Privacy Policy 

The Tawny - Privacy Policy

The Tawny Hotel Limited (company number 13271160) is responsible for the personal data we hold about you, and is the controller of that data for the purposes of data protection law. We take your privacy seriously. Please read this policy carefully, as it explains who we are, how and why we collect, store, use and share your personal information, your rights, and how to contact us or the supervisory authority if you have a concern.

We handle your personal data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025.

How The Law Protects You

• Your personal data is protected.
• You have control over, and access to, the personal information we hold about you, so you can check it, change it or ask us to remove it.
• You can choose how you wish to be contacted, for example by email or phone.
• You can change your mind and update your choices at any time.

Our Lawful Bases of Communicating With You

We can only use your personal data where we have a proper reason to do so. The reasons we rely on are:

• where you have given your consent;
• to fulfil a contract we have with you, or to take steps at your request before entering into a contract;
• to comply with our legal and regulatory obligations; and
• for our legitimate interests, where we have a business reason to use your information that is not overridden by your own rights and interests. Where we rely on a legitimate interest, we will tell you what it is.

The information we collect

We collect information to provide a better service to you, such as having your registration card ready on arrival. This includes information you give us through our website, our social media channels, by phone or email, and when you make a booking or enquiry through a third party travel agent or online booking website. The information we may collect includes:

• registration details (name, postal address, email address, location, mobile or other telephone number);
• date of birth and gender;
• business information (your company name, address, VAT number and registration number);
• customer service information, including comments you make online when booking or when speaking to our reservations team;
• any other information you provide when making a booking; and
• any information you give to third party online booking websites or travel agents.

Additional information for spa, membership and guest forms

When you complete our spa treatment applications, membership applications or guest forms, we may also collect:

• your full name and the name of your partner or spouse;
• your date of birth;
• your contact information, such as email address and telephone or mobile number(s);
• your geographic information, such as home address and postcode;
• your special dietary requirements;
• your credit or debit card details, where you make a payment;
• your medical history and physical health history; and
• your car registration, for car parking arrangements.

Special category data. Some of this information, such as your medical history, physical health and dietary requirements, is special category data. We will only collect and use this information with your explicit consent, so that we can provide spa treatments and dining safely, and you can withdraw that consent at any time.

How we use your information

We may use the information described above for the purpose for which you provided it, as well as the following:

• to provide our products and services to you;
• to create a profile in our hotel system to manage your booking;
• to verify your identity;
• to communicate with you and answer any queries you may have;
• to deliver, or allow you to take part in, our services;
• to keep track of your preferences when you visit us;
• to conduct statistical analysis to improve our website; and
• to understand your interactions with our website.

Who we share your personal information with

We routinely share personal information with:

• third parties we use to help deliver our services to you, for example software providers (such as Sirvoy);
• Ensarb Limited (company number 06586604), an associated company, whose registered office is at c/o The Ashes, Leek Road, Endon, Stoke-on-Trent, Staffordshire, ST9 9AX;
• Jenkinsons Caterers (Stafford) Limited (company number 2864589), whose registered office is at St Albans Road, Stafford, ST16 3DR, who provide catering services;
• other third parties we use to help us run our business, for example marketing agencies or website hosts;
• third parties approved by you, for example treatment suppliers;
• our bank;
• our accountants; and
• our solicitors.

We only allow our service providers to handle your personal information if we are satisfied they take appropriate measures to protect it. We also impose contractual obligations on service providers to ensure they can only use your personal information to provide services to us and to you.

We may disclose and exchange information with law enforcement agencies and regulatory bodies to comply with our legal and regulatory obligations.

We may also need to share some personal information with other parties, such as potential buyers of some or all of our business, or during a re-structuring. Usually, information will be anonymised, but this may not always be possible. The recipient of the information will be bound by confidentiality obligations.

Marketing

We would like to send you information from time to time about products, offers and services at The Tawny that we believe may be of interest to you. If you have consented to receive our marketing, you may opt out at any time using the opt-out link in each of our newsletters.

We also use Google Ads from time to time to remarket our services to previous visitors of our website across third party websites, including Google. You can set your own preferences for how Google advertises to you using the Google Ad Preferences page, and you can opt out there if you wish.

Cookies

A cookie is a small file containing a string of characters that is sent to your computer when you visit a website. When you visit again, the cookie allows the site to recognise your browser. Cookies may store preferences and other information. You can reset your browser to refuse all cookies, or to tell you when a cookie is being sent, although some websites may not work properly without cookies. For more information, please see our cookie policy.

We use Google Analytics, a reporting tool that allows us to review anonymous information about how our website is used and how visitors reach it. Google Analytics does not collect personal data about our visitors.

Your Rights

You have the following rights, which you can exercise free of charge:

Access	The right to be provided with a copy of your personal information.
Rectification	The right to require us to correct any mistakes in your personal information.
Erasure	The right to require us to delete your personal information in certain situations.
Restriction of processing	The right to require us to restrict processing of your personal information in certain circumstances.
Data portability	The right to receive the personal information you provided to us, in a structured, commonly used and machine-readable format, and to transmit it to a third party in certain situations.
To object	The right to object at any time to your personal information being used for direct marketing, and in certain other situations to our continued processing of your personal information.
Automated decision making	The right not to be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you.

If you would like to exercise any of these rights, please contact us (see 'How to contact us' below), give us enough information to identify you, provide proof of your identity and address, and tell us which right you wish to exercise. As required by data protection law, we will respond within 30 days of receiving your request. This is a free service.

Keeping your information secure

We have appropriate security measures to prevent personal information from being accidentally lost, or used or accessed unlawfully. We limit access to your personal information to those who have a genuine business need for it, and those processing your information are subject to a duty of confidentiality. We also have procedures in place to deal with any suspected data security breach, and we will notify you and any applicable regulator where we are legally required to do so.

How to complain

We hope that we can resolve any query or concern you raise about our use of your information. If you wish to make a data protection complaint, please see our separate Data Protection Complaints Process, which explains how to complain to us and how we will handle it. We will acknowledge any complaint within 30 days and respond without undue delay.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority, at any time. The ICO can be contacted at https://ico.org.uk/concerns or by telephone on 0303 123 1113. We would, however, encourage you to raise your concern with us first.

Retention of information

We will retain your personal data for as long as is necessary to fulfil the purpose for which it was collected, for business or legal purposes, or in accordance with applicable laws. We will not keep your personal data for longer than necessary.

Transfers outside the UK and EEA

From time to time we may expand or reduce our business, or transfer or assign the benefit of this privacy policy to an associated company. This may involve the transfer of certain data, where the original purpose for the data remains the same and is relevant, to the new owner or controlling party, who will be required to follow this privacy policy. We will not transfer your data outside the UK or European Economic Area unless the country or territory ensures an adequate level of protection, or appropriate safeguards are in place as required by data protection law.

Links to other websites

This privacy policy applies only to data collected by us. Our website may contain links to external sites operated by others, over which we have no control. We encourage you to read the privacy policy of any website you visit through a link from ours. We are not responsible for the privacy policies, content or security of third party websites.

Changes to this privacy policy

This privacy policy is reviewed regularly. Following any changes, the new version will be uploaded to our website and the previous version removed. This policy was last updated in June 2026.

How to contact us

If you have any questions about this privacy policy or the information we hold about you, please contact us:

• Email: [email protected]
• Post: The Tawny Hotel Limited, Consall Lane, Staffordshire, ST9 0AG

If you would like this policy in another format, for example audio, large print or braille, please contact us using the details above.

The Tawny is operated by The Tawny Hotel Limited (company number 13271160)