Privacy policy: what Cotswolds Info collects and why

Cotswolds.info is a guide to the Cotswolds, from Chipping Campden to Castle Combe, with a directory of local businesses. This policy explains what personal data we collect, why we collect it, how long we keep it, and the rights you have under the UK General Data Protection Regulation and the Data Protection Act 2018. It is deliberately short, because we collect little. Nothing on this site tracks you across other websites.

Who we are

Cotswolds.info is run by Cherwell Studio. We are the data controller for the personal data described on this page. The quickest way to reach us about anything here is the contact page.

What we collect and why

What we hold about you depends on what you do on the site. Most visitors fall under the first heading only.

Browsing the site

We measure how the site is used with the analytics built into the software that runs it. It sets no cookies and stores nothing in your browser: a visit is counted on our own server as the page is sent. To count you once rather than on every page, it combines your IP address and browser details with a random value that changes every day into a short code that cannot be turned back into either, and each day's random value is deleted when the next is made. What we see is aggregate: which pages are read, which sites send visitors here, which kinds of device they use, and how often people do things like contact a business or follow a link to book. We have no way to pick out an individual, and we do not try to.

We also see the usual technical information any web server receives, such as your IP address and browser type, in short-lived logs used to keep the site running and to stop abuse.

Our lawful basis is our legitimate interest in understanding how the site is used and keeping it secure. There is more detail on the cookies and analytics page.

Searching the site and the directory

Search terms you type into the site search and the business directory go to our own search index, which runs on our servers, so results can be returned. We also keep a record of what was searched for, how many results came back and which result was followed, so we can see what people are looking for and improve the site. That record uses the same daily-changing code as our visit counting and is not linked to any account.

If you subscribe, we keep your email address, and your name if you give it, and send you occasional emails about the area. We use double opt-in, so nothing is sent until you confirm from the link in the first email. Every email has an unsubscribe link, and unsubscribing removes you from the list. Our lawful basis is your consent.

Contacting us

If you email us at the address on the contact page, we have your email address, your name if it comes with it, and what you wrote. We keep your email for as long as we need to deal with your message and any follow-up. Our lawful basis is our legitimate interest in answering you.

Enquiring with a business

Some directory listings have an enquiry form. What you enter, including your name, contact details and message, is passed to the business you chose so they can reply to you, and you get a copy by email. We keep a copy so the business can see its enquiries in its account, and so we can deal with misuse, for ninety days, or up to 180 days once the business has replied or noted it. Once the business has your message it is responsible for how it handles it. Our lawful basis is our legitimate interest in connecting you with the business you asked to contact.

Business accounts

Business owners can create an account to claim, edit and promote their listing. We hold the details you give us, such as your name, email address and the sign-in method you use, along with a record of the changes made to your listing. Signing in sets a session cookie so you stay logged in for up to thirty days from when you sign in. Our lawful basis is the contract we have with you to provide the account, and our legitimate interest in keeping an accurate record of listing changes.

Claiming a listing asks for your name, email address, your role at the business and, if you like, a note. To check the claim is genuine we may compare your email address with the business's own, ring the number listed for the business, or post a code to its address. We keep that record while the claim is reviewed and afterwards as part of the listing's history.

Paying for a membership

Memberships are invoiced: we send an invoice and you pay it by bank transfer, so no card details pass through the site. We keep records of memberships, invoices and payments, including the name and address on the account, because we are required to keep financial records. Our lawful basis is the contract with you and our legal obligation to keep accounts.

Links to booking sites

Some links to hotels, holiday cottages and tours go to booking sites that pay us a commission if you book, and the page says so. When you follow one it passes through a short redirect on our own site, which records that a click happened, when, from which page, to which booking site and from what kind of device, so we can match the commission the booking site later reports. We do not record who you are, we keep no IP address for it, and the record is deleted after about thirteen months. The booking site, and the affiliate network that runs its programme (such as Awin, CJ or Partnerize), may then set cookies on their own site so the booking is credited to us. Those are theirs and covered by their own privacy policies. Our lawful basis for the click record is our legitimate interest in being paid for the bookings we send.

