The Old Stores Privacy Policy
Version 4 dated 7 October 2026
Who is responsible for your information
James Miles and Natalya Miles, trading as The Old Stores, jointly decide how guest information is used and are joint data controllers. You can contact either of us about your information or rights. We jointly handle enquiries, bookings and privacy requests; you do not need to identify which operator holds a record. Email: theoldstores@familymiles.co.uk. Postal address: The Limes, Bardwell Road, Sapiston, Bury St Edmunds, Suffolk IP31 1RU.
This policy covers our website, enquiries, direct bookings, stays and information we receive about reservations made through other platforms. Separate provider privacy notices also apply to information those providers use for their own purposes.
Information we collect and where it comes from
We collect names and contact details, stay dates, guest numbers, relevant child age information, dog details, requests, payment amounts and references, payment status, correspondence, feedback and records of complaints or incidents. Card information entered directly into Stripe is handled by Stripe; we receive only the payment information needed to administer your booking.
Information comes from you, the person booking for your party, Smoobu, Stripe and any platform through which you book. Our website and its providers may receive IP addresses, device and browser information, access times and privacy choices. Please share this notice with others whose information you provide and avoid sending unnecessary personal details.
Contact, booking and payment information is needed to arrange and provide a stay. Without it we may be unable to accept or manage a booking. Optional marketing preferences are not required to book. If an access request involves health or disability information, please describe the adjustment needed rather than provide a diagnosis. Where we need to retain health details, we will ask for explicit consent unless another lawful special-category condition applies; emergency or legal-claim uses may have different lawful conditions.
Why we use information
Enquiries and the lead guest’s booking, payments and stay communications: performance of our contract or steps you request before entering it. Administration of information about other guests: our legitimate interests in providing and safely managing the booked stay.
Tax, accounting and legally required records: compliance with legal obligations. Fraud prevention, security, complaints, evidenced damage claims and legal disputes: our legitimate interests in protecting the property, guests and business and resolving problems, or a legal obligation where applicable. Emergency assistance: vital interests where necessary. We consider necessity and your rights whenever we rely on legitimate interests.
Optional promotional emails: your consent. You can withdraw consent using an unsubscribe facility or by contacting us. Booking and service messages are separate from marketing.
Who receives information
We share only information needed for the purpose with Smoobu for reservations and property management; Stripe for payments, refunds, fraud prevention and payment disputes; website hosting, security, email and IT providers; the platform used for your booking; and cleaners or maintenance contractors where needed for the stay. Advisers, insurers, banks, payment networks and public authorities may receive information where necessary and lawful. We do not sell guest information.
Smoobu’s privacy notice is at https://www.smoobu.com/en/privacy-policy/ and Stripe’s is at https://stripe.com/privacy. Where you use Google Maps, Google’s privacy notice is at https://policies.google.com/privacy. Those providers may act independently for some of their purposes.
International processing
Our providers may process information outside the UK. For restricted transfers we use applicable UK adequacy regulations or appropriate safeguards, such as the UK International Data Transfer Agreement or UK Addendum, as appropriate to the provider and transfer. Contact us for details of the applicable safeguards and how to obtain a copy. Provider notices explain their own international processing.
How long information is kept
We retain information only as long as needed for its purpose. Unsuccessful enquiries are normally deleted within 12 months of the last meaningful contact. Booking and payment records needed for tax or contractual claims are retained for the applicable tax-record period and, where needed for claims, normally up to six years after the stay. We retain only relevant communications with those records, not every message as a matter of course.
Records may be kept longer for an open tax enquiry, dispute, insurance claim or legal requirement, and unnecessary details are deleted sooner. Optional request information, particularly health details, is removed once the arrangement has been completed unless an incident or legal requirement justifies retention. Marketing consent records remain while used; a minimal suppression record may be retained after withdrawal to prevent further unwanted marketing. Security logs and privacy choices are retained only for the periods justified by security needs or the relevant technology’s purpose.
Security cameras
Three external Anker Eufy security cameras operate at the property: one on the garage facing the drive; one on the corner of the house covering the drives and garden; and one at the front door. All three record video and audio when triggered. There are no internal cameras. Video, audio and associated camera data are used only for security and kept for no more than 30 days.
We rely on our legitimate interests in protecting the property and preventing or investigating security incidents, subject to necessity and proportionality. Access is restricted. Recordings may be shared with the police or other authorised recipients only where necessary and lawful for security purposes. We use Anker Eufy equipment and services for the camera system. You can contact us about recordings or exercise the rights set out below.
Cookies and embedded services
The website uses a first-party local-storage entry called oldstores_privacy_v1 to remember your separate choices for Smoobu booking/availability embeds and the Google map. It contains those choices and the date they were saved, with no guest or payment details. Choices expire after 180 days and are then renewed; this entry is not used for advertising or tracking. We do not add our own analytics or advertising scripts.
On your first visit, or when a saved choice has expired, a Cookies & privacy prompt lets you choose Allow all, Necessary cookies only, or Save my selection for Smoobu booking and availability and Google Maps separately. Closing the prompt without choosing leaves optional features off. Smoobu embeds and the Google map are blocked until you allow the relevant service. Allow all loads both immediately; valid saved choices are applied automatically on return visits for up to 180 days. You can change or withdraw your choices at any time using Privacy choices in the footer. Loading an embed sends technical information, including your IP address, to its provider, which may use cookies or similar storage for that feature. The provider controls the names and lifetimes of its technologies; see the Smoobu and Google privacy notices above. Withdrawing permission stops future embedded loading but does not delete cookies already set by a provider: use your browser settings to remove those. External booking and directions links remain available when embeds are off; the destination provider manages its own privacy choices. Accepting booking terms does not give marketing or cookie consent.
Your rights
Depending on the processing, you may request access, correction, deletion, restriction or portability of your information. You can withdraw consent at any time without affecting earlier lawful processing. Contact either operator using the details above. We may reasonably verify identity and normally respond within one month, subject to lawful extensions or exceptions. Requests are normally free of charge.
Your right to object: you may object to our processing based on legitimate interests for reasons relating to your situation. You may object to direct marketing at any time, and we will stop using your information for that purpose.
If you are concerned about our use of information, you may contact us or complain directly to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/ or on 0303 123 1113. You do not have to complain to us first.
Protecting information and policy changes
We use appropriate organisational and technical safeguards, including restricted access and secure service providers. We may update this notice as our practices or legal obligations change. The website will show the current version. Changes to this notice do not reduce the contractual cancellation rights accepted when you booked.