Privacy Statement

Last updated: 21 September 2026

Who we are

The data controller is Fiona Craig, a sole trader trading as The Old Smiddy Cottage and Apartment. In this Privacy Statement, “The Old Smiddy”, “we”, “us” and “our” refer to this business.

Address: The Old Smiddy Cottage and Apartment, Haldane Terrace, Balloch, Alexandria, G83 8ER
Telephone: 07719 401608
Email: auldsmiddy@blueyonder.co.uk

Please use these details if you have a question about this statement or how we use your personal information.

Personal information we collect

We collect only the information reasonably needed to answer enquiries, administer stays, take payments, meet our record-keeping duties and operate our website.

Depending on how you contact or book with us, this may include:

Your name, postal address, email address and telephone number.
The accommodation and dates requested, the number of people staying and messages connected with your enquiry or booking.
For confirmed bookings, the lead guest’s contact details, check-in and check-out dates, party size, and vehicle make and registration number.
Information you choose to give us about accessibility, allergies or other special requirements.
Booking and communication details received from Airbnb, Booking.com, Vrbo or another booking service you use.
Payment and transaction records, including the amount, date, payment method and reference. We do not retain a copy of your full card number or card security code.
Reviews submitted through FreeToBook or another platform.
Technical information about your use of our website, where permitted, such as your device, browser, IP address and the pages viewed.

How we use your information

We use personal information for the following purposes and lawful bases:

Responding to enquiries

We use your information to answer an enquiry and take steps you request before making a booking. We rely on taking steps before entering into a contract and our legitimate interests in managing enquiries.

Managing your booking and stay

We use your information to confirm and administer your booking, communicate with you about your stay and provide the accommodation. This processing is necessary for the performance of our contract with you.

Payments and financial records

We use payment and transaction information to take payments, manage deposits, cancellations or refunds, and maintain financial records. We rely on the performance of our contract and compliance with our legal obligations.

Licensing and guest records

We may keep guest and vehicle information where it is reasonably required for accommodation licensing, record keeping, security or responding to an appropriate request from a local authority. We rely on compliance with our legal obligations where a specific duty applies and our legitimate interests where appropriate.

Tax, accounting and legal claims

We retain relevant records to comply with tax and accounting requirements and to establish, exercise or defend legal claims. We rely on our legal obligations and legitimate interests in protecting the business.

Guest reviews

We may publish and manage genuine guest reviews. We rely on our legitimate interests in informing future guests and promoting the accommodation.

Website analytics

Where you have given your consent through our cookie controls, we may use analytics information to understand how visitors use our website and improve its performance.

Special requirements and health information

A message about an allergy, health condition or accessibility need may reveal special-category personal information. Please provide only the information necessary for your stay.

Where we need to record this information, we will normally rely on your explicit consent as well as the relevant lawful basis described above. You may withdraw your consent, although this will not affect any processing already carried out.

In an emergency, information may instead be used where necessary to protect someone’s vital interests.

Where your information comes from

Most personal information comes directly from you through our website forms, email, telephone conversations or information provided in person.

We may also receive booking and guest information from Airbnb, Booking.com, Vrbo, FreeToBook or another service you choose to use. Those organisations are responsible for explaining how they use your information when you use their services.

Payments

Payments may be handled by Airbnb, Vrbo, Booking.com, PayPal, Square, our bank or another payment service shown to you at the time.

These providers process payment information under their own privacy terms. We retain transaction and accounting records, but we do not retain guests’ full payment-card numbers or card security codes.

Any temporary written payment details are securely destroyed after the stay and should not be retained where a secure payment method is available.

Who we share information with

We share personal information only where it is necessary and proportionate. Recipients may include:

Airbnb, Booking.com, Vrbo, FreeToBook and other booking or review services involved in your reservation.
PayPal, Square, banks and other payment providers.
Our accountant, Helen Henderson, for accounting and tax purposes.
West Dunbartonshire Council or another competent licensing or public authority where information is required.
Our website, email, hosting, security and IT service providers.
Google and Automattic/Jetpack for optional website analytics where you have consented.
Insurers, professional advisers, law-enforcement bodies, courts or regulators where necessary to comply with the law or establish, exercise or defend legal claims.

We do not sell personal information and we do not use guest details for newsletters or promotional messages.

International transfers

Some booking, payment, website and technology providers may process personal information outside the United Kingdom.

Where this happens, the provider must use a lawful transfer mechanism and appropriate safeguards, such as UK adequacy regulations or approved contractual clauses. You may contact us if you would like more information about the safeguards relevant to your information.

How long we keep information

We keep personal information only for as long as it is needed for the purpose for which it was collected, including relevant legal, tax, licensing and dispute requirements.

Our intended retention periods are:

Enquiries that do not become bookings: normally up to 12 months after the last contact.
Confirmed and cancelled bookings, payment evidence and accounting records: normally for the period required for tax and accounting purposes. For a sole trader, this will generally be at least five years after the relevant tax return filing deadline.
Guest and vehicle information: up to five years where retention is necessary and justified for licensing or record-keeping purposes.
Routine emails and messages: deleted after the stay or once the matter has been concluded when they are no longer needed.
Allergy, health and special-requirement information: deleted shortly after the stay unless it is needed for an unresolved incident or legal claim.
Reviews: retained for as long as the review remains relevant and published.
Website form entries and analytics information: retained according to the configured website and cookie retention settings.

Information may be kept for longer where this is required by law or while a complaint, dispute or legal claim is being handled.

How we protect your information

Guest information is held in password-protected email accounts and on a passcode-protected iPad. Two-factor authentication is used where it is available. The paper booking diary is kept in a locked drawer.

Access is limited to the owner, and information is shared with an authorised recipient only where this is necessary. We take reasonable measures to protect personal information against loss, misuse, unauthorised access or disclosure.

Cookies and website analytics

Our website uses cookies and similar technologies. Optional analytics should operate only after you have made an affirmative choice through our cookie banner.

Please see our Cookie Policy and cookie settings tool for current information about the cookies used and to change your preferences.

Your data-protection rights

Depending on the circumstances, you may have the right to:

Request access to the personal information we hold about you.
Ask us to correct inaccurate or incomplete information.
Ask us to delete your information.
Ask us to restrict how your information is used.
Receive or transfer certain information you have provided.
Object to processing based on legitimate interests.
Withdraw your consent where processing depends on consent.

These rights are subject to legal conditions and exemptions. We may need to verify your identity before responding. There is normally no charge, and we normally respond within one month.

Questions and complaints

Please contact Fiona Craig first so that we can try to resolve your question or concern.

Email: auldsmiddy@blueyonder.co.uk
Telephone: 07719 401608

You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection.

ICO website: www.ico.org.uk
ICO telephone: 0303 123 1113

Changes to this statement

We may update this statement when our services, suppliers or legal duties change. The latest version will be published on this website with the date of the update.