Privacy policy

This policy explains how Taigh Tuaram handles the personal information you give us when you enquire about or book a stay. It is written to meet our obligations under the UK GDPR and the Data Protection Act 2018.

Who we are

Taigh Tuaram is run by Murdo Macleod, trading as Taigh Tuaram, a holiday cottage on the Isle of Lewis. Murdo Macleod is the data controller for the information described here. You can write to us at Taigh Tuaram, Isle of Lewis, HS2 9AZ, reach us through our contact page, or by email at stay@taightuaram.com.

What we collect

• Your name, email address and phone number.
• Your booking details: dates, number of guests and any special requests you send.
• Correspondence you send us through the contact form or by email.
• Payment is handled by Stripe. We do not see or store your full card details; Stripe processes the payment and returns only a confirmation and a reference to us.

Why we use it and our legal basis

• To take and manage your booking and to contact you about it (to perform our contract with you).
• To answer enquiries you send us (our legitimate interest in responding to you).
• To meet our legal and accounting obligations (legal obligation).

Who we share it with

We use a small number of trusted providers to run the site and process bookings:

• Stripe for payment processing.
• Resend to send booking confirmation, cancellation and enquiry emails.
• Hetzner, our hosting provider, whose servers in Germany store the site and its database.
• A self-hosted error-monitoring tool (GlitchTip) that we run on our own server to diagnose faults; it may briefly record technical details of a request.

Enquiries you send through the contact form are delivered to our own email inbox. We do not sell your information. We share availability dates with Booking.com and Airbnb through calendar feeds, but those feeds carry dates only, not your personal details.

Sending data outside the UK

Most of your information stays in the UK or the European Economic Area; our hosting is in Germany, which the UK recognises as giving adequate protection. Two of our providers, Stripe and Resend, may process some information in the United States. Where they do, the transfer is covered by safeguards approved for UK data transfers, such as the UK International Data Transfer Agreement, the UK addendum to the European Standard Contractual Clauses, or the UK to US data bridge where the provider takes part in it.

How long we keep it

We keep enquiry messages only as long as we need them to deal with your enquiry, normally up to twelve months. We keep booking and payment records for six years after the end of the tax year they relate to, because we must for accounting and tax. After that we delete or anonymise them.

Your rights

You have the right to ask for a copy of the information we hold about you, to have it corrected or deleted, and to object to or restrict how we use it. To exercise any of these, please get in touch. If you are not satisfied with our response, you can complain to the Information Commissioner's Office at ico.org.uk.

Cookies and analytics

The site uses only the cookies it needs to work, such as keeping you logged in to the owner area and protecting forms against cross-site request forgery (the sessionid and csrftoken cookies). We do not use advertising or third-party tracking cookies.

To understand which pages and which sources bring visitors to the site, we use Umami, a privacy-friendly analytics tool that we run ourselves on our own server. It does not set any cookies, does not track you across other websites, and does not collect information that identifies you personally. It records only aggregate figures such as page views, the page you arrived from, and any campaign tags in the link you followed. Because this analytics is first-party and works without cookies, it does not require a consent banner under the Privacy and Electronic Communications Regulations; we describe it here for transparency. The data stays on our own infrastructure and is not shared.

Automated decisions and changes to this policy

We do not make decisions about you by automated means, and we do not profile you. We may update this policy from time to time; the date at the top of the page shows when we last changed it.