What I collect when you use this website, why I collect it, how long I keep it, and exactly what you can ask me to do about it.
Last updated 2 September 2026 Applies to theletloft.com
On this page
In short
I collect your name and email when you contact me, book a call or buy a guide — and basic, anonymised information about how the site is used.
I use it to reply to you, deliver what you’ve booked, and keep proper records. I never sell it, and you can ask me to delete it at any time.
The Let Loft is run by Ashleigh Allwood, trading as [legal / trading name — e.g. “Ashleigh Allwood t/a The Let Loft”, or the limited company name and number], based in [town / county, UK].
For the purposes of UK data protection law I am the data controller for the personal information collected through this website. That means I decide what is collected, why, and what happens to it.
You can reach me at any time at ash@theletloft.com, or by post at [correspondence address].
Registered with the Information Commissioner’s Office under registration number [ICO registration number].
I only collect what I actually need to answer you, deliver what you’ve booked or bought, and run the business properly.
I never see or store your full card details. Payments are handled entirely by [payment provider — e.g. Stripe / PayPal], who send me only a confirmation that payment succeeded and the last four digits of the card.
I don’t knowingly collect special category data (health, ethnicity, religion, and so on), and I’d ask you not to include it when you write to me.
UK GDPR requires me to have a valid reason for every use of your information. Here is each one, plainly:
| What I do | Why | Lawful basis |
|---|---|---|
| Reply to your enquiry | To answer the question you asked | Legitimate interests — responding to someone who contacted me |
| Deliver a call or audit | To provide the service you booked | Performance of a contract |
| Fulfil a guide purchase | To take payment and send your download | Performance of a contract |
| Send the newsletter | To share tips and new guides | Consent — withdrawable at any time |
| Keep accounting records | Tax and bookkeeping obligations | Legal obligation |
| Measure site usage | To understand what’s useful and improve the site | Consent — via the cookie banner |
| Keep the site secure | To prevent spam, fraud and abuse | Legitimate interests |
Where I rely on legitimate interests, I’ve considered whether it’s fair to you as well as useful to me, and I’ve concluded it is. If you disagree, you can object — see your rights.
I don’t sell your information, and I never will. I do use a small number of trusted service providers to run the business. They act on my instructions and are contractually required to keep your information secure and use it only for the purpose I’ve given it to them for.
| Provider | What it does | What it sees |
|---|---|---|
| [Hosting provider] | Hosts the website | Server logs, form submissions |
| Calendly | Handles call bookings | Name, email, booking details |
| [Payment provider] | Processes payments | Name, billing details, payment data |
| [Email marketing tool] | Sends the newsletter | Name, email, open and click activity |
| [Analytics tool] | Measures site usage | Anonymised usage data |
| [Accountant] | Prepares accounts | Invoices and order records |
I may also disclose information where I’m legally required to — for example to HMRC, a regulator or a court.
Wherever possible I use providers that store data in the UK or the European Economic Area.
Some of the tools above are based in the United States. Where information is transferred outside the UK, it is protected by an approved safeguard — either UK adequacy regulations, the UK Extension to the EU–US Data Privacy Framework, or the International Data Transfer Agreement.
If you’d like to know exactly where a particular piece of information sits, just ask and I’ll tell you
I don’t keep things indefinitely. As a rule:
Under UK GDPR you have the right to:
To use any of these, email ash@theletloft.com. It’s free, and I’ll respond within one month. I may ask you to confirm your identity first, so that I’m not handing your information to someone else.
I’ll only add you to the newsletter if you’ve asked to be on it, or if you’ve bought a guide or booked a session and I’ve told you at the time that you’ll receive occasional related emails.
Every email has an unsubscribe link at the bottom. One click and you’re off — you don’t need to explain why, and it won’t affect any work we’re doing together. You can also just reply and ask.
The site runs over an encrypted HTTPS connection. Access to accounts and inboxes is protected by strong, unique passwords and two-factor authentication. Only I have access to client records.
No system is perfectly secure, and I won’t pretend otherwise. If a breach happens that’s likely to put your rights at risk, I’ll tell you and report it to the ICO within 72 hours, as the law requires.
This website and these services are intended for adults running or buying holiday let property. I don’t knowingly collect information from anyone under 18. If you believe a child has given me their information, contact me and I’ll delete it.
I’ll update this page when what I do changes — for example if I start using a new tool. The date at the top always shows the current version. If a change materially affects how your information is used, I’ll tell subscribers and clients by email rather than quietly editing the page.
If something here concerns you, please come to me first at ash@theletloft.com. I’d much rather put it right directly.
You also have the right to complain to the UK’s data protection regulator at any time:
