Privacy Policy
Cavens Country House Kirkbean, Dumfries & Galloway, DG2 8AA, Scotland
Last updated: July 2026
Who we are
Cavens Country House ("Cavens", "we", "us", "our") is the data controller responsible for your personal data. We are a small, independently run boutique hotel in Dumfries & Galloway, Scotland.
If you have any questions about this privacy policy or how we handle your data, please contact us:
- Email: enquiries@cavens.com
- Telephone: 01387 880 234
- Post: Cavens Country House Hotel, Kirkbean, Dumfries & Galloway, DG2 8AA, Scotland
What this policy covers
This policy explains what personal data we collect, why we collect it, how we use it, who we share it with, and what rights you have over your data. It applies to information collected through our website (cavens.com), by telephone, by email, and in person during your stay.
The legal framework
We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025. Where we serve guests from the European Economic Area, we also comply with the EU General Data Protection Regulation (EU GDPR). For guests visiting from the United States, we respect applicable state privacy laws including the California Consumer Privacy Act (CCPA) where relevant.
We are registered with the Information Commissioner's Office (ICO) as a data controller.
What personal data we collect
Depending on how you interact with us, we may collect the following:
When you make a booking or enquiry: your name, email address, telephone number, postal address, payment card details (processed securely by our booking provider), arrival and departure dates, room preferences, dietary requirements, and any special requests.
When you stay with us: the information above, plus your nationality (as required by the Immigration (Hotel Records) Order 1972 for all guests over 16), vehicle registration (if applicable), and any information you choose to share to help us improve your stay.
When you sign up for our newsletter: your name and email address.
When you use our website: your IP address, browser type, pages visited, and cookies (see the Cookies section below).
When you contact us: any information you include in your correspondence.
Why we collect your data and our legal basis
We only collect personal data when we have a lawful reason to do so. The table below sets out the purposes for which we process your data and the legal basis we rely on in each case.
To process your booking and provide our services — Legal basis: Performance of a contract with you.
To comply with legal obligations — such as keeping guest records under the Immigration (Hotel Records) Order 1972 and retaining financial records for HMRC — Legal basis: Legal obligation.
To respond to your enquiries and correspondence — Legal basis: Legitimate interest (to respond to communications and provide customer service).
To send you our newsletter and information about offers — Legal basis: Consent. You may withdraw your consent at any time (see Your Rights below).
To improve our website and understand how visitors use it — Legal basis: Legitimate interest (to maintain and improve our services).
To manage dietary requirements, accessibility needs, or health-related requests — Legal basis: Explicit consent, given when you provide this information to us.
Who we share your data with
We do not sell, rent, or trade your personal data. We share data only with the following categories of trusted third parties, and only to the extent necessary:
Brevo (Sendinblue) — our email marketing platform, used to send newsletters and offer updates. Brevo processes your name and email address on our behalf. Brevo is headquartered in France and processes data in compliance with EU GDPR. Their privacy policy is available at brevo.com/legal/privacypolicy.
freetobook — our online booking platform. When you make a reservation through our website, your booking information is processed by freetobook. Their privacy policy is available at freetobook.com/privacy.
Google Analytics — we use Google Analytics to understand how visitors use our website. This involves the processing of anonymised usage data, including your IP address (which is anonymised before storage). You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.
Payment processors — card payments are handled securely by our payment provider. We do not store your full card details.
Professional advisers — our accountants and legal advisers, where necessary for business administration.
Law enforcement or regulatory bodies — where we are legally required to do so.
International data transfers
Some of our third-party service providers process data outside the United Kingdom. Where this occurs, we ensure appropriate safeguards are in place:
- Brevo processes data within the European Economic Area, which the UK recognises as providing adequate data protection.
- Google may transfer data to the United States under its data processing terms, which include Standard Contractual Clauses approved by the relevant authorities.
We do not transfer your personal data to any country that does not provide an adequate level of data protection without appropriate safeguards in place.
How long we keep your data
We retain personal data only for as long as necessary for the purpose it was collected:
Booking and guest records — for up to 2 years after your last stay, unless we are required by law to keep them longer.
Financial and tax records — for 7 years, as required by HMRC.
Immigration (Hotel Records) Order records — for a minimum of 12 months, as required by law.
Newsletter subscribers — until you unsubscribe. We will remove your data from our mailing list promptly upon request.
Website analytics data — anonymised and retained in accordance with Google's data retention settings (currently set to 14 months).
Enquiry correspondence — for up to 12 months after the last communication.
Cookies
Our website uses cookies — small text files placed on your device — to help us understand how visitors use the site and to improve your experience.
Essential cookies — required for the website to function properly (e.g. session management). These cannot be switched off.
Analytics cookies — we use Google Analytics to collect anonymised information about how visitors use our website, including which pages are most popular and how visitors navigate through the site. This data helps us improve the website. These cookies do not identify you personally.
Third-party cookies — our booking widget (freetobook) may set its own cookies when you use the reservation system.
You can manage your cookie preferences through your browser settings. Most browsers allow you to refuse or delete cookies. Please note that disabling cookies may affect the functionality of some parts of our website.
For more information about cookies, visit allaboutcookies.org.
Your rights
Under UK GDPR (and EU GDPR where applicable), you have the following rights over your personal data:
Right of access — you can request a copy of the personal data we hold about you.
Right to rectification — you can ask us to correct any data that is inaccurate or incomplete.
Right to erasure — you can ask us to delete your personal data, subject to any legal obligations we have to retain it.
Right to restrict processing — you can ask us to limit how we use your data in certain circumstances.
Right to data portability — you can request that we provide your data in a structured, commonly used format so you can transfer it to another organisation.
Right to object — you can object to our processing of your data where we rely on legitimate interest as the legal basis.
Right to withdraw consent — where we process your data based on your consent (such as newsletter subscriptions), you can withdraw that consent at any time. You can unsubscribe from our newsletter by clicking the unsubscribe link in any email, or by contacting us directly.
To exercise any of these rights, please contact us at enquiries@cavens.com. We will respond to your request within 30 days.
For visitors from the United States
If you are a resident of California, you may have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we have collected and the right to request its deletion. We do not sell personal information. To exercise your rights, please contact us using the details above.
How to complain
If you are unhappy with how we have handled your personal data, we would like the chance to put things right. Please contact us at enquiries@cavens.com in the first instance.
If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
- Website: ico.org.uk
- Telephone: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
If you are located in the European Economic Area, you may also contact your local data protection authority.
Children's data
We do not knowingly collect personal data from children under the age of 16 through our website. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.
Changes to this policy
We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. The date at the top of this page shows when it was last updated. We encourage you to review this page periodically.
Security
We take appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include secure hosting, encrypted connections (SSL/TLS) for our website, access controls for staff, and careful selection of third-party service providers.
While we take every reasonable precaution to protect your data, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security but are committed to maintaining the highest standards of data protection.
Cavens Country House, Kirkbean, Dumfries & Galloway, DG2 8AA, Scotland enquiries@cavens.com — 01387 880 234