Cheesemans Farm Ltd, trading as The Retreat (“we”, “us”, “our”), is committed to protecting your privacy. This policy explains what personal information we collect when you book or enquire about our private in-cottage spa experiences, how we use it, and the rights you have under the UK GDPR and the Data Protection Act 2018.
Cheesemans Farm Ltd (company no. 11322722), trading as The Retreat (Aesthetics & Beauty Lounge)
North Lodge, Quex Farm, Birchington, Kent, CT7 0BH
Email: info@cheesemansfarm.com · Phone: 01843 866023
1. Information we collect
Identity & contact details
Your name, email address and phone number, provided when you book a treatment or make an enquiry.
Booking information
The location (cottage) of your stay, treatments and enhancements selected, appointment dates and times, and your chosen therapist where applicable.
Health & treatment information (special category data)
To deliver treatments safely, we may collect relevant health information such as allergies, skin sensitivities, injuries, medical conditions, medications, or pregnancy. This is “special category” data and is collected and processed only with your explicit consent, and used solely to provide your treatment safely.
Payment information
Payments are processed securely by Stripe, our payment provider. Your card details are entered directly with Stripe and are not stored on our systems. Stripe’s handling of your data is governed by its own privacy policy.
Website & technical information
IP address, device and browser type, and basic usage information collected via cookies and similar technologies (see “Cookies” below).
Communications & preferences
Any correspondence with us, and your marketing preferences where you have opted in.
2. How we use your information & lawful bases
| Purpose | Lawful basis |
|---|---|
| Managing your booking, sending confirmations and reminders | Performance of a contract |
| Delivering treatments safely using health information | Explicit consent |
| Taking payment and preventing fraud | Contract / legitimate interests |
| Responding to enquiries and complaints | Legitimate interests |
| Meeting legal, tax and accounting obligations | Legal obligation |
| Sending marketing (only if you opt in) | Consent |
| Operating and improving our website | Legitimate interests |
3. Who we share your information with
We share your personal data only where necessary, with:
- SimplyBook.me — our booking and scheduling platform, which stores your booking and contact details.
- Stripe — our payment provider, to process payments securely.
- Microsoft Azure — our website hosting provider.
- Email/communication providers — to send booking confirmations and, where opted in, marketing.
- Law enforcement or regulators — where we are legally required to do so.
All providers act only on our instructions and are required to keep your data secure. We never sell your personal data.
4. International transfers
Some of our providers may process data outside the UK. Where they do, we ensure appropriate safeguards are in place (such as UK adequacy regulations or Standard Contractual Clauses) to protect your information.
5. How long we keep your information
- Booking & payment records: retained for 6 years to meet HMRC/accounting requirements.
- Health & treatment records: retained for as long as necessary to provide safe ongoing care, then securely deleted.
- Marketing preferences: until you withdraw consent or ask us to delete them.
- Website/analytics data: retained for up to 26 months.
6. Your rights
Under UK data protection law you have the right to:
- Be informed about how your data is used
- Access the personal data we hold about you
- Have inaccurate data corrected
- Request erasure of your data in certain circumstances
- Restrict or object to processing
- Data portability
- Withdraw consent at any time (including for marketing or health data processing)
To exercise any of these rights, contact us using the details above. We will respond within one month. We may need to verify your identity first.
7. Cookies
Our website uses cookies and similar technologies. Some are strictly necessary for the site to function; others help us understand usage and improve the experience. You can control non-essential cookies through your browser settings.
8. Security
We use appropriate technical and organisational measures — including encryption in transit, access controls and secure servers — to protect your personal data from unauthorised access, loss or disclosure. No system can be guaranteed completely secure, but we take all reasonable steps to safeguard your information.
9. Changes to this policy
We may update this policy from time to time. Any changes will be posted on this page with a revised “Last updated” date.
10. Complaints
If you have concerns about how we handle your data, please contact us first. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.
← Back to booking