Privacy Policy

This Privacy Policy explains how Corprolet (“we”, “us”, “our”) collects, uses and protects personal data when you use stjohnspenthouse.co.uk (the “Website”) or book a stay with us.

If you have questions, contact [email protected].

1) Who we are (data controller)

Data Controller: Corprolet
Email: [email protected]
Website: stjohnspenthouse.co.uk
Company number: 13052546

We are the controller for the personal data you provide when you enquire, book, stay with us, or contact us.

2) What personal data we collect

We only collect data needed to run bookings and provide a safe, high-quality stay.

A) Booking and stay information

Name, email address, phone number
Booking details (dates, number of guests, pricing, discounts)
Address details if required for billing/invoicing
Communications with us (messages, emails)
Special requests you choose to share (for example, accessibility needs)

B) Payment and deposit information

Payments for bookings (and any refundable damage deposit/pre-authorisation where applicable) are processed through our booking system and payment provider. We do not intentionally store full card details on our own systems.

C) Website and device information (cookies)

Depending on your cookie choices, we may collect:

IP address, device/browser information
Pages visited, clicks, referral sources, approximate location
Booking journey events (for example, viewing availability or starting checkout)

3) How we use your data (and why)

We use personal data for the following purposes:

A) To provide your booking and stay (service delivery)

To confirm and manage bookings
To send pre-arrival / stay / check-out information
To provide support during your stay
To handle payments and refundable damage deposits/pre-authorisations

B) To run and protect our business (operations and security)

To prevent fraud and enforce house rules
To protect the Property and guests
To keep internal records and improve guest experience
To respond to enquiries and resolve issues or disputes

C) Accounting and invoicing

To keep accounting records
To raise invoices and manage payments where needed

D) To improve the Website (analytics)

To measure how the Website is used and improve performance (only where you consent to analytics cookies)

E) Advertising and marketing (ads)

If enabled and you consent to marketing cookies, we may measure ad performance and run advertising (for example, conversion tracking/remarketing)

4) Lawful bases for processing (UK GDPR)

We rely on the following lawful bases (as applicable):

Contract: to take and manage bookings and provide accommodation.
Legitimate interests: to operate our business, provide customer service, prevent fraud, protect the Property, and improve guest experience (balanced against your rights).
Legal obligation: to keep certain records for tax/accounting and compliance purposes.
Consent: for non-essential cookies (analytics/marketing). You can withdraw consent at any time.

5) Who we share your data with

We share personal data only where necessary to run your booking and operate the Website, such as:

Booking and payments

Lodgify (booking system/website booking engine used to manage reservations and guest communication)
Stripe (payment processing provider used via Lodgify for booking payments and any applicable deposit/pre-authorisation)

Accounting and invoicing

Xero (accounting software used for bookkeeping and invoicing where applicable)

Website and security

Hosting, security and IT providers used to maintain and secure the Website and systems

Analytics and advertising (where enabled and consented)

Analytics/advertising providers (for example Google Analytics / Google Ads) where you have consented via the cookie banner

We may also share data where required by law, or to protect our rights (for example, in relation to a legal claim).

6) International transfers

Some service providers may process data outside the UK. Where this happens, we use appropriate safeguards to help protect your information (for example, adequacy regulations or approved contractual protections).

7) How long we keep your data (retention)

We keep personal data only as long as needed for the purposes above, then securely delete or anonymise it.

Typical retention periods:

Booking and accounting records: usually kept for up to 6 years for tax/accounting purposes (or longer where required).
Enquiries with no booking: typically up to 12 months after last contact, unless you ask us to delete it sooner.
Disputes/incidents: retained as long as reasonably necessary to handle the issue and meet legal or insurance requirements.

8) Your rights

You have rights over your personal data, including: access, rectification, erasure, restriction, objection, and (in some cases) data portability.

To exercise your rights, email [email protected]. We may need to verify your identity before responding.

If we rely on consent (for example, analytics/marketing cookies), you can withdraw consent at any time using the cookie banner settings (where available) and/or your browser controls.

9) Complaints

If you have concerns, please contact us first at [email protected] and we will try to resolve the issue.

You also have the right to complain to the UK regulator, the Information Commissioner’s Office (ICO).

10) Cookies

We use cookies (including essential cookies needed for bookings) and may use analytics and advertising cookies depending on your choices.

Please see our Cookies Policy

11) Children

Our accommodation and Website are not intended for children to use independently for bookings. If information about children is provided as part of a family booking, it will only be used to provide the stay.

12) Changes to this policy

We may update this Privacy Policy from time to time. The latest version will always be posted on this page with the “Last updated” date.

13) Contact

Corprolet
Email: [email protected]
Address: 30 Cordon Close, TF2 8DY

14) Privacy policy status

Last updated: 20.01.2026