For visitors, enquirers, newsletter subscribers and retreat owners
Last updated: 1 September 2026
| Plain-English summary: BLR is a directory, not a booking agent. We use personal information to operate the directory, respond to enquiries, pass an enquiry to the chosen retreat owner, communicate with owners, send marketing where permitted and keep the website secure. Visitors do not create BLR accounts and bookings are made directly with owners. |
1. Who we are
Boutique Luxury Retreats is operated by Hooley Time Limited (‘BLR’, ‘we’, ‘us’ or ‘our’), a company incorporated in England and Wales with company number 06702376. For the personal information described in this policy, Hooley Time Limited is normally the data controller.
Contact details:
- Email: info@boutiqueluxuryretreats.co.uk
- Postal address: Well Furlong, Little Comberton, Worcestershire, WR10 3EP
- Website: https://boutiqueluxuryretreats.co.uk
2. What this policy covers
This policy explains how we collect and use personal information when you browse our website, submit an enquiry, contact us, join our newsletter, participate in a promotion, communicate with us through social media or enquire about or purchase an owner listing or related marketing service.
BLR is an online directory. We do not provide visitor accounts or memberships and we do not take accommodation bookings on the BLR website. When you choose to enquire about a retreat using our form, we pass your enquiry to the relevant retreat owner. If you then make a booking, your contract is with that owner and the owner’s own privacy notice applies to the information they use for the booking.
Our website links to third-party websites. We do not control those websites and this policy does not cover their handling of personal information. Please read their privacy information before providing personal data.
3. Personal information we collect
Website enquiries
- Your name, email address and, if supplied, telephone number.
- Requested arrival and departure dates, retreat name and the content of your message.
- Your newsletter preference where a separate newsletter choice is offered.
- Technical and security information connected with submitting the form, such as IP address, time of submission and anti-spam results.
Newsletter and marketing
- Your email address and any name or preferences you choose to provide.
- Records of consent, subscription source, unsubscribe requests and engagement with our emails where the email platform provides this information.
Retreat owners and business contacts
- Names, job roles and business contact details.
- Property, listing, imagery, availability-link and marketing information.
- Communications, service selections, invoices and payment-status information. We do not need to publish private owner contact details unless this is agreed.
Website and device information
- IP address, device and browser information, pages viewed, referral source, approximate location, interaction data and cookie or similar identifiers.
- Consent choices, security events and diagnostic information.
Information you send to us
We also receive information when you email, telephone or message us, respond to a survey, enter a competition or contact us through social media. Please avoid including sensitive personal information in a general enquiry unless it is genuinely needed. If you provide accessibility or health-related information for an enquiry, we will use it only as necessary to respond to you and, where you request this, pass it to the selected owner.
BLR does not collect payment-card details for accommodation bookings because bookings and payments are made directly with retreat owners. If an owner pays BLR for a listing or marketing service, payment information may be handled by our bank or payment provider rather than stored in full by BLR.
4. How we collect information
- Directly from you, including through website forms, email, telephone, social media and owner communications.
- Automatically from your browser or device through essential website technology and, where you consent, analytics or marketing technology.
- From retreat owners, business partners and publicly available business sources where this is necessary to manage a listing, communicate with a business contact or keep directory information accurate.
5. How and why we use personal information
| Purpose | Information used | Lawful basis |
| Respond to and forward a retreat enquiry | Contact details, dates, retreat and message | Steps at your request before a possible contract with the owner; our legitimate interests in operating the directory |
| Operate and improve the website | Device, usage and diagnostic information | Our legitimate interests; consent where required for non-essential cookies |
| Send the BLR newsletter and promotional emails | Email, preferences, consent and engagement | Consent, or another permission allowed by electronic-marketing law where applicable |
| Manage owner listings and services | Owner contacts, listing information, communications and billing records | Performance of a contract; legitimate interests; legal obligations |
| Protect the website and prevent spam, fraud or misuse | Technical, form and security information | Legitimate interests; legal obligations |
| Maintain business and accounting records | Contracts, invoices, correspondence and transaction records | Legal obligations; legitimate interests |
| Establish, exercise or defend legal claims | Relevant enquiries, communications and records | Legal obligations and legitimate interests |
6. Marketing
We send marketing emails only where we have an appropriate legal permission. Where we rely on consent, the newsletter choice must be separate, optional, specific and unticked when presented with another form. You may unsubscribe at any time by using the link in an email or contacting us. We may retain a minimal suppression record so that we can respect your request not to receive further marketing.
