Privacy Notice – Guests and potential guests
20th January 2022
At Cornish Gems, we are committed to protecting and respecting your privacy and safeguarding any personal data that you give to us. We are transparent about the processing of your personal data and this notice sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us.
We are a controller under the UK GDPR and the Data Protection Act 2018. Our data protection officer is Kristy Gouldsmith and she can be contacted at data.protection@cornishgems.com.
We are:
Cornish Gems Limited of Carne House, Western Extension, Threemilestone Industrial Estate, Threemilestone, Truro, Cornwall. TR4 9LD.
What kind of personal data does Cornish Gems collect and process?
When you book with us, we need information in order to arrange your holiday accommodation and any other services you are requesting.
1. Bookings and accounts
Cornish Gems collects and uses information you provide to us. When you make a booking, we need your:
- Name
- home address
- billing address
- mobile number
- date of birth, nationality (if you are not a British, Irish or Commonwealth guests, then we require your passport number and place of issue (or other document which shows your identity and nationality) plus details of your next destination (including the address, if known) on or before departure)
- payment information (last four digits only is stored)
- personal travel preferences, such as accessibility requirements.
We will also collect the names of the people travelling with you, the details of the property you have booked, a booking reference number, any complaint information, details of any calls with us and any compensation paid to you. This information is kept for 6 years following the conclusion of your stay in the unlikely event of any court proceedings.
We can take your booking by the website or over the phone. All phone calls are recorded. If we take payment over the phone, we will pause the recording when we take your payment information. This information will be immediately entered into our payment provider and your full payment details are not kept by us. Call recordings are kept for 6 years in the unlikely event we may need access to them for legal reasons.
2. Customer Service
If you contact us, we will keep a record of that correspondence. If you contact us by phone, we will monitor and/or record phone conversations for training and customer service reasons. We keep this information for 6 years following the conclusion of your stay incase of any court proceedings.
3. Marketing
You can subscribe to receive our email newsletters and you can opt-out at any time.
If you made an enquiry or purchase with us, we may contact you via email, telephone, text or post with information and offers relating to products or services similar to those about which you enquired or which you purchased. We will only do this if you have not opted-out of such marketing either at the point of collection of your details or by contacting us or by unsubscribing.
4. Surveys or Feedback
We may also ask you to complete surveys that we use for research purposes (although you do not have to respond to them) and we will be clear about what information we are collecting and how the data will be processed.
5. Competitions
If you enter one of our competitions, we will use your data to let you know if you have won the prize. We will not use this data for marketing purposes unless you have consented to such marketing.
6. Site Data
We collect information about your computer, including your IP address, operating system and browser type, for system administration and for the security of our website.
We do not use cookies (except essential or necessary cookies) without your consent.
7. Personal data you give us about others.
If you are travelling with others, we will need the following details of all guests over the age of 16, as required by The Immigration (Hotel Records) Order 1972:
- full name
- nationality
- for guests who are are not British, Irish or Commonwealth citizens, then we require their passport number and place of issue (or other document which shows their identity and nationality) and details of their next destination (including the address, if known, on or before departure)
At this point, we have to make it clear that it’s your responsibility to ensure that the person or people you have provided personal data about are aware that you’ve done so, and that they have understood and accepted how Cornish Gems uses their information. We will keep this information for 6 years following the conclusion of your stay in case of any court proceedings.
8. Personal data we receive from other sources.
We may also receive information about you from other sources, such as the property owner, in the regrettable case of a complaint or a dispute.
Another way we might receive data about you is through the communication services integrated into our website. Our chat service offers you a way to contact us. We receive data about these communication activities (such as who you are, where you are from, your email (if you choose to share it with us) and the date and length of the chat).
Why does Cornish Gems collect and use your personal data?
The main reason we ask you for personal details is for you to book your holiday accommodation and to ensure that you get the best service possible.
Your personal data may be used in the following ways:
1. Bookings: most importantly, we use your personal data to complete and administer your booking. We will email you confirmations, modifications and reminders about your booking.
Providing your personal data to Cornish Gems is voluntary. Once you have made a booking, then we rely on the legal basis of contract -- the processing of personal data is necessary for your booking with us. All administrative communications with you regarding your booking are required because of your contract with us and you can’t opt out of them.
2. Customer service: we provide customer service 7 days a week. Sharing information allows us to provide you with an excellent service and deal with any issues that may arise during your stay. For example, wewill share your name with a contractor if there is an issue at your accommodation. Our legal basis here is also contractual – providing our customer service is part of our agreement with you.
3. Account facilities: an account is created on our website to administer your booking, make payments, manage your personal settings etc. This is also part of our contractual services to you.
4. Marketing activities: We use your information for marketing activities. These activities include:
- Using your contact information to send you regular news about our holiday homes. You can unsubscribe from email marketing communications quickly, easily and at any time. All you need to do is click on the ‘Unsubscribe’ link included in each newsletter or other communication.
- When you participate in our competitions, we use your data to administer it.
- If you have started but not finished an online booking or made an enquiry, we might contact you to invite you to continue with your booking.
Our legal basis for our marketing activities is either consent or legitimate interest. If you haven’t engaged with us either by booking or starting a booking, then we will only contact you if you have asked us to do so.
