Lunshaw Farm Privacy Policy

Privacy Policy

Last updated 6 October 2026

At Lunshaw Farm we are committed to protecting the personal data we hold about you and to respecting your privacy.

This policy sets out what we collect and how we use it. If you need to know more, you can contact us by email at stay@lunshawhouse.co.uk, by phone on +44 (0)1609 000 000, or by post at Lunshaw House Farm, Boltby, Thirsk, North Yorkshire, YO7 2HU.

This policy covers:

About this policy
How we use your personal data
Other uses and disclosures
Sensitive personal data
Children’s data
Security and retention of your personal data
Your rights and how to contact us
Changes to this privacy policy

1. About this policy

This policy, together with our website terms of use and any other documents it refers to, describes the personal data we collect from or about you and how we use it. Please read it carefully so you understand how we use your data and why.

The data controller, meaning the organisation that decides how your data is used, is [Company name] (company number [number]), with its registered address at Lunshaw House Farm, Boltby, Thirsk, North Yorkshire, YO7 2HU.

2. How we use your personal data

A) What personal data do we collect?

Personal data is any information that could identify you. Depending on our relationship with you, we may collect, store and use:

your name, date of birth and address
your email address and phone number
demographic information
your business VAT number, if you are a sole trader supplying us and we need to issue you a tax invoice
your social media handle, if you interact with us on social media
anything you share with us when you contact us by email, phone or social media
images of you on CCTV on our premises
information about your visits to our website, including how you arrived, what you looked at, how you interacted with pages and where you went next
technical information about how you access our website, including your IP address, location, browser, time zone, operating system and device

B) How do we collect personal data?

Directly from you: when you contact us, interact with us on social media, visit us or book a stay.
From the person who made the booking: if someone books on your behalf and gives us your details.
From publicly available sources: for example, your public social media profile when you interact with us.
From third party service providers or partners: for example, if you book through a travel agent or booking platform, they will pass your details to us to manage the booking.
Through your browser or device: most browsers collect certain information automatically, and our servers log your IP address or device identifier.
Through cookies: small files stored on your device that tell us things like your browser type, pages visited and time on site. They help us recognise you and improve the website. See our Cookie Policy for details and how to limit cookies.
Google Ads and Google Analytics: we may use these services, which use cookies and similar technologies to help us understand how people use our website and measure our advertising. You can read Google’s Privacy Policy and opt out of Google Analytics using the opt-out browser add-on.

C) How do we use personal data, and why?

To run Lunshaw Farm, welcome guests and provide our services:

to reserve your accommodation, meet any requirements you have and communicate with you about your booking
to provide the information and services you request and answer your questions
to send you access details for your stay, such as a key safe code
to meet any dietary or health requirements, where relevant and essential

We do this because we have a contract with you or because it is in our legitimate interests to look after our guests well. We will only process dietary, health or other sensitive data with your explicit consent or where the law otherwise allows.

For marketing, and to measure how well it works:

if you have stayed with us, we may send you news and offers by post or email that we think will interest you
where you have opted in, we will send you promotions, special offers and event information
to measure the effectiveness of our marketing and advertising

We rely on your consent to email you where we have no previous relationship with you, and on our legitimate interests otherwise. You can unsubscribe at any time.

To share information with partners for marketing, only with your consent:

We may occasionally share details with partners so they can tell you about services you may like. We will only do this with your consent, which you can withdraw at any time.

To fulfil our agreement with suppliers:

If you are a sole trader supplying us, we will use your data to pay you and perform our agreement. We may also carry out credit checks on suppliers where it is in our legitimate interests.

For administrative and internal business purposes:

to present our website clearly on your device
to run and troubleshoot the website, including analysis, testing and surveys
to understand and improve our business, using aggregated data

It is in our legitimate interests to make sure our website works well and our services are high quality.

For security, legal and compliance purposes:

to comply with tax law
to keep our website safe and secure
to detect or prevent fraud or other illegal activity
to comply with laws and legal processes
to protect our rights and property, or those of others, including through CCTV

Sometimes we must use your data to meet a legal obligation. In other cases, such as fraud prevention, we rely on our legitimate interests.

Profiling: we do not use personal data for automated processing that makes assumptions about you. If this changes, we will update this policy.

We will never sell your personal data or give it to anyone to use for their own purposes without telling you. We do share it in the following ways.

(i) With organisations that provide services to us

We use trusted third parties for specific functions, which means sharing some of your data with them. These include:

[booking system provider], which helps us take and manage bookings
[website host], which hosts and administers our website
[payment provider], which processes card payments
Google Analytics, which helps us understand how our website is used, on an aggregated basis
[email and CRM provider], which helps us manage communications with guests

These providers may only use your data to provide services to us, and we only work with organisations we trust to look after it properly.

In rare cases we may share some data with our insurers, limited to what they need to provide cover.

(ii) If our business ownership changes

If we sell or propose to sell all or part of our business, or our ownership changes, we may need to share your data with prospective or new owners.

(iii) To comply with the law

We may be legally required to share your data, for example with the police or public authorities to prevent or detect crime.

International transfers

Some of our suppliers may store or process your data outside the UK or European Economic Area. Where this happens, we make sure it is protected as the law requires, for example through UK adequacy regulations or approved contract terms with the recipient.

3. Other uses and disclosures

We will use and disclose personal data where we believe it is necessary or appropriate to:

comply with applicable law, including laws outside your country of residence
comply with legal process
respond to requests from public and government authorities, including for national security or law enforcement
enforce our terms and conditions
protect our operations
protect the rights, privacy, safety or property of Lunshaw Farm, you or others
pursue available remedies or limit any damages we may suffer

4. Sensitive personal data

Lunshaw Farm will only ask for sensitive personal data to protect a guest’s interests or our own. Examples include allergy or dietary information we need to know about, or identity information required for legal purposes or to prevent fraud.

5. Children’s data

Our services are not aimed at children under 13, although children are very welcome to stay at Lunshaw Farm with a parent, guardian or responsible adult.

If you would like us to provide something tailored to your child, such as marking a birthday or catering for an allergy, a parent or legal guardian must provide the relevant information.

6. Security and retention of your personal data

Security: we take appropriate technical and organisational measures to protect personal data against unlawful or unauthorised processing, accidental loss or damage. We keep it secure from the point we collect it to the point we destroy it.

Retention: we only keep your personal data for as long as we need it for the purposes in this policy, so retention periods vary. For example, we only keep information about allergies or health conditions for the duration of your stay. Marketing data you consented to is kept until you withdraw consent or we stop marketing.

7. Your rights and how to contact us

The law gives you a number of rights over your personal data. You have the right to:

ask us not to use your data for direct marketing
see what personal data we hold about you and how we process it, and in some cases ask us to provide a copy to a third party
ask us to correct or update inaccurate data
ask us to delete your data in some circumstances, where there is no good reason for us to keep processing it
ask us to temporarily stop using your data if you believe we have no right to use it, or to stop using it where there is no good reason to continue
not be subject to decisions made solely by automated processing, without human input, in certain circumstances
receive the data you gave us in a structured, commonly used, machine-readable format, and ask us to send it directly to another organisation

To exercise any of these rights, or if you have questions about how we use your data, contact us by email at stay@lunshawhouse.co.uk, by phone on +44 (0)1609 000 000, or by post at Lunshaw House Farm, Boltby, Thirsk, North Yorkshire, YO7 2HU.

The supervisory authority

If you want to complain about how we have handled your data, the UK supervisory authority is the Information Commissioner’s Office (ICO). Helpline: +44 (0)303 123 1113. Website: ico.org.uk/concerns.

We would always appreciate the chance to put things right first, so please contact us before going to the ICO.

8. Changes to this privacy policy

We will post any future changes to this policy on this page, and may also email you about them if we have your email address. Please check back from time to time to see any updates.