We use GetResponse to host and manage the BLR newsletter database, subscription records, email campaigns, unsubscribe requests and email-performance information. For this activity, Hooley Time Limited remains the controller and GetResponse processes subscriber information on our instructions as a processor, although GetResponse may act as a separate controller for limited data it processes for its own account, security, legal-compliance and service-administration purposes. GetResponse’s current privacy information is available at https://www.getresponse.com/legal/max-privacy-policy.
Withdrawing marketing consent does not affect the lawfulness of processing before withdrawal, and it does not stop service messages that are genuinely necessary and are not promotional.
7. Who we share personal information with
We share personal information only where necessary and appropriate. Recipients may include:
- The retreat owner or operator selected in your enquiry. That owner becomes responsible for its subsequent use of the enquiry and any booking information.
- GetResponse S.A., which provides our email-marketing and newsletter-database platform and processes subscriber and campaign data for us.
- AmbroTech Ltd (ambrotech.co.uk), which provides website-hosting services for BLR, together with website maintenance, backup, form, consent-management, analytics, advertising, security and anti-spam providers acting for us or providing their own services.
- Professional advisers such as accountants, insurers, solicitors and IT advisers.
- Banks, payment providers and debt-recovery providers in connection with paid owner services.
- Regulators, courts, law-enforcement bodies or other parties where disclosure is required by law or reasonably necessary to protect rights, safety or security.
- A buyer, investor or successor in connection with a proposed or completed sale, merger or reorganisation of our business, subject to appropriate safeguards.
Current website and hosting technologies include services supplied by AmbroTech Ltd (ambrotech.co.uk), Google, Meta, Cloudflare, Complianz, Bricks and WPForms. Their involvement depends on the service, configuration and your consent choices. The Cookie Policy gives more information about website technologies.
8. International transfers
Some suppliers may process personal information outside the United Kingdom. Where we make a restricted transfer, we use a lawful safeguard such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another mechanism permitted by UK data-protection law. You may contact us for further information about the safeguards relevant to your data.
GetResponse S.A. is established in Poland. Its services may involve sub-processors or processing outside the UK or EEA. Where a restricted transfer occurs, BLR and/or GetResponse must use an applicable lawful transfer mechanism and appropriate safeguards. BLR should keep GetResponse’s data-processing terms, sub-processor information and transfer safeguards under review.
9. How long we keep information
We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting and dispute-resolution needs. Our working retention periods are:
- Retreat enquiries and ordinary correspondence: normally up to 24 months after the last meaningful contact, unless needed for a complaint, legal claim or ongoing relationship.
- Newsletter records held in GetResponse: while you remain subscribed; a minimal suppression record may be retained afterwards so that we can respect your opt-out. BLR should configure and periodically test deletion and suppression routines.
- Owner contracts, invoices and core accounting records: normally six years after the end of the relevant financial year or relationship.
- Owner listing and marketing working files: for the listing relationship and normally up to 24 months afterwards, unless continued retention is agreed or legally required.
- Cookie-consent records, security and technical logs: for the period reasonably needed to demonstrate consent, protect the site and investigate incidents, according to the relevant system settings.
We may retain anonymised information that no longer identifies an individual. These periods should be reviewed against BLR’s actual systems and deletion routines before publication.
10. Cookies and similar technologies
We use essential website technologies and, with your consent where required, analytics and marketing technologies. Please read our Cookie Policy for the categories, purposes, providers and controls. You can change your choices at any time through the Manage consent control on the website.
11. Security
We use reasonable technical and organisational measures designed to protect personal information against accidental or unlawful loss, alteration, disclosure or access. No internet service can be guaranteed completely secure. You should not send information through the website that is unnecessary for your enquiry.
12. Your rights
Depending on the circumstances, UK data-protection law may give you rights to:
- Ask for access to your personal information.
- Ask us to correct inaccurate or incomplete information.
- Ask us to erase information in certain circumstances.
- Ask us to restrict its use in certain circumstances.
- Object to processing based on legitimate interests and object at any time to direct marketing.
- Receive certain information in a portable format.
- Withdraw consent at any time where processing is based on consent.
- Complain to the Information Commissioner’s Office.
To exercise a right, email info@boutiqueluxuryretreats.co.uk. We may ask for information needed to verify your identity. Rights are not absolute and exemptions may apply.
13. Complaints
Please contact us first so that we can try to resolve your concern. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority.
Information Commissioner’s Office – make a complaint
14. Changes to this policy
We may update this policy when our services, suppliers or legal obligations change. We will publish the revised version on this page and change the ‘last updated’ date. We review this policy at least annually and whenever we add a new form, marketing tool, analytics service, supplier or material use of personal information
