Privacy Policy
Fleece & Woodland Retreats Ltd
Fleece and Woodland Retreats Ltd ("we", "our", "us") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our Website at www.fleeceandwoodlandretreats.com (the "Website") in accordance with data protection laws (which includes the European General Data Protection Regulation (GDPR), as amended and/or incorporated into the laws of the United Kingdom of Great Britain and Northern Ireland (UK), if applicable and other applicable EU, Member State and UK laws). Please read this Privacy Policy carefully. By accessing our Website or doing business with us, you confirm you have read and understand our Privacy Policy. For any data protection inquiries or queries related to this Privacy Policy, please use the contact details provided in this policy.
At Fleece & Woodland Retreats Ltd, we believe that respecting your privacy is part of the care we offer our guests.
When you visit our website, make an enquiry, join our mailing list, book a retreat, workshop or event, or attend one of our experiences, you may share personal information with us. Some of this information may be sensitive, particularly where you tell us about health conditions, allergies, dietary requirements, accessibility needs or other circumstances that may affect your stay or participation.
This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, who it may be shared with, and your rights.
It applies to information collected through our website, booking and enquiry processes, email communications, mailing lists, questionnaires and participation in our retreats, workshops and events.
Who we are
Fleece & Woodland Retreats Ltd is the organisation responsible for deciding how and why your personal information is used and is the data controller for the purposes of UK data protection law.
Fleece & Woodland Retreats Ltd Registered office: Unit 6 Parc Pensarn, Carmarthen, SA31 2NF Company number: 17261564 Email: hello@fleeceandwoodlandretreats.com
Our website is built and hosted using Squarespace. Squarespace provides the technology that allows us to operate our website and may process certain information on our behalf when you visit or interact with it. More information about this is provided below.
Personal data we collect and process
"Personal data" means any information relating to an identified or identifiable natural person ('data subject'). We collect and process various types of personal data depending on our interactions with you. This may include:
Contact and identification information Your name, postal address, email address and telephone number.
Booking information
Details relating to your chosen retreat, workshop or event, accommodation or room selection, booking preferences and other information necessary to administer your booking.
Payment and transaction information Information connected with payments, deposits, refunds and purchases. Payment card details are normally processed securely by our payment provider rather than being stored directly by Fleece & Woodland.
Communications , Emails, enquiries, feedback and other correspondence between you and us.
Emergency contact information Where appropriate, we may ask you to nominate an emergency contact for use if there is a genuine concern for your safety or wellbeing.
Dietary and accessibility information
This may include allergies, food intolerances, dietary requirements, disabilities, mobility requirements or other adjustments that will help us provide a safe and comfortable experience.
Health and wellbeing information
Some of our retreats and workshops may include activities such as walking, forest bathing, swimming or river dipping, sauna or hot-tub use, craft activities and the use of relevant tools and equipment.
Where necessary, we may ask you to tell us about health conditions, disabilities, injuries, allergies, medication or other relevant circumstances that could affect your safe participation.
We will only ask for information that is reasonably necessary. We do not require a complete medical history.
Marketing preferences
If you choose to join our mailing list, we will keep your name, email address and relevant communication preferences. You may unsubscribe at any time.
Photographs and video We may take photographs or video during our retreats, workshops and events for use by Fleece & Woodland Retreats Ltd, Calon Yarns and Nellie & Eve Plant Dyed Yarns in our websites, newsletters and promotional or social-media material.
We will make guests aware when photography or filming is taking place and will respect anyone who does not wish to appear.
Information collected through our website
Our website is hosted by Squarespace.
When you visit the website, certain technical information may be collected automatically. This can include your IP address, browser and device information, pages visited, how you arrived at the website and information about how you interact with it.
Squarespace may process this information to provide, protect and improve the website and its services, prevent fraud and abuse, and provide website analytics.
If you submit information through a website form, subscribe to our mailing list, make an enquiry or complete a booking or purchase, Squarespace may process that information in order to provide the relevant website functionality to us.
Squarespace may also use cookies and similar technologies necessary for the website to operate and, where permitted, to help us understand how visitors use our website.
Third-Party Services
We may collect and process your data with trusted third-party service providers who assist us in operating our Website, conducting our business, or providing our services to our users, so long as those parties agree to keep this information confidential. Our Website is hosted by a third-party service provider called Squarespace.
Customer Account, Member Site Subscribers, Online Stores or Donations If you create an account or purchase a membership on our Website, we collect personal data from you to enable your access. We may collect information like your:
Billing and shipping address
Details relating to your subscription or orders
Email address
Name
Phone number
We may email you with messages about your transaction or account activity. For example, we may email you to tell you that:
You've created a customer account
Your customer account password has been reset or updated
You've made a purchase
Your order has shipped
As these are transactional messages, it's not possible to unsubscribe from these messages. As you go through checkout, this site may auto-complete your shipping and billing address by sharing what you type with the Google Places API and returning suggestions to you to improve your checkout experience.
Squarespace Payments When you make a purchase from us on this website, we use Squarespace Payments as our payment solution. Squarespace Payments is a fully integrated, native payment solution provided to us by our third-party service provider Squarespace. Squarespace Payments makes use of the following third-party service providers which will also receive your personal data and process it in accordance with their privacy policies:
Stripe - payment processing services. You can read Stripe's privacy policy.
Sift - fraud monitoring and detection services. You can read Sift's privacy policy.
Invoicing
We use branded invoices to collect payments. We may collect information like your:
Email address
Invoice details (for example, line items)
Name
Payment history
Taxes We use automated taxes to confirm applicable tax rates and we may collect information like your:
Billing and shipping address
Details relating to your purchase (for example, Product Tax Codes for the items purchased)
Name
Form Blocks
When you submit information to this Website via webform, we collect the data requested in the webform in order to track and respond to your submissions. We provide this information to Squarespace, our third-party Website service provider, so that they can provide website services to us and help us manage our relationship with you.
Abandoned Cart Emails
You'll receive an automated email within 24 hours after you abandon your shopping cart, if all of the following occur:
You enter your email address at checkout, or are logged into your customer account.
You add a product which is in stock to your shopping cart.
You close your browser or leave this website without completing your purchase.
You can unsubscribe from these messages at the bottom of the email.
The email will link back to this Website, where you can pick up where you left off and complete your purchase.
Marketing Emails | Campaigns
We may send you marketing emails, which you can unsubscribe from by clicking the link at the bottom of the email.
Special Categories of Personal Data:
We generally prohibit the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation. We will only process such special categories of personal data if one of the specific exceptions under Article 9(2) of the GDPR applies, for example:
You have given explicit consent for one or more specified purposes.
It is necessary for reasons of substantial public interest, based on Union or Member State law, with suitable and specific measures to safeguard your rights and interests.
It is necessary for the purposes of preventive or occupational medicine, medical diagnosis, health or social care, or the management of health/social care systems and services, processed by a professional subject to professional secrecy obligations.
The data has been manifestly made public by you.
Cookies and analytics
Cookies are small files placed on your device when you visit a website.
Some cookies are necessary for our website to function properly. Others may help us understand how visitors use our website, remember preferences or improve the experience we provide.
Where required, you will be given the opportunity to manage non-essential cookies through our website's cookie settings or consent banner.
Information collected through analytics is used to understand general patterns of website use rather than to identify individual guests unnecessarily.
You can also control or delete cookies through your browser settings.
Why we use your information
We use personal information only where we have a lawful reason to do so. This may include:
administering enquiries, bookings, payments and refunds;
providing the retreat, workshop or experience you have booked;
arranging accommodation, meals and activities;
communicating important information about your booking;
protecting the health, safety and wellbeing of guests and staff;
making reasonable accessibility arrangements;
managing our business and maintaining appropriate records;
complying with legal, accounting, insurance and regulatory requirements;
improving our website, retreats and services;
responding to enquiries or complaints; and
sending marketing communications where you have chosen to receive them.
Depending on the circumstances, our legal basis may be that processing is necessary to fulfil our contract with you, meet a legal obligation, pursue our legitimate business interests, protect someone's vital interests, or because you have given us consent.
Sensitive information
Information about health, disability and certain dietary or accessibility requirements can be classed as special category personal data under UK data protection law and receives additional protection.
We will only collect this information where it is relevant to your safety, wellbeing, dietary needs, accessibility or participation in an activity.
Access will be limited to those who genuinely need the information, such as retreat organisers, activity leaders, catering staff or other relevant professionals.
For example, a chef may need to know that a guest has a serious food allergy but would not normally need access to unrelated health information.
In an emergency, relevant information may be shared with medical or emergency professionals where necessary to protect someone's health or safety.
Workshops, activities and equipment
Our retreats and events may include practical workshops and activities involving tools, equipment, materials, processes, outdoor environments or other activities requiring particular safety considerations.
Appropriate information, instruction or guidance will be provided where relevant.
If a health condition, disability, allergy, injury or other circumstance could affect your safe participation, we may ask for enough information to understand whether an adjustment is required.
This information will only be used for the purposes of providing a safe and appropriate experience.
Who we may share information with
We do not sell your personal information.
Where necessary, information may be shared with trusted organisations or individuals helping us provide our services, including:
Squarespace, which hosts and supports our website;
secure payment providers;
accommodation or venue providers;
chefs, caterers and food providers;
workshop tutors and activity leaders;
massage therapists or other independent practitioners where relevant;
IT, website, email and administrative service providers;
professional advisers, insurers or accountants; and
emergency services or medical professionals where necessary.
We only share information that is reasonably required for the particular purpose.
Independent practitioners, such as massage therapists, may operate under their own privacy policies where you book directly with them.
Squarespace and international data transfers
Squarespace is a global technology company and information processed through our website may be stored or processed outside the United Kingdom.
Where personal information is transferred internationally, Squarespace states that it uses appropriate legal safeguards for international data transfers, such as recognised adequacy arrangements and contractual protections where applicable.
Squarespace operates under its own privacy and data-protection arrangements in relation to the services it provides.
You can read more about how Squarespace handles personal information in the Squarespace Privacy Policy, available through the Squarespace website.
Legal basis to process your personal data
We process your personal data for specified, explicit, and legitimate purposes. The legal bases for our processing activities are as follows:
Your Consent: We will process your personal data when you have given us clear, affirmative consent for one or more specific purposes. For example, for sending you marketing communications, or for certain types of cookies. You have the right to withdraw your consent at any time. The withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.
Performance of a Contract: Processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract. For example, to provide you with the services or goods you have requested.
Compliance with a Legal Obligation: Processing is necessary for compliance with a legal obligation to which we are subject.
Protection of Vital Interests: Processing is necessary in order to protect your vital interests or those of another natural person. This applies in emergency situations, such as to protect your life or physical integrity.
Performance of a Task Carried Out in the Public Interest or Exercise of Official Authority: Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us. The purpose of such processing will be determined by Union or Member State law.
Legitimate Interests: Processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms, especially if you are a child. Our legitimate interests include:
Improving our services and products: To understand how our services are used and to enhance their functionality and user experience.
Marketing our products and services: To inform you about our offerings that may be of interest to you.
Preventing fraud and ensuring network security: To protect against unauthorised access, malicious code distribution, and other cyber threats.
Internal administrative purposes: For processing client or employee data within our group of undertakings.
Processing by public authorities in the performance of their tasks is not based on legitimate interests.
How we disclose your information
As part of the services we provide, we may disclose information about you to third parties, on your behalf to provide the services request, for legitimate purposes, legal obligation and by your consent in accordance with this Privacy Policy. We only share your information with service providers to help run our business. This may include:
Squarespace and other vendors. Squarespace and other vendors assist us in providing the services (e.g. website hosting, scheduling, order processing, invoicing, transacting, payment processing, shipping, customer accounts or subscriptions, form blocks). Please see below for more information about our platform provider, Squarespace.
Payment Processing. We transmit your payment information via an encrypted connection to our payment processors, to enable us to operate and provide the payments services.
Customer support vendors. These vendors assist us in hosting our support offerings.
Safety and security vendors. These vendors enable us to keep our services safe and secure.
Sales and marketing vendors. These vendors assist us in sending marketing and other communications.
Third party plugins and social networks. We may disclose information about you to other parties that operate website plugins, social media platforms or similar third party services to improve your experience, at your direction, or when you intentionally interact with the plug-in.
Your Consent.
When you provide us with a direction or request to provide certain information to a third party.
Following the law or protecting rights and interests. We disclose your information if we determine that such disclosure is reasonably necessary to comply with the law or law enforcement, protect our or others' rights, prevent fraud and abuse, or prevent other criminal or illegal activity.
Corporate group. With affiliates to within our company group.
How long we keep information
We keep personal information only for as long as it is reasonably required for the purpose for which it was collected and to meet relevant legal, accounting, insurance or regulatory obligations.
Routine booking and financial records may need to be retained for several years.
Sensitive health, dietary and accessibility information will not normally be retained longer than necessary for the relevant retreat, workshop or event unless there is a legitimate legal, safeguarding, insurance or record-keeping reason to do so.
Marketing information will normally be retained until you unsubscribe or ask us to stop contacting you.
Keeping your information safe
We use reputable service providers such as Squarespace and our payment providers, to help us operate our website and booking systems securely.We implement appropriate technical and organisational measures to ensure the appropriate level of security and confidentiality for the personal data we process. This includes protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage. Our measures include, but are not limited to:
Using SSL certificates (HTTPS) to encrypt data shared between our Website and servers.
Implementing strong password policies for administrative accounts.
Minimising the collection of personal data to only what is necessary for our stated purposes.
Access to sensitive guest information is restricted to those who need it to perform their role.
While we strive to protect your personal data, no method of transmission over the Internet or method of electronic storage is 100% secure. Therefore, we cannot guarantee its absolute security.
