Privacy Policy

This policy explains what personal information we collect when you use the Ink & Hearth website or book a retreat with us, why we collect it, and what rights you have over it.

Who we are

Ink & Hearth is a trading name of Lorenzen Tonna Services Limited, a company registered in Scotland (Company No. SC602737) with its registered office at 5 South Charlotte St, Edinburgh EH2 4AN.

We are the controller of the personal information described in this policy. If you have any questions about it, or want to exercise any of your rights, email us at info@inkandhearth.uk.

What we collect

When you create an account

• Your name and email address.
• Your phone number, if you choose to give it to us.
• Your password, which we store only in hashed form. We can never see it.

When you book a retreat

• The retreat, room type and number of guests you book, and the price.
• Any special requests you give us. These may include dietary requirements, allergies or accessibility needs.
• Records of your payments: amounts, dates, status and Stripe's reference numbers. Your card details go directly to our payment provider, Stripe, and never reach our servers.

When you contact us

• Your name, email address and anything you write in your message.

When you browse the website

• The pages you visit, when you visit them, and the page that referred you.
• Your IP address, browser user agent and device type (desktop, tablet or mobile).
• An approximate location (country, city and rough coordinates) worked out from your IP address.

Why we use it, and our lawful basis

• To create and run your account, take your booking and deliver your retreat. This is necessary to perform our contract with you.
• To take payments, issue refunds and keep accounting records. This is necessary for our contract with you and to meet our legal obligations, such as tax law.
• To cater for dietary requirements, allergies or accessibility needs. Some of this may be health information. We use it only because you have chosen to give it to us for this purpose, and only to look after you during the retreat. You can ask us to delete it at any time, though we may then be unable to make arrangements for you.
• To reply to your enquiries and send messages about your booking, such as confirmations, payment reminders and pre-retreat information. These are necessary for our contract with you or are in our legitimate interest in answering people who contact us.
• To understand how the website is used, such as which pages are popular and where visitors come from, so we can improve it. This is in our legitimate interests. We use this information only in aggregate and do not use it to profile individual visitors.
• To keep the website secure and prevent fraud. This is in our legitimate interests.

We do not sell your personal information, and we do not send you marketing emails unless you have asked us to.

Who we share it with

• Stripe, which processes card payments for us. Stripe handles your card details under its own privacy policy.
• The venue and the hosts of your retreat. They receive only what they need to welcome you, such as your name, room and any dietary or accessibility requirements.
• Service providers who run our website for us, such as our hosting and email providers, and an IP geolocation service that tells us an approximate location from an IP address. They act on our instructions and may not use your information for their own purposes.
• Authorities such as HMRC or the police, where the law requires it.

International transfers

Some of our service providers, including Stripe, may process information outside the UK. Where they do, we make sure appropriate safeguards are in place, such as a UK adequacy decision or the UK International Data Transfer Agreement.

How long we keep it

• Account details: until you delete your account. You can do this at any time from your profile page.
• Booking and payment records: six years from the end of the financial year they relate to, as UK tax law requires. This applies even if you delete your account.
• Dietary, allergy and accessibility information: until shortly after your retreat ends, unless you ask us to keep it for future bookings.
• Contact enquiries: up to two years after our last exchange with you.
• Website visit records: up to 24 months.

Cookies

We use only the cookies the website needs to work: a session cookie that keeps you signed in and remembers what you are doing, and a security cookie that protects forms against cross-site request forgery. These are strictly necessary, so we do not ask for consent to set them. We do not use advertising or third-party tracking cookies. Our visit statistics are recorded on our own server and do not rely on cookies.

Your rights

Under UK data protection law you have the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct information that is wrong or incomplete;
• ask us to delete your information;
• ask us to restrict how we use your information, or object to us using it on the basis of our legitimate interests;
• ask us to send information you gave us to you or to another organisation in a machine-readable format;
• withdraw your consent at any time, where we rely on it.

To use any of these rights, email info@inkandhearth.uk. We will reply within one month. Some rights have legal limits. For example, we cannot delete payment records that we are required to keep.

If you are unhappy with how we have handled your information, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Changes to this policy

If we change this policy, we will publish the new version on this page and update the date at the top. If the changes are significant, we will tell account holders by email.