Privacy Policy

This Privacy Policy explains how Old Crown Girton, located in Girton, Cambridge, UK, collects, uses, and protects your personal information in accordance with UK GDPR, the Data Protection Act 2018, and other applicable laws.

1. Data Collection Practices

We may collect the following information:

• Personal Information: Name, contact details, booking information, dietary preferences (if provided)
• Payment Data: Card details (processed securely via third-party payment processors; we do not store full card numbers)
• Cookies & Usage Data: Device information, IP address, browsing activity, preferences
• Marketing Preferences: Newsletter sign-ups, event participation
• Order/Delivery Data: Address, order details (if using delivery platforms)

2. Legal Basis for Processing

We process your data under the following lawful bases:

• Contract: To fulfill reservations, orders, or service requests
• Consent: For marketing communications and optional cookies
• Legal Obligation: Compliance with tax, health & safety, or regulatory requirements
• Legitimate Interests: Service improvement, fraud prevention, business analytics

3. Data Retention & Deletion

• • Personal data is retained only as long as necessary for the purpose collected
• • Booking/payment data: retained for up to 7 years for legal/accounting purposes
• • Marketing data: retained until you withdraw consent
• • Analytics data: typically retained for 26 months
• • You may request deletion of your data at any time (subject to legal exceptions)

4. Third-Party Integrations

We may share data with:

• Payment Processors: (e.g., Stripe, Square) for secure transactions
• Delivery Platforms: (e.g., Deliveroo, Uber Eats) for order fulfillment
• Marketing Tools: (e.g., Mailchimp) for newsletters and communications
• Website Analytics: (e.g., Google Analytics) for site improvement

All third parties are contractually required to comply with UK data protection laws and maintain appropriate security measures.

5. Your Rights Under UK GDPR

You have the right to:

• Access: Request copies of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data ("right to be forgotten")
• Restriction: Limit how we process your data
• Objection: Object to processing based on legitimate interests
• Portability: Receive your data in a portable format
• Withdraw consent: Remove consent for marketing or optional processing

To exercise your rights, contact us at oldcrown@lapeninns.com.

6. Cookie Policy & Consent Management

We use cookies to enhance your experience and analyze site usage:

• Essential cookies: Required for site operation and security
• Analytics cookies: Help us understand how visitors use our site
• Marketing cookies: Used to deliver relevant advertisements

You can manage cookie preferences via our website's cookie banner or your browser settings. Disabling certain cookies may affect site functionality.

7. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

• • Encryption of sensitive data in transit and at rest
• • Regular security assessments and updates
• • Access controls and staff training
• • Secure hosting and backup procedures

While we take security seriously, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

8. International Data Transfers

Some of our service providers may process data outside the UK/EEA. When this occurs, we ensure adequate protection through approved transfer mechanisms such as adequacy decisions or standard contractual clauses.

9. Children's Privacy

Our services are not directed at children under 13. We do not knowingly collect personal information from children under 13. If we become aware of such collection, we will delete the information immediately.

10. Updates to This Policy

We may update this policy from time to time. Material changes will be notified via email (where possible) or prominent notice on our website. The updated version will be effective immediately upon posting.

11. Contact Information & Data Protection Officer