Privacy Policy

This Privacy Policy explains how Elm & Oak ("we", "us", "our") collects, uses, and protects your personal information when you visit our website or make an enquiry with us. We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Elm & Oak is a short-term rental and property management business operating in the United Kingdom. Our contact email is hello@elmandoak.co.uk.

2. What information we collect

We may collect the following personal information from you:

• Name and contact details (email address, phone number)
• Booking enquiry details (dates, number of guests, property interest)
• Messages you send us via our contact or enquiry forms
• IP address and basic usage data if you visit our website

3. How we use your information

We use your information to:

• Respond to your booking enquiries and provide quotes
• Manage and administer your stay if you book with us
• Contact you about your enquiry or booking
• Improve our website and services
• Comply with our legal obligations

We will not use your information for unsolicited marketing without your consent, and we do not sell your data to third parties.

4. Legal basis for processing

We process your personal data on the following legal bases:

• Contract: To fulfil a booking or enquiry you have made with us
• Legitimate interests: To respond to enquiries and improve our services
• Legal obligation: Where required to comply with UK law

5. How long we keep your data

We retain personal data only for as long as necessary. Enquiry data is typically retained for 12 months. Booking records may be kept for up to 7 years to comply with financial and legal requirements.

6. Sharing your information

We do not sell, trade, or otherwise transfer your personal information to third parties, except where necessary to provide our services (e.g. email service providers, payment processors) or where required by law. Any third parties we work with are contractually required to protect your data.

7. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data ("right to be forgotten")
• Object to or restrict how we process your data
• Data portability (receive your data in a machine-readable format)
• Withdraw consent at any time where processing is based on consent

To exercise any of these rights, please contact us at hello@elmandoak.co.uk.

8. Cookies

Our website may use essential cookies to ensure it functions correctly. We do not use tracking or advertising cookies. By using our website, you consent to the use of essential cookies only.

9. Security

We take reasonable steps to protect your personal information from unauthorised access, loss, or misuse. However, no internet transmission is completely secure and we cannot guarantee absolute security.

10. Changes to this policy

We may update this Privacy Policy from time to time. The latest version will always be available on this page with the date of last update shown at the top.

11. Complaints

If you believe your data has been handled incorrectly, you have the right to lodge a complaint with the UK's supervisory authority, the Information Commissioner's Office (ICO): ico.org.uk.