This privacy policy governs the collection, storage and use of personal data collected by The Original Cottage Company Limited. The information may be gathered through our main website at, through one of our growing band of local websites, through affiliate partner websites, via a telephone conversation or through our normal business activities supporting the provision of cottage rental and associated services.

Specifically, this privacy policy provides you with details about the personal data we collect and hold about you, how we use your personal data, and your rights regarding the personal data we hold about you.

Please read this privacy policy carefully – by continuing to access or browse our websites, or by requesting the provision of services from us, you confirm that you have read and understood this privacy policy in its entirety.

This Privacy Policy supplements other notices and terms published on our website (including our terms of use (Terms)) and is not intended to override them.


We absolutely respect your right to privacy. Our overall aim is to ensure that our collection and use of personal data is appropriate to the provision of services to you and our clients and is in accordance with applicable data protection laws.

Further details of how we do so is set out in each section of our privacy policy as follows:

[return to top]

Who we are

The Original Cottage Company Limited is the data controller of the personal data that we collect from you. It is a company registered in England and Wales (registration number 06951692), whose registered office is at Bank House, Market Place, Reepham, Norwich, NR10 4JJ.

You can contact us in relation to this privacy policy by email at .

[return to top]

The personal data we collect about you

If you sign up to join our mailing list we will collect your name and email address, together with your consent to receive communications from us. This consent can be removed at any time simply by using the unsubscribe button on any of our email communications.

We may share your email address or browsing behaviour with technology providers including Google, Facebook and Microsoft (as data processors). They may use this information to serve targeted advertising/content to you via their platforms. This is based on either your marketing consent or your acceptance of cookies on our websites. For more information please see our Cookie Policy.

If you are, or work for, a supplier to The Original Cottage Company Limited, then we will collect the minimum amount of business specific personal data, usually your name, business role and business contact details to enable us to manage the business relationship.

If you are, or work for, a business customer of The Original Cottage Company Limited, then we will collect the minimum amount of business specific personal data, usually your name, business role and business contact details to enable us to manage the business relationship.

If you are considering applying for a job with us or have already applied for a job, please refer to the Applying for a job at The Original Cottage Company section of this Privacy Policy.

[return to top]

How we store, use and share your personal data for our core business

Individuals who join our mailing list

You will receive marketing communications from us if you have requested information from us or purchased goods or services from us and, in each case, you have not opted out of receiving that marketing. You will also receive marketing communications from us if you have provided us with your details when you entered a competition or registered for a promotion and gave us your consent as part of that process. As such, we may contact you with details of our properties, services, offers and other marketing items which we believe will be of interest or potential benefit. We do not believe that this storage and use of your personal data will unduly prejudice your rights or freedoms. You can remove your consent at any time using the unsubscribe button on any of our email communications to you.

Business partners

We collect, store and use the business contact details of individuals working with our business partners for our legitimate business interests in maintaining and managing the commercial relationship between The Original Cottage Company Limited and its commercial suppliers and customers. We do not believe that this storage and use will unduly prejudice the rights or freedoms of these individuals.

All other users of the sites and our services

We collect, store and use your personal data for the following purposes:

  • to make the sites available to you; and
  • to provide any services that you request.

Sometimes, our use of your personal data is for purposes which are ancillary to the provision of the sites and services, or which are desirable in order to make them to operate more effectively. In those circumstances, we believe we have a legitimate business interest in handling your personal data, and do not believe that this storage and use of your personal data will unduly prejudice your rights or freedoms.

The relevant circumstances are:

  • detecting and preventing fraud;
  • keeping our websites, apps, products and IT systems secure;
  • ensuring that our own processes, procedures and systems are as efficient as possible;
  • analysing and enhancing the information that we collect;
  • determining the effectiveness of our promotional campaigns and advertising; and
  • if you have joined our mailing list and you have given us your consent, contacting you (including by SMS and email) with products and services which we think may interest you.

