Privacy Policy

Last updated: 11 September 2026

This is the privacy policy of Ruthlin, the holiday let operated by Sarah Buchanan and James Buchanan (“Ruthlin”, “we”, “us” or “our”).

We respect your privacy and are committed to protecting your personal data. This policy explains how we look after your personal data when you enquire about or book a stay with us, when you stay with us, and when you use our website www.ruthlin.com. It also tells you about your privacy rights and how the law protects you.

In this policy we explain:

1. Who we are and important information
2. The personal data we collect about you
3. How we collect your personal data
4. How we use your personal data
5. Who we share your personal data with
6. International transfers
7. Data security
8. Data retention
9. Your legal rights
10. Changes to this policy
11. Queries, requests or concerns

1. Who we are and important information

Purpose of this policy

This policy gives you information on how we collect and process your personal data when you enquire about or book a stay at Ruthlin, when you stay with us, and through your use of our website. Our website and services are not intended for children and we do not knowingly collect data relating to children; bookings must be made by an adult.

Data controller

Ruthlin is operated by Sarah Buchanan and James Buchanan as individuals (sole traders), who are the controllers responsible for your personal data. Our contact details are: Ruthlin Barn, Skenfrith, Monmouthshire, NP7 8UL; email sarah@ruthlin.com. We are registered with the Information Commissioner’s Office (ICO) under registration reference ZC244102. For any questions about this policy or your personal data, please contact us at sarah@ruthlin.com.

Third-party links

Our website may include links to third-party websites (for example, local recommendations). Clicking those links may allow third parties to collect or share data about you. We do not control those websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.

2. The personal data we collect about you

Personal data means any information about an individual from which that person can be identified. You can find out more about personal data from the Information Commissioner’s Office (ICO). We collect and use the following kinds of personal data about you:

Identity Data: your name and the names of others in your party.
Contact Data: your email address, telephone number and postal address.
Booking Data: details of your stay, such as dates, number of guests, arrival time, any requests you make, and your correspondence with us.
Marketing Data: your email address and contact preferences, if you choose to sign up to our newsletter.

We do not operate user accounts, and our website does not require you to register or log in.

We do not routinely collect any Special Categories of Personal Data (such as information about your health, race or ethnicity, religious beliefs, sexual orientation, political opinions or trade union membership), and we do not collect information about criminal convictions. If you choose to share such information with us — for example, dietary or access requirements to help us prepare for your stay — we will only use it to provide what you have asked for.

If you fail to provide personal data

Where we need to collect personal data to enter into or perform a booking with you and you do not provide it when requested, we may not be able to take or fulfil your booking. We will tell you if this is the case at the time.

3. How we collect your personal data

We collect personal data from you directly:

when you enquire about or book a stay with us by email or telephone;
when you complete our guest details form (hosted using Google Forms) after booking, which we use to prepare for your stay. This may include a river-safety acknowledgement for guests intending to use the river; and
when you subscribe to our newsletter using the sign-up form on our website.

We also collect personal data through our ongoing correspondence with you.

4. How we use your personal data

We will only use your personal data when the law allows us to. Most commonly, we use it on the following bases:

Performance of a contract: to take, manage and fulfil your booking and stay.
Legitimate interests: to run and manage our holiday let, respond to your enquiries, keep proper records, and keep our guests and property safe (for example, river-safety information). We consider and balance any impact on you before relying on this basis.
Consent: to send you our newsletter, where you have signed up to receive it.
Legal obligation: to comply with our legal and regulatory duties, including keeping financial and tax records.

Purposes for which we use your personal data

To respond to your enquiry — Identity, Contact data — Legitimate interests (to answer your enquiry).
To take and manage your booking and stay — Identity, Contact, Booking data — Performance of a contract.
To prepare for your stay and keep guests safe (guest details form, river safety) — Identity, Contact, Booking data — Performance of a contract; Legitimate interests (safety).
To send you our newsletter, if you have subscribed — Contact, Marketing data — Consent.
To keep financial and business records — Identity, Contact, Booking data — Legal obligation; Legitimate interests.

Marketing

If you sign up to our newsletter, we will use your email address to send you occasional news from the valley and seasonal offers about Ruthlin. We do this only with your consent, which you give when you subscribe. You can withdraw your consent and unsubscribe at any time — by using the unsubscribe option in any newsletter email, or by contacting us at sarah@ruthlin.com. We do not sell your details, and we do not send any other marketing.

Cookies

Our website makes only limited use of cookies. You can set your browser to refuse some or all cookies. For more information about the cookies we use, please see our Cookie Policy.

5. Who we share your personal data with

We may share your personal data with the following, for the purposes set out above:

Service providers acting as processors — for example Google (which hosts our guest details form and stores our newsletter sign-ups) and our website and email providers, who process data on our instructions to help us run our services.
Our bank, to process payments for direct bookings.
Our accountant and professional advisers (such as accountants and, where needed, lawyers or insurers), acting as processors or joint controllers.
HM Revenue & Customs, regulators and other authorities, where we are required to share data by law.
Booking platforms: if you book through a third-party platform such as Airbnb, that platform operates its own privacy notice for the data it holds about you.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our service providers to use your personal data for their own purposes. If we sell, transfer or merge parts of our business, the new owners may use your personal data as set out in this policy.

6. International transfers

Some of our service providers (for example, Google, which hosts our guest details form and newsletter sign-ups) may store or process personal data outside the UK. Where they do, we rely on appropriate safeguards recognised under UK data protection law — such as UK adequacy regulations or standard data protection clauses — to protect your data. Please contact us at sarah@ruthlin.com if you would like more information about the safeguards we use.

7. Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We limit access to your personal data to those who have a business need to know. We also have procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

8. Data retention

We keep your personal data only for as long as necessary for the purposes we collected it for. In practice, we generally keep booking and guest information for up to six years after your stay — reflecting the period for which we may need to keep financial and tax records — after which we securely delete it. Newsletter sign-up data is kept until you unsubscribe. In some circumstances you can ask us to delete your data sooner (see Your legal rights below).

9. Your legal rights

Unless subject to an exemption under data protection law, you have the following rights over your personal data:

The right to request a copy of the personal data we hold about you;
The right to ask us to correct any personal data that is inaccurate or out of date;
The right to ask us to erase your personal data where it is no longer necessary for us to hold it;
The right to withdraw your consent at any time, where consent is the basis on which we process your data;
The right to ask us to provide your personal data to you or, where possible, to another controller (data portability), where applicable;
The right to ask us to restrict processing where there is a dispute about the accuracy or processing of your data; and
The right to object to our processing of your personal data, where applicable (including for direct marketing).

If you wish to exercise any of these rights, please contact us at sarah@ruthlin.com. You will not usually have to pay a fee. We try to respond to all legitimate requests within one month; occasionally it may take longer if your request is complex, in which case we will let you know.

10. Changes to this policy

This policy was last updated on 11 September 2026. We may update it from time to time, so please check back for the latest version. Please also keep us informed if your personal data changes during your relationship with us, so that the information we hold is accurate and current.

11. Queries, requests or concerns

If you have any questions about this policy or how we handle your personal data, or if you wish to make a complaint, please contact us at sarah@ruthlin.com. We operate a data protection complaints procedure: we will acknowledge your complaint within 30 calendar days of receiving it, investigate the matter, and notify you of the outcome as soon as reasonably possible.

You also have the right to complain to the Information Commissioner’s Office (ICO), although we would ask you to contact us first so we can try to resolve your concern. You can contact the ICO on 0303 123 1113, via ico.org.uk/make-a-complaint, or by writing to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.