1. Introduction
1.1. The General Data Protection Regulation (the "GDPR") seeks to protect and enhance the rights of data subjects. Isle of Mull Cottages Limited (the "Company") is committed to protecting and respecting your privacy. The Company recognises the importance of the correct and lawful treatment of personal information, and will only use personal information as set out in this Privacy Notice.
1.2. This Privacy Notice sets out how the Company collects and uses any information that you give us when you use this website and the booking system contained within it (together the "Website"). The expressions "we", "us" and "our" refer to the Company.
1.3. We have appointed a Privacy Officer to oversee compliance with this Privacy Notice. If you have any questions about this Privacy Notice or how we handle your personal information, please contact the Privacy Officer at: mail@isleofmullcottages.com, or by post to: Privacy Officer, Reuben O’Connell, Isle of Mull Cottages Limited, Woodbank, Dervaig, Tobermory, Isle Of Mull, Scotland, PA75 6QW.
1.4. We may change this Privacy Notice at any time by updating this page so you should therefore check the Website from time to time to ensure you are aware of any changes.
1.5. It is important that you read this Privacy Notice, together with any the Company terms and conditions that we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such personal information. This Privacy Notice supplements the other notices and is not intended to override them.
1.6. It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your relationship with us.
2. Who are we?
Isle of Mull Cottages Limited is a registered company, based in Scotland under company number SC477072, with its registered office at Broombank, North Connel, Oban, Argyll, PA37 1RD.
3. In what capacity will the Company hold personal information about you?
3.1. During the course of providing its services, the Company, on behalf of its clients (the "Landlords") compile and hold certain personal information about living individuals for the purposes of procuring and providing short term holiday lets by those Landlords. This may include personal information about current and past employees of Landlords; customers of Landlords; suppliers and others with whom we communicate and other third parties.
3.2. In providing these services, we will act as both a Data Processor and in some instances, as a Data Controller in respect of your personal information. In the cases where we are not the Data Controller, the Data Controller will be the relevant landlord.
4. How is your personal information collected?
We use different methods to collect personal information from and about you:
4.1. Directly from you: Typically the personal information that we collect about you will be the personal information that is input onto the Website. In some instances, however, it could be provided in other electronic formats, on application forms, or in other communications which may be in writing, by telephone, via the internet or by any other means.
4.2. From third parties: We will also gather personal information from other sources, including from Landlords.
5. What personal information will the Company hold about you?
5.1. Personal information means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
5.2. We may collect, use, store and transfer different kinds of personal information about you, as follows:
- full name and title
- contact information including email addresses and postal addresses, telephone numbers and fax numbers
- adverse credit and negative media
- date of birth
- identification or supporting documents (such as passport, driving license, birth certificate, utility bill etc.)
- IP address
- Gender
- bank details
- customer data
5.3. We do not collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data).
6. How will the Company use personal information held about you?
6.1. We will only use your personal information when the law allows us to.
6.2. We will use your personal data where we need to: (a) in order to meet our contractual obligations under our agreement with you; (b) where it is necessary for our legitimate interests (or those of a third party and your interests and fundamental rights do not override those interests); or (c) where we need to comply with a legal or regulatory obligation. In summary this means we use your personal information to enable us to facilitate the exchange of instructions, documentation and information between you and the landlord; establish, maintain and support the procurement and provision of short term holiday lets; and support the validation of information and data.
6.3. We do not rely on consent as a legal basis for processing your personal information other than in relation to sending third party direct marketing communications to you. You have the right to withdraw consent to marketing at any time by contacting us (see paragraph 1.3 for contact information).
6.4. Most commonly, we will use your personal information in the following circumstances and for the purposes of:
Purpose/Activity
The procurement and provision of short term holiday lets.
Lawful basis for processing
(a) Performance of a contract with you
Purpose/Activity
Internal record keeping
Lawful basis for processing
(a) Performance of a contract with you
(b) Necessary to comply with a legal obligation
(c) Necessary for our legitimate interests (to keep our records updated and to study how customers use our products/ services)
Purpose/Activity
Review by Landlords to update their records and to allow them to approve customers to use the Website
Lawful basis for processing
(a) Performance of a contract with you
Purpose/Activity
Undertaking checks with third parties
Lawful basis for processing
(a) Performance of a contract with you
(b) Necessary to comply with a legal obligation
Purpose/Activity
Assessing risks
Lawful basis for processing
(a) Performance of a contract with you
(b) Necessary to comply with a legal obligation
Purpose/Activity
Prevention and detection of crime (and the prosecution of criminal activities)
Lawful basis for processing
(a) Performance of a contract with you
(b) Necessary to comply with a legal obligation
(c) Necessary for our legitimate interests (for running our business)
Purpose/Activity
Sending promotional e-mails which we think you may find interesting (only with your express consent)
Lawful basis for processing
(a) Performance of a contract with you
(b) Necessary for our legitimate interests (to study how customers use our products/ services, to develop them and grow our business)
Purpose/Activity
Contacting you for market research purposes
Lawful basis for processing
(a) Performance of a contract with you
(b) Necessary for our legitimate interests (to study how customers use our products/ services, to develop them and grow our business)
Purpose/Activity
Compliance with applicable laws and regulations
Lawful basis for processing
(a) Necessary to comply with a legal obligation
Purpose/Activity
Processing payment for the purchase of products and/ or services
Lawful basis for processing
(a) Performance of a contract with you
(b) Necessary for our legitimate interests (to recover debts due to us and/ or the Landlords)
Purpose/Activity
Undertaking anti-money laundering, identity and credit checks
Lawful basis for processing
(a) Performance of a contract with you
(b) Necessary to comply with a legal obligation
Purpose/Activity
Monitoring negative media
Lawful basis for processing
(a) Performance of a contract with you
(b) Necessary for our legitimate interests (to study how customers use our products/ services, to develop them and grow our business)
Purpose/Activity
Providing this information to agents or subcontractors so that they can assist us with providing the Website and/ or the services
Lawful basis for processing
(a) Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise)
(b) Necessary to comply with a legal obligation
7. Change of purpose
7.1. We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
7.2. Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
8. Disclosure of your personal information
8.1. The Company may share the personal information that it has about you with Landlords and with any organisation the landlord may appoint to carry out the services in the future (collectively, the "Relevant Parties").
8.2. Your personal information may also be disclosed to the following parties:
- employees of the Relevant Parties
- affiliates of the Relevant Parties
- group companies of the Relevant Parties
- successors in title to the business of the Relevant Parties
- providers of IT solutions to the Relevant Parties
- third party consultants, contractors or other service providers who may access the personal information when providing services to the Relevant Parties (including but not limited to IT support services)
- government bodies, law enforcement agencies, regulatory bodies, legal societies, trade associations and in response to other legal or regulatory requests from similar third parties
- legal advisers, auditors, contractors or other advisers auditing, assisting with or advising on any of the business purposes of the Relevant Parties
8.3. If you give us personal information regarding another person, you are confirming they have given you permission to provide their personal information to us to be able to process their personal information and also that you have advised them that their personal information will be passed to the Company.
9. Will your personal information be transferred to other countries?
9.1. We may need to share personal information with third parties in both the UK and internationally for a variety of reasons. We require third parties to respect the security of your personal information and to treat it in accordance with the law. We may transfer your personal information outside the EU. If we do, you can expect a similar degree of protection in respect of your personal information.
9.2. We may transfer the personal information we collect about you to countries outside the EU in order to process your personal information on one of the grounds listed above. It is possible that the European Commission will have deemed such countries adequate. This means we can transfer your personal information to those countries as they will provide an adequate level of protection for your personal information.
10. What happens if you choose not to provide us with personal information or are unable to provide us with personal information?
10.1. If you fail to provide certain personal information when requested, we may not be able to perform the agreement we have entered into with you, or we may be prevented from complying with our legal obligations.
10.2. It is a requirement of many Landlords that the personal information is provided to allow them to consider and permit your requested booking. Therefore if you are unable or not willing to provide the required personal information, the booking may not proceed.
10.3. If you are unable or not willing to provide personal information this may also impact our ability to progress bookings via the Website.
11. What are your rights relating to the use of your personal information?
11.1. Under the GDPR, you have certain rights in respect of the processing of your personal information, which may vary dependent on the legal basis for collection of your personal information and the uses made of this personal information.
11.2. For all uses made of your personal information you have the right to be informed about how we use your personal information, and this notice discharges that obligation. However, further rights may apply in different circumstances, as set out below:
- Right of access: you have a right to access a copy of the personal information that is held about you (subject to Data Protection Laws).
- Right of rectification: you have a right to correct personal information that is held about you if it is inaccurate or incomplete.
- Right to be forgotten: in certain circumstances you can ask for the personal information held about you to be erased (please note our retention period set out below).
- Right to restrict processing: where certain conditions apply you have a right to restrict processing (please note this may impact our ability to provide our services to you).
- Right to data portability: you have the right to have the personal information held about you to be transferred to another organisation, where applicable the Company will provide copies of personal information in a structured commonly used, and machine readable form.
- Right to object: you have the right to object to certain types of processing, such as marketing (please note that we will only ever use your contact information for marketing purposes where you have provided express consent).
- Right to withdraw consent: In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact us (see paragraph 1.3 for contact information).
11.3. In the event you wish to exercise any of these rights, please make your request in writing to the Company’s Privacy Officer (see paragraph 1.3 for contact information).
12. How long will the Company retain your personal information for?
12.1. We will only retain your personal information for the duration of our agreement with you and for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
12.2. To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.
12.3. In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such personal information without further notice to you.
13. Security
13.1. We have put in place measures to protect the security of your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.
13.2. However the internet is not a secure medium but we are committed to ensuring that your personal information is secure. In order to prevent unauthorised access or disclosure we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the personal information we collect online. We will use our best efforts to ensure that no unauthorised parties have access to any of your personal information and we restrict access to non-public information about you to those individuals and entities that need to know the personal information to be able to provide products and services to you.
14. How we use cookies
Cookies are used on the Website. A cookie is a small file that is stored on your computer when you visit a website. If you visit the Website again, it is recognised as a repeat visit by means of the cookie. The cookie cannot be used to identify you on websites of third parties. The cookie helps analyse web traffic or lets you know when you visit a particular site. We use traffic log cookies to identify which pages are being used, which helps us analyse data about web page traffic and improve the Website in order to tailor it to customer needs. We only use this information for statistical analysis purposes and then the data is removed from the system. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us. You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. Some personalised services on the Website may not be available if you choose to disable cookies.
15. Links to other websites
The Website may contain links to enable you to visit other websites of interest more easily. However, once you have used these links to leave our Website, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and this Privacy Notice does not govern such sites.
16. Further information
16.1. In the event you have any questions about this Privacy Notice or wish to make a complaint about how your personal information is being processed by the Company you have the right to complain to the Privacy Officer (see paragraph 1.3 for contact information).
16.2. You have the right to make a complaint at any time to the relevant supervisory authority. The UK supervisory authority for data protection issues is the Information Commissioner’s Office (ICO).
17. Legal statement about this Privacy Statement
17.1. This Privacy Notice is not designed to form a legally binding contract. It is a guide to the use of the Website.
17.2. Use of the Website by you constitutes acceptance by you of the Privacy Notice. If you do not wish to accept the Privacy Notice, you should not continue to use the Website.
17.3. All calls made to and by us may be monitored or recorded.