Hatterrall Lettings Limited · hatterrall.co.uk
Version 2.0 · Last updated: 4th May 2026
Your privacy matters to us. This statement explains what personal data we collect about you, why we collect it, how we use and share it, and what rights you have. It applies to all users of our services and website.
This statement is governed by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. References to ‘GDPR’ throughout mean the UK GDPR unless otherwise stated.
1. Who We Are
We are Hatterrall Lettings Limited (company number 17102564), Mr and Mrs Griffiths, trading together as Hatterrall. We operate the holiday cottage portfolio at hatterrall.co.uk, comprising Hatterrall Farmhouse, Hatterrall Barn, and Tri Afon Cottage, set at the foothills of the Black Mountains, Longtown, Herefordshire.
Throughout this statement, ‘we’, ‘us’, and ‘our’ refers to Hatterrall Lettings Limited and Mr and Mrs Griffiths jointly.
2. Data Controller
Hatterrall Lettings Limited is the data controller for personal data collected in connection with your use of our website and services.
Contact details
- Address: Cwm Farm, Longtown, Herefordshire, HR2 0PA, United Kingdom
- Email: hatterrall.herefordshire@gmail.com
- Telephone: 01873 860656
Please contact us using the above details if you have any questions about this statement, or if you wish to exercise any of your rights (see Section 8).
3. What Personal Data We Collect
Information you provide directly
We collect personal data when you contact us, make a booking, subscribe to our newsletter, submit a review, or enter a competition. This may include your name, email address, phone number, and postal address.
We may also ask for the names and ages of guests in your party, some of whom may be under 18. If you provide information about anyone under 18, you confirm that you are their parent or guardian and consent to us handling their details.
Information generated when you use our services
- Site management data: whether you are logged in, server logs for error monitoring, your IP address and device information.
- Session data: booking information, searches performed, IP address, operating system, browser or app version.
- Analytics data: how you find, navigate, and interact with our website, collected via analytics tools.
Information from third parties
We may receive information about you from third parties, including:
- Payment providers, email service providers, and review partners who help us deliver our services.
- Social media and search engine marketing partners.
- Marketing list and database providers.
- Publicly available sources.
Information from these sources may be combined with data we already hold about you.
4. Why We Use Your Data & Our Lawful Basis
UK GDPR requires us to have a lawful basis for each type of processing. The table below sets out the purposes for which we use your data and the basis on which we do so:
| Purpose | Lawful basis (UK GDPR) | Details |
| Managing your booking | Contract (Art. 6(1)(b)) | We need your details to fulfil your reservation. |
| Communicating about your stay | Contract (Art. 6(1)(b)) | Booking confirmations, balance reminders, arrival info. |
| Legal & tax obligations | Legal obligation (Art. 6(1)(c)) | We are required to retain financial records for 6 years. |
| Website analytics & improvement | Legitimate interests (Art. 6(1)(f)) | Understanding how our site is used to improve it. |
| Direct marketing | Consent (Art. 6(1)(a)) | Only where you have opted in. You can withdraw at any time. |
| Fraud prevention & security | Legitimate interests (Art. 6(1)(f)) | Protecting our systems and guests from fraudulent activity. |
5. Cookies & Tracking Technologies
We use cookies, pixels, and similar technologies on our website. For full details of the cookies we use and how to manage them, please see our Cookie Policy.
6. How We Share Your Data
We do not sell your personal data. We share it only in the following circumstances:
Service providers
We share data with trusted third parties who act on our behalf, such as payment processors, mailing services, and marketing tools. They are only given the data necessary to perform their service and are contractually required to keep it secure.
Business partners
We may share data with consultants and marketing partners where we have a legitimate interest, or where you have given consent, or where it is necessary to fulfil a contract.
Advertising platforms
We may share data with platforms such as Google and Facebook to deliver relevant advertising. You can manage your preferences via the opt-out links in Section 9.
Public forums
If you submit content through public forums such as review platforms or social media, any personal information you include is shared at your own risk.
Legal requirements
We may disclose your data when required by law or to protect our legal rights — for example, in the event of a dispute.
International transfers
Where we share data with parties outside the UK, we ensure that appropriate safeguards are in place in accordance with UK GDPR requirements, such as the UK’s international data transfer agreements or adequacy regulations.
7. How Long We Keep Your Data
We retain your personal data only for as long as necessary for the purpose for which it was collected. As a guide:
- Booking and financial records: 6 years from the date of your stay, to comply with our legal and tax obligations.
- Marketing data: until you withdraw consent or opt out.
- Website analytics data: typically 26 months, in line with standard analytics tool defaults.
- Enquiries and correspondence: up to 3 years, unless a booking results from the enquiry.
8. Your Rights
Under UK GDPR you have the following rights in relation to your personal data:
| Your right | What it means |
| Right of access | You can request a copy of the personal data we hold about you (a Subject Access Request). We will respond within one month. |
| Right to rectification | If any information we hold is inaccurate or incomplete, you can ask us to correct it. |
| Right to erasure | You can ask us to delete your personal data where there is no compelling reason for us to keep it. |
| Right to restriction | You can ask us to restrict how we use your data in certain circumstances. |
| Right to portability | You can ask us to provide your data in a structured, machine-readable format so you can transfer it to another service. |
| Right to object | You can object to us processing your data for direct marketing or where we rely on legitimate interests as our lawful basis. |
| Right to withdraw consent | Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing. |
To exercise any of these rights, please contact us at hatterrall.herefordshire@gmail.com, or write to us at Cwm Farm, Longtown, Herefordshire, HR2 0PA. We will respond within one month.
If you are not satisfied with how we have handled your data, you have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.
9. Marketing Preferences & Opt-Outs
You can opt out of marketing communications from us at any time by:
- Email: clicking the unsubscribe link at the bottom of any marketing email.
- Post: following the instructions within the mailing, or returning it to the sender address.
- Google ads: support.google.com/ads/answer/2662922
- Facebook ads: facebook.com/ads/preferences
Please note: opting out of marketing will not stop operational messages such as booking confirmations or balance reminders. Preference changes may take a short time to take effect.
10. Security
We take data security seriously. Our systems are protected by industry-standard firewalls and password controls. Sensitive data such as payment information is secured by SSL encryption. We monitor server activity to detect and prevent suspicious or fraudulent behaviour.
11. External Links
Our website may contain links to third-party websites. Once you leave hatterrall.co.uk, this privacy statement no longer applies. We encourage you to read the privacy policies of any external sites you visit.
12. Updates to This Statement
We review this statement regularly and will update it when our practices change or when required by law. If we make significant changes, we will notify you via our website or by email where possible. The current version and date are shown at the top of this document.
Hatterrall Lettings Limited · hatterrall.co.uk · Company No. 17102564 · Version 2.0 · 4th May 2026