Privacy policy

This policy explains what personal information Hello Yorkshire collects when you use www.hello-yorkshire.co.uk, why we collect it, and what your rights are. We’ve tried to keep it short and in plain English. It was last updated in [check: month and year of publication].

Who we are

Hello Yorkshire is run by Bow House Digital Ltd (09984109), 3 Chapel Court, Chapel Street, Easingwold, York YO61 3AE. Bow House is the data controller for the personal information described in this policy, which means we decide how it’s used and we’re responsible for looking after it.

If you have any questions about this policy or your information, email tourism@bowhouse.co.uk or call 01347 821928.

What we collect and why

You can browse Hello Yorkshire without telling us who you are. We only collect personal information in the situations below.

Enquiries to a business

When you use the enquiry form on a listing, we ask for your name, email address and message. For places to stay you can also give arrival and departure dates and the number of guests if you want to. We email your enquiry straight to the business you’re contacting, so they can reply to you directly, and send a copy to Bow House.

• The business is a separate organisation, not part of Hello Yorkshire. Once they receive your enquiry, they’re responsible for how they use your details, under their own privacy policy.
• We keep the copy so we can help if an enquiry goes astray, deal with complaints or misuse, and count how many enquiries each listing receives.
• Enquiries aren’t saved in the website’s database. They exist only as emails in the business’s inbox and ours.

Our lawful basis is legitimate interests: passing your enquiry on is what you’ve asked us to do, and keeping a copy helps us run a reliable service.

Contact and advertising enquiries

If you use our contact form, we ask for your name, email address, an optional phone number and your message. The advertising form also asks for your business name and an optional website. These go by email to Bow House only, and we use them just to reply to you and, for advertising enquiries, to discuss listing your business. Our lawful basis is legitimate interests (answering your message), or taking steps at your request before entering into a contract if you’re asking about advertising.

If a form doesn’t send

If there’s a problem with something you’ve typed (a missing field, say), we keep what you entered for 15 minutes so the form can be filled in again for you. It’s then deleted automatically. We don’t keep anything when a form is sent successfully, other than the emails described above.

To stop spam, our forms use a hidden field and check how long the form was open. We don’t use reCAPTCHA or any other third-party spam service.

Businesses that advertise with us

If your business has a listing, we hold the details you or we have added to it, such as the business name, contact name, address, phone numbers, website and booking links, photos, descriptions, special offers, calendar links and dates you’ve marked as booked. Most of this is shown publicly on your listing; your enquiry email address isn’t shown on the site.

• Logging in: you log in to My listings with a link we email to you. Each link works once and expires after 15 minutes. Your account holds your email address and name. To prevent abuse, we briefly keep a scrambled (hashed) record of the email address and IP address used to request a link, for up to an hour, to limit how many links can be requested.
• Changes you make: each time you save a listing, we keep a previous version so our staff can undo mistakes, and we note what changed, when and by which account. Staff receive a daily summary of these changes.
• Calendars: if you add calendar links from booking sites, we read them every few hours and keep only the booked dates. We don’t store guest names or other booking details from those calendars.
• Monthly stats emails: we email each listing a summary of its figures for the month. Free listings also receive information about our paid listings. Every email has a link to stop them, and you can also turn them off in My listings.

Our lawful bases are contract (providing the listing you’ve arranged with us) and legitimate interests (running and improving the directory, keeping it secure, and telling you how your listing is doing).

Listing statistics

To show businesses how their listings are doing, we count how often each listing appears in search results, is viewed, has its phone number revealed, has its website or booking link clicked, and receives an enquiry. We store only a daily total for each listing. These counts don’t include your IP address, don’t use cookies and can’t be linked to you. We don’t count visits from logged-in users or known search engine robots.

Cookies and similar technologies

Our listing statistics don’t use cookies. We do use the following:

• Google Analytics (via Google Tag Manager): on the live site we use Google’s tools to understand how the site is used, for example which pages are popular and how people find us. These set cookies in your browser and send information about your visit, including your IP address and device details, to Google. We only use them if you click Accept on our cookie banner, and nothing is loaded from Google until you do. You can change your mind at any time with the Cookie settings link at the bottom of every page. [check: which tags the Tag Manager container loads (Google Analytics 4 only, or others such as Google Ads), and their cookie names and lifetimes, for example _ga and _ga_* for up to 2 years]
• Your cookie choice: a cookie called hy_consent remembers whether you accepted or rejected analytics cookies, for six months, so we don’t ask on every page.
• Login cookies: if you log in to My listings (or our staff log in), WordPress sets cookies that keep you logged in, for up to 14 days. These are strictly necessary and aren’t used for anything else.

You can also block or delete cookies in your browser settings.

Maps and other services your browser connects to

• Maps: listing maps use OpenStreetMap. When a map is shown, your browser fetches the map images directly from OpenStreetMap’s tile servers, which see your IP address in the same way any website does. See the OpenStreetMap Foundation privacy policy.
• Map software: the code that draws the map (Leaflet) is loaded from cdnjs, run by Cloudflare, which also sees your IP address. [check: whether to keep this or host Leaflet on our own server]
• Videos and virtual tours: some paid listings have a video (from YouTube or Vimeo) or a virtual tour (from Matterport). Nothing is loaded from those services until you press play; then the player comes from them, under their own privacy policies, and they may set cookies.

Our fonts and other site files are served from our own server.

Who we share information with

We don’t sell your information, and we only share it where we need to:

• the business you send an enquiry to;
• our website host, who stores the website and its data on our behalf [check: hosting company name; we believe the servers are in the UK];
• our email providers, who handle emails sent by and to the website [check: email provider used for sending, and for the tourism@bowhouse.co.uk mailbox];
• Google, for analytics as described above, if you accept analytics cookies;
• anyone we’re legally required to share it with, such as the police or a court.

Some of these providers, such as Google, may process information outside the UK. Where they do, we rely on the safeguards UK law requires, such as the UK–US Data Bridge or standard contractual clauses.

How long we keep it

• Enquiry copies and contact or advertising messages: in our email inbox for 2 years, then deleted.
• Form details kept after a problem: 15 minutes.
• Login links: 15 minutes, or until used. Login request records: up to an hour.
• Advertiser accounts and listings: while your business is listed, and for 12 months afterwards in case you return, unless you ask us to delete them sooner. Previous versions of listings are kept with the listing. The log of changes is deleted from the site once the daily summary has been emailed to staff.
• Listing statistics: daily totals are kept so businesses can compare months. They don’t contain personal information.
• Analytics: as set in Google Analytics.

Your rights

Under UK data protection law (the UK GDPR and the Data Protection Act 2018) you have the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct information that’s wrong or incomplete;
• ask us to delete your information;
• object to us using your information, or ask us to restrict how we use it;
• ask for information you’ve given us to be transferred to you or another organisation, where that applies;
• withdraw your consent at any time, where we rely on consent.

To use any of these rights, email tourism@bowhouse.co.uk. We’ll reply within one month. There’s normally no charge.

If you’ve sent an enquiry to a business and want them to delete your details, please contact that business directly as well, as they hold their own copy.

Complaints

If you’re unhappy with how we’ve handled your information, please tell us first and we’ll try to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

Changes to this policy

We may update this policy from time to time, for example if we add new features to the site. The latest version will always be on this page, with the date it was last updated.