Your Data Protection Rights
Under data protection laws in the European Economic Area and the UK, you have several important rights regarding your personal data. We are committed to facilitating the exercise of these rights. These rights include:
Right to be Informed: You have the right to receive clear, transparent, and easily understandable information about how we use your personal data and your rights. This Privacy Policy aims to provide you with this information.
Right of Access: You have the right to obtain confirmation as to whether or not personal data concerning you is being processed, and, where that is the case, access to the personal data and certain information about the processing, free of charge.
Right to Rectification: You have the right to have inaccurate personal data concerning you rectified without undue delay. You also have the right to have incomplete personal data completed, including by means of providing a supplementary statement. If we have shared incorrect data, we will inform recipients of the change where possible.
Right to Erasure: In certain circumstances, you have the right to ask us to erase your personal data without undue delay, for example, if the data is no longer necessary for the purposes for which it was collected or if you withdraw consent and there is no other legal ground for processing. We are not obliged to erase data if processing is necessary for exercising the right of freedom of expression and information, compliance with a legal obligation, reasons of public interest (e.g., public health, scientific/historical research), or for the establishment, exercise, or defence of legal claims.
Right to Restriction of Processing: You have the right to request the restriction of the processing of your personal data in certain situations (e.g., if you contest the accuracy of the data, or the processing is unlawful but you oppose erasure).
Right to Data Portability: Where processing is based on consent or a contract, and is carried out by automated means, you have the right to receive the personal data concerning you in a structured, commonly used, and machine-readable format and have the right to transmit those data to another controller without hindrance from us. This includes data you provided and data observed from your behaviour.
Right to Object: You have the right to object, at any time, to the processing of your personal data for direct marketing purposes, or when processing is based on our legitimate interests or for a task in the public interest, unless we demonstrate compelling legitimate grounds for the processing that override your interests. In the case of direct marketing, we are always obliged to stop processing your personal data if requested.
Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. The process for withdrawing consent should be as easy as giving it.
Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority, particularly in the EEA Member State or the UK of your habitual residence, place of work, or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the data protection laws in the EU or the UK. You also have the right to raise a concern with the Information Commissioner's Office (ICO), the UK's independent data-protection regulator.
To exercise any of these rights, please contact us using the contact details provided in this Privacy Policy. In accordance with applicable laws, we may be required to verify your identity or request additional information prior to processing your request.
SQUARESPACE Platform
Our Website and certain services we provide are hosted by Squarespace. Squarespace, as our processor collects and processes personal data for the purpose of providing the services to us and to improve the services to you. Squarespace may also act as an independent controller for some personal data relating to your use of the services and is responsible for processing such personal data in compliance with applicable laws. Please see Squarespace Privacy Policy for details relating to your end user site usage information, for which they act as an independent controller. We share personal data and other information with Squarespace as part of the services they provide to us.
Data Transfers
As our Website is hosted by Squarespace, a U.S.-based company, certain personal data may be transferred outside the European Economic Area (EEA) or the United Kingdom (UK) (a "third country") or to an international organisation and transferred to and stored in the United States. In accordance with applicable data protection laws in the EEA and UK, Squarespace relies upon a number of means to transfer personal data. These include:
Adequacy decision. In accordance with Article 45 of the GDPR, a country that European Commission, UK or Swiss data protection supervisory authority(ies) have confirmed, by decision, offers an adequate level of data protection (adequacy decision).
Data Privacy Frameworks. Transfer of personal data to Squarespace, Inc. in the US from, as applicable, the EEA, Switzerland and the UK pursuant to the Data Privacy Frameworks. An adequacy decision was adopted for the EU-U.S. Data Privacy Framework, Swiss-US Data Privacy Framework and the UK Extension to the EU-US Data Privacy Framework (each individually and jointly, the Data Privacy Frameworks).
Standard data protection clauses ("SCCs") and other transfer methods. For countries without an adequacy decision, in accordance with Article 46 of the GDPR, recipients may enter the approved form of transfer contract (SCCs) for the transfer of personal data outside the EEA or UK.
Children
Our retreats and services are primarily intended for adults.
Where an event is open to participants under the age of 18, appropriate consent and information will be obtained from a parent or legal guardian where required.
We do not knowingly use children's personal information for marketing without appropriate consent.
Links to other websites
Our website may contain links to external websites or services.
Once you leave our website, the way your information is collected and used will be governed by the privacy policy of the organisation operating that website. We are not responsible for the privacy practices of independent third-party websites.
Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our services, website, legal obligations or the technology we use.
The latest version will always be published on our website with the date it was last updated.
Contact us
If you have any questions about this Privacy Policy or how we use your personal information, please contact:
Fleece & Woodland Retreats Ltd, Unit 6 Parc Pensarn, Carmarthen, SA31 2NF