Privacy, handled properly.

1. Who is responsible for your information

Roffe's Ltd is the controller of the personal information described in this notice when we decide how and why it is used.

When we manage a property or booking with another organisation, that organisation may also be independently responsible for some information. Its privacy notice may apply alongside ours.

2. The information we collect

Prospective and existing property owners

Contact details; property name, address, postcode, type, capacity, amenities, condition, privacy and links; ownership or operating position; service interests; communications; contracts, approvals, performance information, invoices and payment records.

Guests and booking contacts

Name, email address, telephone number, booking reference and channel, stay dates, guest numbers, communications, requests, support records and information reasonably needed to provide a safe and suitable stay. This may include accessibility information when it is volunteered or needed.

Portal users and staff

Account identifiers, work contact details, role and permissions, authentication and security records, recent access, operational updates, maintenance and inspection records, incident reports and actions taken through the portals.

Suppliers and contractors

Business and contact details, service area, qualifications and compliance information, availability, property access arrangements, work records, invoices and communications.

Technical information

IP address, device and browser information, authentication tokens, security events and service logs generated when you use our website or portals. See our cookie policy for information stored on your device.

3. How we obtain it

We receive information directly from you, from a property owner or booking organiser, from staff and suppliers, and from booking, property-management and communications platforms used to deliver our services. We may also use information from property listings, public registers or other public sources where relevant to a property assessment or our legal responsibilities.

The property assessment form sends the details you provide to our customer relationship management system. It does not produce an automated valuation.

4. Why we use information and our lawful bases

We do not use personal information to make solely automated decisions that have legal or similarly significant effects. Property assessments, pricing and management recommendations are made with human judgement.

5. Special-category and sensitive information

We do not ask for health or other special-category information unless it is genuinely needed, for example to address an accessibility request, safety incident or emergency. Where we use it, we limit access and rely on an appropriate legal condition such as explicit consent, vital interests, employment or health and safety law, or the establishment or defence of legal claims.

Please do not include unnecessary sensitive information in a general enquiry.

6. Who we share information with

We share information only where needed with:

• owners, authorised property contacts, staff and relevant suppliers;
• booking and property-management platforms, including Uplisting where applicable;
• HubSpot for prospective-owner relationship management;
• Supabase for database and authentication services;
• hosting and infrastructure providers, including Vercel and Cloudflare where applicable;
• Google Workspace and Drive for communications and controlled document storage;
• email, telephone and messaging providers where you choose those channels;
• professional advisers, insurers, auditors and payment providers where required; and
• regulators, emergency services, courts or law-enforcement bodies where the law or safety requires it.

Service providers may only use information on our instructions and must protect it appropriately. We do not sell personal information or share it with third parties for their independent marketing.

7. International transfers

Some technology providers may process information outside the United Kingdom. Where this happens, we use an applicable UK adequacy regulation or contractual and organisational safeguards recognised by UK data-protection law. You may contact us for more information about the safeguards relevant to your data.

8. How long we keep information

We keep personal information only for as long as it is reasonably needed. Our normal approach is:

• prospective-owner enquiries that do not become a client relationship: up to 24 months after the last meaningful contact;
• contracts, owner records, booking and material operational records: generally six years after the relationship or stay ends, with financial records kept for the applicable tax period;
• guest-portal access: restricted shortly after the stay ends, while underlying booking records may be retained for accounting, claims and service records;
• security and access logs: normally up to 12 months, unless needed for an investigation;
• incident, insurance, safeguarding and legal-claim records: for the relevant statutory, insurance or limitation period; and
• optional marketing records: until you unsubscribe, withdraw consent or the record is removed after an inactivity review.

We may keep a minimal suppression record after an opt-out so we can respect your preference.

9. Your rights

Depending on the circumstances, you may have rights to access, correct or erase your information; restrict or object to its use; receive certain information in a portable format; and withdraw consent at any time.

We may need to confirm your identity. We normally respond to rights requests within one month.

Data protection complaints

You can make a data protection complaint by emailing owners@roffes.uk with the subject “Data protection complaint”, or by writing to our address above. We will acknowledge it within 30 days, take appropriate steps to investigate without undue delay, keep you informed where necessary and explain the outcome.

If you remain dissatisfied, you have the right to complain to the Information Commissioner's Office.

10. Marketing choices

We may contact you about the property assessment or service you requested without treating that response as marketing. We use a separate, optional choice for wider promotional emails. Every marketing email will identify Roffe's and provide a way to unsubscribe.

11. Security and account responsibility

We use access controls, authentication, restricted data views, encryption provided by our service platforms and operational procedures designed to protect personal information. No internet service is completely risk-free. Portal users must keep sign-in links, passwords and property access information confidential and tell us promptly about suspected misuse.

12. Children

Our website and portals are not intended for independent use by children. Holiday bookings must be made by an adult. We may receive limited information about children travelling as part of a booking when needed for capacity, safety or a requested service.

13. Changes and contact

We will update this notice when our services or legal responsibilities change and publish the new date above. Questions and privacy requests should be sent to owners@roffes.uk or posted to Roffe's Ltd, 34 Langley Road, Durham, DH1 5LR.