Analytics shown to business owners

Businesses with a listing can see how it performs: how often it appears in results, how often its page is viewed, and how often people click to call, email or visit its website. These counts are worked out in the same cookieless way as our site measurement. Individual events are deleted after about ninety days and only totals are kept. Business owners never see anything that identifies a visitor.

Business listings and information from public sources

The business directory is built from information businesses have already made public, such as their own websites, together with listings created or updated by the businesses themselves. A listing holds business details: name, address, phone number, business email address, website, opening hours, a description and photographs. Where a business is run by an individual, some of that is personal data. Our lawful basis for publishing it is our legitimate interest in promoting local businesses to people looking for them, and the business's interest in being found.

We may email a business at its published address to let it know its listing exists and invite it to claim it. If you would rather we did not, reply and say so, and we will not email that address about it again.

If you run a business and want your listing corrected, claimed or removed, use the contact page and we will act on it promptly.

We do not sell personal data and we do not share it with advertisers. The services below process data on our behalf, only for the purposes described here and under contract.

Cloudflare sits in front of the site: every request passes through it, and it caches pages and images and protects the site from attack.
Google Cloud hosts the site, its database, its search index and uploaded images, in its London region.
Our email delivery provider sends our newsletter and the emails the site sends, such as sign-in links, enquiries and confirmations.
Booking sites and affiliate networks receive the click when you follow a commission link, as described above.
Proton hosts our mailbox, so it holds the emails you send us.

Some pages load content directly from other organisations, which means your browser contacts their servers and they see your IP address: OpenStreetMap provides the map tiles on a walk page, fetched only when you open the map, and YouTube provides embedded videos from its privacy-enhanced domain, loaded only when you press play. Their own privacy policies apply to what they do with that.

Some of these providers are based in the United States. Where data leaves the UK we rely on the UK Extension to the EU-US Data Privacy Framework or on the UK International Data Transfer Agreement, so that it stays protected to UK standards.

How long we keep data

Visit counts and listing analytics: individual events for about ninety days, hourly totals for about thirteen months, and daily and monthly totals after that.
Search records and booking link clicks: about thirteen months.
Newsletter subscriptions: until you unsubscribe.
Contact messages: as long as needed to deal with them, then deleted.
Business enquiries: ninety days, or up to 180 days once the business has replied or noted them.
Accounts, claims and listing history: while the account exists, and for a short period afterwards to deal with any dispute.
Billing records: six years from the end of the relevant financial year, as required by UK tax law.
Sessions: up to thirty days from when you sign in, or until you sign out.

Cookies and similar technologies

The site sets cookies only where they are strictly necessary: one to keep you signed in to a business account, short-lived ones while you sign in, and a security cookie when you send a form. Our analytics use none. The full list of what is stored in your browser and why is on the cookies and analytics page.

Your rights

Under the UK GDPR you can ask us to:

give you a copy of the personal data we hold about you;
correct anything that is inaccurate;
delete your data, where we no longer have a reason to keep it;
restrict how we use it, or object to a use based on our legitimate interests;
send you your data in a machine-readable form;
stop, where something relied on your consent, by withdrawing that consent. Unsubscribe links do this for the newsletter.

To use any of these rights, get in touch through the contact page. We will reply within one month. If you are unhappy with how we have used your personal data, you can complain to us the same way: we will acknowledge your complaint within thirty days and tell you the outcome without undue delay. You can also complain to the Information Commissioner's Office at ico.org.uk (opens in a new tab), though we would rather you spoke to us first.

Children

The site is written for a general audience and does not knowingly collect personal data from children under thirteen. Business accounts are for adults.

Changes to this policy

When we change this page the date at the top updates. Substantial changes to how we use personal data will also be mentioned in the newsletter.

Privacy Policy