise free of charge. In summary, you can:
Request access to your personal data (commonly known as a "data subject access request"): This enables you to receive a copy of the personal data which we hold about you and to check that we are lawfully processing it.
Request correction of the personal data that we hold about you: This enables you to have any incomplete or inaccurate data which we hold about you corrected, though we may need to verify the accuracy of the new data which you provide to us.
Request erasure of your personal data: This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms: You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
Request restriction of processing of your personal data: This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data's accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
Request the transfer of your personal data to you or to a third party: We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
Withdraw consent at any time where we are relying on consent to process your personal data: However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.
For further information on each of those rights, including the circumstances in which they apply, see the Guidance from the UK Information Commissioner's Office (ICO) on individuals rights under the General Data Protection Regulation.
If you would like to unsubscribe from any email newsletter you can also click on the 'unsubscribe' button at the bottom of the email newsletter.
How to contact us to exercise your rights
If you would like to exercise any of the above rights, please email, call or write to us or to our Data Protection Officer, letting us know the information to which your request relates.
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.
Time limit to respond
We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so only in an authorised manner.
How to complain
We hope that we or our Data Protection Officer can resolve any query or concern you raise about our use of your personal data.
UK data protection laws give you the right to lodge a complaint with a supervisory authority where you work, normally live or where any alleged infringement of data protection laws has occurred. The supervisory authority in the UK is the Information Commissioner who may be contacted at https://ico.org.uk/concerns or by telephone on 0303 123 1113.