Privacy Policy

Privacy at a glance

We want you to understand what happens to information you choose to share with the park and when visiting its websites. The sections below explain the main circumstances in which personal data can be processed.

This notice should be read alongside our Terms & Conditions and any separate terms provided when you book or purchase a service.

Who is responsible for your information?

Fraser Brooks, General Manager, is the designated privacy and data protection lead for Stonham Barns Park. He manages privacy enquiries and requests, coordinates oversight of service providers, and is responsible for administering the park's data-retention and cookie-consent arrangements. The legal data controller is the organisation or other entity deciding why and how personal information is processed; Fraser's role as privacy lead does not, by itself, make him the legal data controller. The park contact address and the company's registered office are separate addresses. For park-operated services, the registered company named below is identified as the data controller; separate businesses and organisers can be independent controllers for their own services.

Individual retailers, event organisers, attractions or property-related businesses may be separate controllers for some transactions. Shops, individual attractions, event organisers, property businesses, third-party ticket sellers and payment platforms may be separate data controllers when they collect information directly for their own products or services. Please check the privacy notice provided by the relevant operator.

Information we may collect

Depending on how you interact with us, information may include:

• Contact details: name, email address, telephone number, postal address and the content of your messages.
• Booking details: arrival and departure dates, pitch or accommodation preferences, party size and booking references.
• Sales or property enquiries: details you submit about holiday home ownership, retail space or viewing arrangements.
• Transaction records: amounts, payment status and references from the payment service; payment card data is handled by the relevant provider where used.
• Support and correspondence: emails, contact form submissions and records of requests or complaints.
• Technical information: IP address, browser/device information, security logs and information collected through permitted cookies or similar technologies.
• On-site images: CCTV or photographs/video where systems or recordings are used, subject to appropriate notices and legal requirements.

Much of this information comes directly from you, although booking partners, payment providers or authorised third parties may also send relevant booking or transaction status information. Please do not send sensitive details unless they are genuinely needed and requested through a suitable channel.

How and why we use information

UK data protection law requires a valid lawful basis for each use of personal data. The table below explains the purposes for which personal information is used and the applicable types of lawful basis.

Where we rely on legitimate interests, these are balanced against the rights and reasonable expectations of individuals. We do not rely on this notice to authorise processing that otherwise requires permission or a different lawful basis.

Bookings, payments and reservations

When booking accommodation, camping or touring pitches, event tickets or other services, the operator handling the transaction may need the details required to confirm availability, process payment, send confirmations and respond to changes or cancellations.

Where services such as Stripe or PayPal are offered, payment details may be processed under those providers' respective privacy policies. Other booking or ticketing platforms may act as independent controllers. The relevant payment or booking platform provides additional privacy information when you use that service.

We do not ask you to email payment-card numbers or passwords. Payment or refund queries should be handled through the provider or booking channel identified on your confirmation.

Emails, updates and marketing

We may use the contact information you provide to respond to requests, send transactional messages such as confirmations and updates, or resolve questions about a booking or enquiry.

We only send promotional emails and messages where the relevant marketing rules permit. Where consent is the basis, you can withdraw it at any time. Promotional messages explain how to unsubscribe or change preferences, and service emails should not be treated as permission to send unrelated advertising.

You can contact Fraser Brooks to ask which marketing systems are used, to update your preferences or to object to direct marketing.

Cookies and your consent choices

Our sites may use necessary cookies for services such as secure sessions, booking features and remembering your privacy choice. Optional functional features, analytics and marketing technologies require an appropriate legal basis and, where required, your prior consent.

You can accept optional categories, reject them or change your preferences later. Declining optional storage does not prevent you accessing ordinary site content, though some optional functions may not operate.

Consent preference cookie: The consent manager uses sb_cookie_consent to remember necessary, functional, analytics and marketing choices for up to 180 days across stonhambarns.co.uk subdomains.

Fraser Brooks oversees cookie preferences for the park. Cookies vary between the main site, booking, event and other subdomains. The list below explains the confirmed consent cookie and the types of other storage that may be used. For cookie details for a particular service, contact Fraser.

Cookie types and preferences

sb_cookie_consent: a first-party cookie used to remember essential, functional, analytics and marketing preferences across the Stonham Barns websites. It lasts up to 180 days, uses Path=/, SameSite=Lax and Secure on HTTPS. Other cookies may be used for login and security, bookings and payment services, video embeds, and optional analytics or marketing. Their names and lifetimes depend on the relevant platform. Where required, non-essential cookies should be blocked until you give consent; cookie choices can be changed using Manage Cookie Consent.

Browser settings may also let you block or delete cookies. Blocking necessary storage can affect essential site functions. Optional scripts and embedded content need to be connected to the consent manager, not just described in this policy.

CCTV, photographs and video

CCTV may operate in designated parts of the park for security and safety. Where recording takes place, appropriate signage should identify the responsible operator and explain how to obtain privacy information. Different venues and independent businesses may operate their own systems.

Photographs or video may also be captured during events or activities. Where individuals can be identified, the relevant operator must have a lawful basis, explain the purposes and respect applicable data protection rights. Additional permission may be required for particular uses.

Access to recordings should be restricted to authorised people. Retention and disclosure, including to law enforcement where legally justified, must follow the recorded purpose and retention policy.

Who information may be shared with

To operate websites and services, personal information may be shared when appropriate with hosting and technical-support providers, booking and payment providers, email delivery services, relevant park teams, and professional advisers or public authorities where legally required. Independent event organisers, attractions and retailers may collect information directly through their own services.

We require appropriate contractual and security safeguards when an organisation processes personal information on our behalf. We do not describe data sharing as a sale or blanket permission to use personal data for unrelated purposes.

Fraser Brooks manages enquiries about service providers that handle park information. The categories below explain the types of recipients relevant to our websites; third-party services and independent businesses can have separate privacy notices.

Service provider and recipient categories

Depending on the service you use, information may be shared with website hosting and IT/security support providers; email and communication services; accommodation booking, ticketing and customer management platforms; payment providers (such as Stripe or PayPal where these are available at checkout); accountants, auditors and professional advisers; insurers; and regulators or public authorities where required by law. We limit sharing to the purpose of the service. You can ask Fraser Brooks about a particular supplier.

International data transfers

Some website, email, cloud or payment suppliers may process information outside the United Kingdom. Where a restricted transfer occurs, we use an applicable UK adequacy arrangement or appropriate transfer safeguards as required by law. Details of a particular transfer can be requested from our privacy lead.

International processing

Some hosting, email, cloud, booking and payment services may involve processing outside the UK. Where a restricted international transfer takes place, we use an appropriate UK legal mechanism such as an applicable adequacy arrangement, UK International Data Transfer Agreement or UK Addendum, as relevant. Ask Fraser Brooks for details about a particular provider or transfer.

How long information is kept

We aim to keep personal information only for as long as necessary for the purpose for which it was collected, including relevant legal, accounting, contractual and security requirements. We review records and securely remove data when no longer needed.

Fraser Brooks manages retention enquiries. The periods or criteria below are our intended normal approach; records may be kept longer where needed for an active dispute, investigation, contract or legal obligation.

Different systems can have different technical retention settings. CCTV footage associated with an incident may be kept longer where there is a legitimate reason; there is no universal retention period for all CCTV installations.

How personal information is protected

We use proportionate technical and organisational safeguards to protect information against unauthorised access, accidental loss and misuse. Depending on the service, these can include secured connections, account access controls, limited permissions, backups, updates and incident-response procedures.

No website or electronic communication can be guaranteed to be completely secure. Please use official contact or booking channels and do not send confidential payment details in ordinary email.

Your data protection rights

Depending on the circumstances and lawful basis, UK data protection law may give you the right to:

• Request access to personal information held about you.
• Ask for inaccurate information to be corrected.
• Request deletion or restriction of processing in applicable circumstances.
• Object to certain processing, including direct marketing.
• Request data portability when its legal requirements apply.
• Withdraw consent where processing relies on it, without affecting earlier lawful use.
• Challenge relevant decisions made solely by automated processing, where applicable.

Automated decision-making: Park website booking, enquiry and contact processes are not intended to make solely automated decisions that produce legal or similarly significant effects. Some independent payment or booking providers may use automated fraud or security checks as explained in their own notices. Contact Fraser Brooks if you have concerns about an automated decision affecting you.

To make a request, contact the privacy contact listed above. We may need to check your identity before releasing information and will respond within applicable legal time limits. Some rights are subject to exceptions.

Children, links and independent services

Family attractions and events may involve children, but online services are not necessarily intended to collect personal data directly from children without suitable safeguards. Where information about children is necessary for bookings or activities, it should be limited to what is required and handled appropriately.

Our pages may link to independent businesses, booking providers, social media services and other websites. We are not responsible for their privacy practices; please read the relevant provider's notice before sharing personal information with them.

Contact, questions and complaints

If you have questions about how information is used, would like to exercise your rights or want to raise a concern, please contact:

You may also complain to the UK Information Commissioner's Office (ICO), the independent regulator for data protection. Visit ico.org.uk/make-a-complaint/.

Changes to this policy

We may update this notice if our websites, systems, service providers or legal obligations change. Material changes to the way we handle information should be explained before relevant new processing begins. The effective date at the top identifies this version of the policy.

For general website conditions, see the Terms & Conditions.