Privacy policy.

1 · Who we are

Bolney Properties Limited ("we", "us") is the data controller for personal data collected through this site and in connection with your booking.

• Company number: 05192983
• Registered office: Waterfield Mill Lane, Headley, Bordon, Hampshire, GU35 0PD
• Contact for data queries: hello@henleystays.co.uk

2 · What we collect

When you make an enquiry or book a stay, we collect:

• Your name, email address, phone number, and postal address
• Booking details — dates, property, number of guests, special requests
• Payment information (handled by our payment processor — see §5 — we don't store full card numbers)
• Communications you send us (emails, messages through the booking system)
• Identification documents in limited cases (e.g. to verify identity for high-value bookings)

When you use our site, we may automatically collect:

• IP address, browser type, device information, pages visited (used for site analytics and security)

3 · Why we use it (lawful basis)

We don't sell your data, and we don't share it for marketing purposes.

4 · How long we keep it

• Booking and payment records: 7 years from the end of the booking (HMRC requirement).
• Enquiry correspondence that doesn't lead to a booking: up to 2 years.
• Marketing subscribers: until you unsubscribe.
• Website analytics: aggregated and anonymised after 14 months.

5 · Who we share it with

We share the minimum data necessary with the following service providers:

• Smoobu (booking and channel manager — Berlin, Germany): your booking details.
• Our payment processor: payment data, processed under their own privacy terms.
• Our property manager: your name and arrival details so they can prepare the property.
• Our accountants: aggregate transaction records for HMRC filings.
• HMRC and other UK authorities: where legally required.

We never sell personal data and never share it with marketing partners.

6 · International transfers

Smoobu is based in the EU and processes data under the EU GDPR, which is essentially equivalent to UK GDPR. Other providers may transfer data to the US — where they do, they rely on the UK's International Data Transfer Agreement or the EU-US Data Privacy Framework as the legal basis for the transfer.

7 · Your rights under UK GDPR

You have the right to:

• Access the personal data we hold about you
• Correct any inaccurate or incomplete data
• Request deletion (subject to our legal obligations to keep accounting records)
• Restrict or object to certain processing
• Receive your data in a portable format
• Withdraw consent at any time (where consent is the lawful basis)
• Complain to the ICO if you think we've mishandled your data — ico.org.uk

To exercise any of these rights, email hello@henleystays.co.uk. We'll respond within one month.

8 · Cookies & analytics

This site uses Cloudflare Web Analytics, which is server-side and does not set any cookies on your device. The Smoobu booking widget sets a single functional session cookie to maintain your booking flow — this is exempt from consent requirements under PECR. We use no third-party advertising or tracking cookies.

9 · Security

We take reasonable technical and organisational measures to protect your data, including TLS encryption for all data in transit and access controls on our internal systems. No system is perfectly secure, so we encourage you to use a strong, unique password if you create an account, and to let us know immediately if you spot anything suspicious.

10 · Children

Our service is not aimed at children. We don't knowingly collect data from anyone under 16 directly — though we may process the names of children included in a booking made by an adult.

11 · Changes to this policy

We may update this policy from time to time. Material changes will be flagged on the homepage for at least 30 days. The "last updated" date at the top shows when the current version was published.

12 · Contact

For any privacy-related questions or requests, email hello@henleystays.co.uk or write to: