Privacy policy.

Who we are

Within the Walls York is a holiday apartment inside York's city walls. It is run by Jonathan Truelove trading as Within the Walls York. Jonathan is the data controller for the personal information described in this policy, which means he decides how it is used and is responsible for looking after it.

If you have any questions about this policy or your information, email info@withinthewallsyork.com.

What information we collect

We only collect what you choose to give us. When you send an enquiry through the form on this website, or email us, we receive:

• your name
• your email address
• the arrival and departure dates you are interested in, and the number of guests
• anything you write in your message

If you go on to stay with us, we will also keep a record of your booking, such as your dates, the price and payment details, and any messages we exchange about your stay. We do not ask for, and would ask you not to send us, sensitive information such as health details.

When you visit the website, our hosting provider automatically records basic technical information, such as your IP address, browser type and the pages requested. This is used to run the site securely and to stop spam and abuse.

How we use it and why

What we do	Our lawful basis under UK GDPR
Reply to your enquiry, check availability and send you a price	Taking steps at your request before entering into a contract with you
Manage your booking and stay, including check-in information and any questions during your stay	Performing our contract with you
Keep booking and payment records for tax and accounting	Complying with our legal obligations
Keep a short record of enquiries so we can follow up, avoid double bookings and deal with any questions or complaints	Our legitimate interests in running the holiday let properly
Keep the website and form secure and filter out spam	Our legitimate interests in protecting the website and our inbox

We will not use your details for marketing, we will not sell them, and we do not make decisions about you using automated processing. You do not have to give us your details, but we cannot reply to an enquiry without a name and email address.

Who we share it with

We use a small number of trusted service providers to run the website and our email. They act on our instructions and may only use your information to provide their service to us:

• Netlify, Inc. hosts this website and handles the enquiry form. Form submissions are stored in our Netlify account and forwarded to our email inbox. Netlify may use a spam filtering service to screen form submissions.
• Google provides our email (Gmail), where enquiries and booking emails are received and stored.

If you book through Airbnb, Airbnb also collects and uses your information as a separate controller, and its own privacy policy applies to that booking. We receive from Airbnb only what we need to host your stay.

We may also share information where the law requires it, for example with HMRC, or with our accountant for tax purposes.

International transfers

Netlify and Google are based in the United States, so your information may be stored or processed outside the UK. Where this happens, we rely on the safeguards UK data protection law requires, such as the UK government's adequacy decision for the United States (the UK Extension to the EU-US Data Privacy Framework) for certified companies, or the UK International Data Transfer Agreement or Addendum built into those providers' data processing terms.

How long we keep it

• Enquiries that do not lead to a stay are deleted from our inbox and from Netlify within 12 months.
• Booking records for guests who stay are kept for 6 years from the end of the tax year they relate to, because HMRC requires us to keep business records.
• Website technical logs are kept by Netlify for a limited period under its own retention settings.

Cookies

This website does not use cookies. It does not use analytics or tracking tools, advertising pixels, embedded social media or third-party fonts. The availability calendar loads booked dates from our own website, and does not store anything on your device. The location map on our homepage loads map tiles from OpenStreetMap, which receives your IP address to serve them; the map itself does not set cookies.

If you follow the link to our Airbnb profile, Airbnb's own cookie policy applies on its website. If we ever add cookies that are not strictly necessary, we will update this policy and ask for your consent first.

Your rights

Under UK data protection law you have the right to:

• access the personal information we hold about you and get a copy of it
• ask us to correct information that is wrong or incomplete (rectification)
• ask us to delete your information (erasure)
• ask us to limit how we use your information (restriction)
• object to us using your information where we rely on our legitimate interests
• receive information you gave us in a portable format, or have it sent to someone else (portability)

Some of these rights have limits. For example, we may need to keep booking records for tax even if you ask us to delete them. To use any of these rights, email info@withinthewallsyork.com. There is no charge, and we will reply within one month.

Complaints

If you are unhappy with how we have handled your information, please tell us first at info@withinthewallsyork.com and we will try to put it right.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk or on 0303 123 1113.

Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last changed.

Back to Within the Walls