Anonymous data

We also collect anonymised details about visitors to our websites for the purposes of generating site statistics, reporting purposes or improving our website and marketing effectiveness.  However, no single individual will be identifiable from the anonymised details we collect for these purposes.

 [return to top]

How we might otherwise share your personal data and who we share it with

We will disclose information under the following circumstances:

  • Third-party service providers: When we share information with third-party service companies for them to facilitate or to provide certain services on our behalf. This will include:
    • IT support service providers;
    • third-party service providers who track our customers’ use of the sites and our services for us.
    • other third-parties who we may need to work with to deliver services and/or facilitate your booking and holiday (including any holiday extras), for example, providers of property management services (including, but not limited to, housekeeping, property maintenance etc).

These third-parties are contracted to use your personal data only as necessary to provide the relevant services to us and are required to maintain full security and confidentiality.

  • Compliance with laws and legal proceedings: When we respond to court orders, or legal process, or to establish or exercise our legal rights or defend against legal claims. When we believe it is necessary to share information in order to investigate, prevent or take actions against illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, violations of our terms of use, or as otherwise required by law.
  • Merger or acquisition: When we need to transfer information about you if we are acquired by or merged with another company.  If we are involved in a merger, acquisition, or sale of all or a portion of its assets, you will be notified by email and/or a prominent notice on our sites of any change in ownership or uses of your personal data, as well as any choices you may have regarding your personal data. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this Privacy Policy.

In some, relatively limited, circumstances we need to handle your personal data in a certain way to be able to comply with our legal obligations – for example: if we are requested to disclose your personal data to regulatory bodies or if we need to demonstrate our compliance with applicable law such as any tax and national insurance legislation relating to the payment of personal service company contractors and immigration law.

[return to top]

International transfers

All of our core cottage rental business systems store and process data within the European Economic Area (EEA). However, some of our internal management systems use international service providers who may carry our processing outside of the EEA. This processing is carried out in the USA and, if affected, your data is protected to the same standards required by UK legislation by use of the EU – US Privacy Shield Framework. If you would like more details on this, please contact us using

[return to top]


Technologies such as cookies, beacons, tags and scripts are used by us and our affiliates, or analytics or service providers. These technologies are used in analysing trends, administering the sites, tracking users’ movements around the sites and to gather demographic information about our user base as a whole. We may receive reports based on the use of these technologies by these companies on an individual as well as aggregated basis.

We use cookies, for example, to remember users’ settings (e.g. language preference) and for authentication. Users can control the use of cookies at the individual browser level. If you reject cookies, you may still use our sites, but your ability to use some features or areas of our sites may be limited.

Please read more about how we use cookies and what information is collected using cookies in our Cookies Policy.

[return to top]


We employ comprehensive, reasonable and appropriate security measures to protect against the loss, misuse, and alteration of the personal data we process. This includes organisational security (passwords and access controls), physical security (data centre protection) and IT security (encryption).  Please note that no transmission over the Internet can ever be guaranteed secure and as a consequence please note that we cannot guarantee the security of any personal data that you transfer over the Internet to us.

[return to top]

Data Retention

We retain information (including personal data) for the minimum reasonable time period to allow us to provide our services and will delete it after that time. The only exceptions are in cases where we need to keep limited personal data to comply with our legal obligations, resolve ongoing disputes, or enforce our agreements.

Should you require more detail about our retention timescales for a specific category of data or information please contact us at

[return to top]

Your rights

You have certain rights in relation to your personal data. If you would like further information in relation to these or would like to exercise any of them, please contact us at at any time. You have the right to request that we:

  • provide access to any personal data we hold about you;
  • update any of your personal data which is out of date or incorrect;
  • delete any personal data which we are holding about you;
  • restrict the way that we process your personal data;
  • prevent the processing of your personal data for direct-marketing purposes;
  • provide your personal data to a third-party provider of services;
  • provide you with a copy of any personal data which we hold about you; or
  • consider any valid objections which you have to our use of your personal data.

