Privacy Policy

Privacy Notice

The Rowley Estates

Last updated: 25 June 2026

Effective date: 25 June 2026

This Privacy Notice explains how Melmerby Estates Limited (The Rowley Estates) (“we”, “us”, “our”) collects, uses, shares and protects personal information about guests, prospective guests, employees, contractors, suppliers and visitors to our properties and website. It applies to information collected through https://www.therowleyestates.com (the “Website”), through direct bookings and enquiries, and at our physical sites, including via the security camera and video doorbell systems described in Section 6.

We are the data controller of the personal information described in this notice. Our contact details are:

The Rowley Estates

Blencowe Hall, Blencow, Cumbria, CA11 0DF, United Kingdom

Email: [email protected]

Phone: 07968 258234

We may update this notice from time to time. If we make material changes, we will post the revised notice on the Website with a new “Last updated” date, and where appropriate we will draw the changes to your attention directly. We encourage you to review this notice periodically.

1. Information We Collect

Depending on how you interact with us, we may collect:

• Identity and contact data – name, postal address, email address, telephone number
• Booking and stay data – arrival and departure dates, property booked, number and names of guests, special requests
• Payment data – card or bank details processed via our payment provider; we do not store card numbers ourselves
• Communications – records of correspondence, enquiries and feedback you send us
• Employment and contractor data – for staff, seasonal workers and contractors, including right-to-work, payroll and HR records, held separately under our staff privacy information
• Security camera and video doorbell footage – collected externally at our properties; see Section 6 for full detail
• Technical and usage data – IP address, browser type and pages visited on the Website, collected via cookies; see our Cookie Policy

We collect this information directly from you (for example, when you make a booking or contact us), automatically (through cookies and our security systems), and occasionally from third parties such as booking platforms or payment processors acting on our instructions.

2. How We Use Your Information and Our Lawful Basis

Under UK GDPR, we must have a valid lawful basis for every use of personal information. The table below sets out our main purposes and the basis we rely on for each.

To process and manage your booking, including payment  —  Performance of a contract with you

To respond to enquiries and provide customer service  —  Performance of a contract, or our legitimate interests in answering enquiries

To send service messages about your stay (e.g. arrival instructions)  —  Performance of a contract

To send marketing communications about offers, events or seasonal availability  —  Your consent, which you may withdraw at any time

To collect and act on customer feedback  —  Our legitimate interests in improving our service

To maintain security camera and video doorbell footage at our properties  —  Our legitimate interests in protecting people, property and guests (see Section 6)

To meet our legal, tax and accounting obligations  —  Compliance with a legal obligation

To establish, exercise or defend legal claims  —  Our legitimate interests, or compliance with a legal obligation

Where we rely on “legitimate interests”, we have considered that our interests are not overridden by your rights and freedoms. You can ask us for more detail on this assessment by contacting us using the details above.

3. How We Share Your Information

We do not sell your personal information. We will not transfer it to third parties except as set out below, and we require any third party we share information with to use it only for the purpose for which it was provided and to keep it secure.

• Payment processors, to take payment for bookings
• Booking platforms (e.g. where a booking originates from a third-party site), to fulfil your reservation
• IT, website hosting and analytics providers, acting on our instructions
• Professional advisers (accountants, solicitors), where necessary for our legal and tax obligations
• Law enforcement, courts or regulators, where we are required to do so by law or to protect our legal rights
• A buyer or successor, if all or part of our business is sold or transferred

We do not currently transfer personal information outside the UK. If this changes, we will update this notice to explain the safeguards in place.

4. How Long We Keep Your Information

We keep personal information only for as long as necessary for the purposes set out in this notice. As a guide:

• Booking and guest correspondence: up to 2 years after your stay, to handle any post-stay queries or disputes
• Financial records connected to a booking (including payment and invoicing records): 6 years, to meet UK tax and accounting law requirements
• Marketing consent records: until you withdraw consent or 3 years of inactivity, whichever is sooner
• Security camera and video doorbell footage: no more than 30 days – see Section 6
• Employment and contractor records: for the period set out in our staff privacy information

Where we cannot state an exact period, we will tell you the criteria we use to decide it. After the relevant period, we securely delete or anonymise your information.

5. Your Rights

Under UK GDPR, you have the right to:

• Access the personal information we hold about you
• Have inaccurate information corrected
• Have your information erased, in certain circumstances
• Restrict or object to our processing of your information
• Receive your information in a portable format, where applicable
• Withdraw consent at any time, where we rely on consent

The right to object: where we process your information for direct marketing, or on the basis of our legitimate interests (including security camera footage), you have the right to object. You can do this at any time by writing to us at [email protected].

Making a complaint

If you have a concern about how we have handled your personal information, please contact us first at the details above. We will acknowledge your complaint within 30 days and aim to resolve it as quickly as possible.

If you remain unhappy with our response, you have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner’s Office (ICO):

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Helpline: 0303 123 1113   |   Website: ico.org.uk

6. Security Cameras and Video Doorbells

For the security and safety of our guests, employees, contractors and property, we operate external security cameras and video doorbell devices (such as Ring-type devices) at our properties. This section explains how this works.

What is recorded

• Cameras and doorbells are positioned to cover the external areas of our properties, such as entrances, driveways and car parks
• They record video only – audio recording is switched off on all devices
• They may capture footage of employees, contractors, guests and visitors moving around these external areas
• We do not operate any internal video recording or listening devices inside any guest accommodation, staff areas, or elsewhere within our buildings

Why we use this footage

We rely on our legitimate interests as the lawful basis for this processing. Specifically, we use this footage to protect people and property, deter and investigate crime, and respond to incidents or disputes. We record video only, and not audio, to keep this processing limited to what is necessary. We consider this use to be proportionate, and that it does not unfairly override the privacy interests of those recorded.

How long we keep it and who can see it

• Footage is retained for no longer than 30 days from the date of recording, after which it is automatically deleted
• We do not share this footage with any third party outside the business, except where we are required to by law (for example, a lawful request from the police) or to protect our legal rights
• This footage is not used for analytics, profiling, or any purpose other than the security and safety purposes described above
• Access to footage is limited to those who need it for the purposes described in this section

Your rights regarding camera footage

If you believe you have been recorded, you may ask us for a copy of footage that identifies you, ask us to stop processing it, or object to our use of it, by contacting us at the details in this notice. Because footage is only retained for 30 days, we encourage you to contact us promptly. We display signage at our properties to make clear that security cameras are in operation.

7. Cookies and Similar Technologies

Our Website uses cookies and similar technologies to operate effectively and, where you consent, to understand how visitors use our site. For full detail on the cookies we use and how to manage your preferences, please see our Cookie Policy.

8. Security

We use appropriate technical and organisational measures to protect your personal information against loss, misuse or unauthorised access. No method of transmission or storage is completely secure, and while we take reasonable steps to protect your information, we cannot guarantee its absolute security.

9. Children’s Information

Our Website and booking services are intended for use by adults. We do not knowingly collect personal information directly from children. Where children’s names are provided as part of a family booking, this is provided by the adult making the booking and used solely for that booking.

10. Contact Us

If you have any questions about this notice or wish to exercise any of your rights, please contact us at [email protected] or 07968 258234.