1. Introduction
Your privacy matters to us. This policy explains what personal data Old Swan & Minster Mill (“we”, “our” or “us”) collects about you, why we collect it, how we keep it safe and what rights you have.
We process personal data in line with UK data protection law, including the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR) and the Data (Use and Access) Act 2025. Where it applies, we also comply with the EU GDPR.
“Personal data” means any information that identifies you directly (such as your name) or indirectly (such as your address or booking reference). Please read this policy before giving us your details.
2. Who we are and how to contact us
Old Swan & Minster Mill is the data controller for the personal data described in this policy. We are registered with the Information Commissioner’s Office (ICO) under registration number ZC258131. ICO Number can also be found here HPH No 3 Limited | ICO.
Old Swan & Minster Mill Minster Lovell, Witney Oxfordshire OX29 0RN United Kingdom
Our Data Protection Officer (DPO) is:
The hotel operating company is not required to appoint a formal Data Protection Officer (DPO), given the nature of its normal business activities.
Instead, we should nominate a hotel-based Data Protection Lead (DPL), which would usually be the General Manager.
The DPL would act as the main point of contact for data protection matters, ensuring appropriate procedures are followed and escalating any issues where necessary. This would not be a statutory DPO appointment.
If you have any questions about this policy or your personal data, please contact us using the details above.
3. What information we collect
We may collect information about you and your fellow guests, including:
We do not deliberately collect information about racial or ethnic origin, religious beliefs, sexual orientation or political opinions.
4. When we collect it
At the hotel, when you:
Online and by phone, when you:
Through third parties, such as online booking sites, travel agents and recruitment agencies.
5. Why we collect it and how we use it
|
Information |
How we use it |
|
Contact details |
To manage your reservation, restaurant and bar bookings, special requests, payments and records of your stay; to send you our newsletter and offers where you have agreed |
|
Personal details |
To meet legal requirements (such as registering overseas guests) and to improve our service |
|
Booking details |
To manage your stay and any changes, refunds or cancellations |
|
Payment card details |
To guarantee bookings and take payment |
|
Dietary and health information |
To keep you safe and meet your needs in our restaurant, spa and rooms |
|
Questions, comments and feedback |
To respond to you and improve our service |
|
CCTV and call recordings |
To protect guests, staff and premises, and for training and quality |
|
IP address and cookies |
To improve our website and prevent fraud and security breaches |
|
Job application details |
To assess and process applications |
We may also use your information to deal with legal claims and disputes.
6. Our legal basis
We only process personal data where we have a lawful basis to do so:
Where we process special category data, such as health information for dietary, accessibility or spa purposes, we make sure an additional condition under data protection law applies, usually your explicit consent.
We never sell or rent your personal data. We only share it where needed to provide our services, with trusted third parties such as:
We have contracts in place requiring these parties to protect your data and use it only on our instructions.
We may also share data with the police, regulators, government bodies or courts where the law requires it, or to establish or defend legal rights.
If all or part of our business is sold, merged or reorganised, relevant personal data may transfer to the new owner. They may only use it for the purposes for which it was originally collected, unless the law allows otherwise.
8. Hotel and event bookings
You can book directly with us or through third parties such as online booking sites. We do not share your booking details with those sites beyond availability.
For weddings, meetings, celebrations and dining, our booking systems may hold attendee names, dietary and accessibility needs, and event dates and times. Only staff who need this information can access it.
9. Children
We do not market to children. For family bookings we ask only for the number and ages of children, to make sure suitable rooms are available and to price your stay. Personal details about children are only collected from a parent or guardian aged 18 or over, and only where needed (for example, gym membership). Please tell us in advance about any adjustments a child may need.
10. Spa and gym
Before spa treatments, you will be asked to complete a health questionnaire so we can check a treatment is suitable. Spa treatments are not available to under-16s.
You may be asked to complete a health declaration before using the gym. Under-16s may not use the gym, but may use the pool if accompanied by an adult at all times.
11. CCTV
We use CCTV in and around the hotel, including car parks, to prevent and detect crime, for health and safety, and to defend legal claims. Signs are displayed wherever CCTV is in use.
12. Call recordings
Calls to the hotel may be recorded for training and quality purposes. Recordings are deleted automatically at the end of the retention period.
13. Recruitment
We advertise roles on our website and on sites such as LinkedIn and Indeed. Our recruitment privacy notice explains how we handle applicant data.
We only send marketing emails where you have given consent. You can unsubscribe at any time using the link in any email, or by contacting us.
We use social media to share news and offers. When you like, share or comment on our posts, we can see details such as your name, handle and photo. We do not copy or record your profile. Other users may also see your interactions, so please check your own privacy settings. You can manage how adverts are shown to you in your social media settings.
15. Keeping your information secure
We take data security seriously and use appropriate technical and organisational measures to protect your personal data. These include:
If we become aware of any loss or misuse of personal data, we will investigate and report it where required.
16. Payment card security
We use accredited third-party payment providers for card terminals at the hotel and payments on our website. We follow the Payment Card Industry Data Security Standard (PCI DSS) wherever card data is handled.
17. How long we keep your information
We keep personal data only as long as needed to provide our services and meet our legal, tax and contractual obligations, resolve disputes, prevent fraud and enforce our terms. Retention periods follow legal requirements (such as HMRC rules) and recognised guidance (such as from the ICO and ACAS). At the end of the retention period, data is securely deleted or anonymised.
18. Transfers outside the UK
Some of our service providers may process data outside the UK. Where this happens, we make sure the transfer is lawful and protected by an appropriate safeguard, such as an adequacy decision or approved contract terms.
Our website uses cookies. Please see our cookie notice for details and to change your preferences.
20. Links to other websites
Our website may link to third-party sites. We are not responsible for their content or how they handle your data, so please read their privacy notices.
21. Your rights
Under data protection law, you have the right to:
To exercise any of these rights, please contact us using the details in section 2. We may ask for ID to verify your identity, which we will securely delete once verified. We will respond within one month. If we need more time, we will tell you why and when to expect a full response.
22. Concerns and complaints
If you have a concern about how we handle your data, please contact us first so we can try to put it right.
You also have the right to complain to the Information Commissioner’s Office (ICO) at any time: ico.org.uk/make-a-complaint. If you are in the European Economic Area, you can contact your local supervisory authority.
23. Changes to this policy
We review this policy regularly and may update it from time to time. Please check this page for the latest version.
Last updated: October 2026
Be the first to hear about riverside stays, seasonal menus and what’s on at Old Swan & Minster Mill, plus limited-time offers worth making a date for.
Old Swan & Minster Mill
Minster Lovell
Oxfordshire
Cotswolds
OX29 0RN