We will consider all such requests and provide our response within a reasonable period (and in any event within any time period required by applicable law). Please note, however, that certain personal data may be exempt from such requests in certain circumstances.

If an exception applies, we will tell you this when responding to your request.  We may request you provide us with information necessary to confirm your identity before responding to any request you make.

[return to top]

Applying for a job at The Original Cottage Company

When you apply for a job with us, we collect and process a range of personal data in order to assess your suitability for employment. You are under no statutory or contractual obligation to provide data to us during the recruitment process. However, if you do not provide the information, we may not be able to process your application properly or at all.

We ask for:

  • personal details including name and contact details
  • details of your qualifications, skills, experience and employment history
  • information about your current level of remuneration, including benefit entitlements

The legal basis we rely upon for processing your personal data is article 6(1)(b) of the GDPR, which relates to processing necessary to perform a contract or to take steps at your request, before entering a contract.

We will also ask whether or not you have a disability for which the organisation needs to make reasonable adjustments during the recruitment process. The legal bases we rely upon for this are article 6(1)(c) of the GDPR which allows us to process information to meet a legal obligation and article 9(2)(b) as the processing is necessary for the purposes of carrying out our obligations in the field of social security and social protection law.

You may also be asked to provide equal opportunities information including information about your ethnic origin, sexual orientation, health, and religion or belief. This is not mandatory – if you don’t provide it, it won’t affect your application. This is done for the purposes of equal opportunities monitoring only and we won’t make the information available to any staff outside our recruitment team, including hiring managers, in a way that can identify you. The legal bases we rely upon are article 6(1)(a) and 9(2)(b) which require your explicit consent.

In some cases, we need to process data to ensure that we are complying with our legal obligations. For example, it is required to check a successful applicant’s eligibility to work in the UK before employment starts. It these situations the legal basis we rely upon is article 6(1)(c) of the GDPR which allows us to process information to meet a legal obligation.

When we make a job offer we will also seek information from third parties, such as references supplied by former employers and information from employment background check providers. For some roles, we are legally obliged by safeguarding legislation to conduct criminal records checks. This usually applies to roles that may involve working with minors. The legal basis we basis we rely upon is article 6(1)(c) of the GDPR which allows us to process information to meet a legal obligation.

Sharing your information

Your information will be shared internally for the purposes of the recruitment exercise. This includes members of the HR team, interviewers involved in the recruitment process, managers in the business area with a vacancy and IT staff if access to the data is necessary for the performance of their roles.

We will not share your data with third parties, unless your application for employment is successful and we make you an offer of employment. The organisation will then share your data with former employers to obtain references for you and employment background check providers to obtain necessary background and criminal records checks.

Keeping your information

If you are unsuccessful after assessment for the role, we will hold your data on file for 6 (six) months after the end of the relevant recruitment process. At this point your data will be deleted unless you have told us that you would like your details retained in our talent pool. If this is the case, then we would proactively contact you should any further suitable vacancies arise.

If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your personnel file and retained during your employment. The periods for which your data will be held will be provided to you in our employee privacy notice.

[return to top]

Third party sites

Our websites contain links to other websites operated by third parties.  Please note that this privacy policy applies only to the personal data that we collect through our sites or services, and we cannot be responsible for personal data that third parties may collect, store and use through their website.  You should always read the privacy policy of each website you visit carefully.

[return to top]

Changes to this Privacy Policy

This privacy policy was last updated in August 2019.

Please check back regularly to keep informed of updates to this privacy policy. Where we make significant changes to this privacy policy, and we have your email address, we will send you notification of the changes.

[return to top]

Complaints, questions and suggestions

We have a Data Protection Officer to assist with all queries regarding our processing of personal data who can be contacted via

If you have any complaints, questions and suggestions about our sites or services, please contact us at

In the EEA, you may also make a complaint to our supervisory body for data protection matters (the Information Commissioner’s Office in the UK) or seek a remedy through local courts if you believe your rights have been breached.

[return to top]