If you have booked with us before, or started a booking, we can contact you using the legal basis of legitimate interest. If you don’t want these communications, then you can opt out at anytime.
5. Market research: we sometimes invite our guests to take part in surveys or to provide feedback. You are free to take part or decide not to.
6. Improving our services: We use personal data for analytical purposes and product improvement. This is part of our commitment to making our services better and enhancing the user experience. As much as possible, we strive to use pseudonyms for this analytical work. Our legal basis is legitimate interest.
7. Call monitoring: we record all calls. When you call, our staff will ask for authentication, which helps to keep your reservation details confidential. Calls are recorded for quality control and training purposes and for the handling of complaints, legal claims and for fraud detection. Recordings are kept for 6 years before being automatically deleted. An exception to this rule would be if Cornish Gems has a legitimate need to keep the recordings longer for complaints, issues, fraud investigation or legal purposes. Calls are recorded under our legal basis of legitimate interest.
8. Legal purposes: we may need to use your information to handle and resolve legal disputes, for regulatory investigations and compliance or to comply with lawful requests from law enforcement. In these cases, our legal basis is legal obligation. For example, the collection of information under the Immigration (Hotel Records) Order 1972 requires all serviced and self-catering accommodation premises to keep a record of all guests over the age of 16, specifically:
- full name
- nationality
For all who are not British, Irish or Commonwealth guests:
- passport number and place of issue (or other document which shows their identity and nationality)
- details of their next destination (including the address, if known) on or before departure
- Note: diplomats, their family and staff do not have to register.
We are required to keep this data for a period of 12 months from the date of arrival. These records can be inspected by any constable or any person authorized by the Secretary of State at any time.
9. Goodwill gesture: Sometimes we may send a goodwill gesture gift to your home address and share your delivery information with a third party to enable delivery to take place. We will confirm delivery address with you before sending and you have the option not to receive the gift if you wish.
How does Cornish Gems share your data with third parties?
We share your personal data with third parties where required, including:
1. The accommodation owner: normally, we will only share the last name of the lead guest with the accommodation owner. If you have a dispute with the accommodation owner, we may provide them with additional information about you as well as your contact details.
Third-party service providers: we use service providers to support us in providing our services.
These include:
- Customer support
- Service providers
- Market research
- Fraud detection and prevention (including anti-fraud screening)
- Insurers
- Legal and other advisors
- Payment
- We use a third party to process payments, handle chargebacks or provide billing collection services. When a chargeback is requested, either by you or by the holder of the credit card used to make your reservation, we need to share certain reservation details with the payment service provider and the relevant financial institution so they can handle the chargeback. This may also include a copy of your reservation confirmation or the IP address used to make your reservation. We may share information with relevant financial institutions, if we consider it strictly necessary for fraud detection and prevention purposes.
- Marketing services
- We share personal data with marketing partners, such as your email address, so that we can send out our email newsletter.
All service providers are required to continue to adequately safeguard your personal data.
3. Competent authorities: we disclose personal data to law enforcement to the extent that it is required by law or is strictly necessary for the prevention, detection or prosecution of criminal acts and fraud, or if we are otherwise legally obliged to do so. We may need to further disclose personal data to competent authorities to protect and defend our rights or properties, or the rights and properties of our accommodation owners.
What security and retention procedures does Cornish Gems use?
We have procedures in place to prevent unauthorised access to, and the misuse of, personal data.
We use appropriate business systems and procedures to protect and safeguard the personal data you give us. We also use security procedures and technical and physical restrictions for accessing and
using the personal data on our servers. Only authorised personnel are permitted to access personal data in the course of their work.
We keep financial data and account data for seven years. We keep you on our newsletter email list until you opt out or we see that you are no longer opening our emails. If you have been a guest or made an enquiry, we keep your name and email for marketing purposes for five years. You can opt out at any time.
Does Cornish Gems process personal data belonging to children?
You are only allowed to make a booking if you are 18 years of age or over. We do not process the data of children under the age of 16 unless supplied to us by their parents or legal guardians for the purposes of the booking.
Does Cornish Gems transfer data out of the UK?
We endeavour to hold most of your data in the UK but we do have some service providers who are based outside of the UK. Several of these providers are based in countries that are adequate for data transfer; for countries that are not, we use approved Standard Contractual Clauses as our data transfer safeguard.
What are your rights regarding your personal data?
You have the right:
- To access to your personal data and information about our processing of it. You also have the right to request a copy of your personal data (but we will need to remove information about other people).
- To rectify incorrect personal data that we are processing.
- To request that we erase your personal data if:
- we no longer need it;
- if we are processing your personal data by consent and you withdraw that consent;
- if we no longer have a legitimate ground to process your personal data; or
- we are processing your personal data unlawfully
- To object to our processing if it is by legitimate interest.
- To restrict our processing if it was by legitimate interest.
- To request that your personal data be transferred from us to another company if we were processing your data under a contract or with your consent and the processing is carried out by automated means.
If you want to exercise any of these rights, please contact us.
If you have a concern about the way we are collecting or using your personal data, please raise your concern with us in the first instance. You may also contact the Information Commissioner’s Office at www.ico.org.uk/concerns/.