CSL Longstone

    Privacy Policy

    Last updated: 17 October 2026

    1. Data Controller

    CSL Longstone Ltd (Company No. 16970515), registered in England and Wales, is the data controller for the personal data processed through this website.

    Contact: admin@csl-longstone.com

    2. What Data We Collect

    • Guests booking a stay: name, email, phone number, number of guests, stay dates, prices paid, payment references (not full card details) and booking status.
    • Host Resources (digital product) buyers: email address, product bought, amount, payment references, your consent to immediate access with the date and terms version, and download activity (count and last download time).
    • Enquirers and landlords: name, email, phone, enquiry type, property details, message, and our notes and activity history on your enquiry.
    • Reviewers: name, email, rating and review text (your email is never published).
    • Staff: name, email, profile picture (optional), role, and sign-in records needed to secure the admin area.
    • Email records: which emails we sent you and whether they were delivered, bounced or unsubscribed.
    • Website use: your cookie choice and, only with analytics consent and when GA4 is configured, browser/session identifiers, clean page paths, campaign source/medium/name and product and purchase events (order ID, product, value and currency). We do not send names, emails, payment-link references or download tokens to Google. Consented analytics identifiers and campaign details may be held with Stripe order metadata to preserve attribution through checkout. See our Cookie Policy.

    3. How We Use Your Data and Our Lawful Bases

    • Taking and managing bookings, selling and delivering digital products, payments, receipts and confirmation emails: performance of a contract (Article 6(1)(b) UK GDPR).
    • Keeping accounting and tax records: legal obligation (Article 6(1)(c)).
    • Responding to enquiries: steps at your request before entering a contract (Article 6(1)(b)).
    • Damage deposit or waiver via Safeguest, fraud prevention, securing our systems, displaying approved reviews and staff administration: legitimate interests (Article 6(1)(f)).
    • Marketing emails: your consent (Article 6(1)(a)), which you can withdraw at any time.
    • Optional website and ecommerce analytics: your consent (Article 6(1)(a)); you can withdraw it using Cookie settings in the footer.

    4. Data Retention

    We keep personal data only as long as necessary — for example, booking and order records for 6 years for accounting purposes and enquiries for up to 24 months from last activity. See our Data Retention Policy for full details.

    5. Who We Share Data With

    • Lovable (Lovable Labs) and Supabase Inc.: website hosting, database, sign-in, file storage and server functions (Lovable Cloud runs on Supabase infrastructure).
    • Stripe: card payment processing for bookings and digital products. Stripe is also an independent controller for some data it needs for fraud prevention and its legal obligations.
    • Uplisting: our property and booking management system — receives guest booking details.
    • Safeguest: receives guest booking details so it can send you a secure link to complete the damage deposit or damage waiver after booking.
    • Email delivery providers (Lovable's managed email service and Resend): send booking confirmations, receipts, download links and enquiry replies.
    • WhatsApp (Meta): only if you choose to contact us through WhatsApp; your messages are then handled under WhatsApp's own terms.
    • Google (Google Analytics 4): consented website and ecommerce analytics, only when configured. Google receives analytics identifiers and event data, not your contact details or download links.
    • Our accountants, professional advisers, and authorities where the law requires.

    We do not sell your personal data.

    6. International Transfers

    Some of these providers (including Lovable, Supabase, Stripe, Uplisting, our email providers, Google and Meta) may process data outside the UK, including in the EU and the United States. Where personal data is transferred outside the UK we rely on the safeguards offered by the provider, such as UK adequacy regulations (including the UK–US Data Bridge where the provider is certified) or the ICO's International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses. You can ask us for more information about the safeguard used for a particular provider.

    7. Your Rights

    Under UK GDPR, you have the right to:

    • Access your personal data
    • Rectify inaccurate data
    • Erase your data ("right to be forgotten")
    • Restrict processing
    • Data portability
    • Object to processing
    • Withdraw consent at any time

    To exercise any of these rights, contact admin@csl-longstone.com.

    8. Complaints

    If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

    We encourage you to contact us first so we can try to resolve any issues.

    9. Security

    We implement appropriate technical and organisational measures to protect your personal data, including encrypted connections (TLS), access controls, and regular security reviews.

    10. Children's Data

    Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.

    11. Changes to This Policy

    We may update this policy from time to time. Any changes will be posted on this page with an updated revision date.

    Chat with us