This policy explains what personal data we collect through this website (winslademanor.com), why we collect it, who we share it with and how long we keep it. “We”, “us” and “Winslade Manor” mean Winslade Park Estate Limited, trading as Winslade Manor, company number 15863576, registered office Winslade House, Manor Drive, Clyst St Mary, Exeter EX5 1FY. We are the controller of your personal data for the purposes of UK data protection law.
1. What we collect, why, and how long we keep it
Table bookings — through DesignMyNight
How it works: our “Book a Table” buttons use a booking service run by DesignMyNight (Access UK Ltd). You complete your booking on DesignMyNight’s system, and it comes through to us.
What we collect: your name, email address, phone number, booking date, time and party size, and anything you add (such as dietary requirements or an occasion).
Why: to take and manage your booking, contact you about it, and prepare for your visit.
Lawful basis: contract — we need these details to provide the booking you’ve asked for. If you tell us about allergies or dietary needs, we use that information only to cater for you safely, and with your explicit consent.
How long we keep it: up to 2 years after your visit.
After you book: you return to a short page on our site asking how you heard about us. Answering is optional, and your answer isn’t linked to your booking. It’s stored on this website without your name or contact details, unless you also choose to join our mailing list on the same page. We look at the answers only as totals, to understand which of our marketing works (legitimate interests), and keep them for up to 12 months.
Tickets for events — through our online shop
What we collect: your name, email address, phone number, billing address, the tickets you buy and attendee names where an event needs them.
Why: to process your order, issue your tickets, and contact you about the event (for example if timings change).
Lawful basis: contract. We keep order and payment records to meet our accounting and tax obligations (legal obligation).
Payments: card payments are taken by Stripe. Your card details go directly to Stripe; we never see or store your full card number.
How long we keep it: order records for six years from the end of the financial year they relate to, as required for accounting and tax purposes.
Customer accounts — closing on 25 October 2026
Background: customers used to be able to create an account on our online shop. We’ve stopped offering accounts, and you don’t need one to buy tickets. Existing accounts will be closed and deleted on 25 October 2026, and we’re emailing account holders to let them know.
What an account holds: your name, email address, password (stored in a scrambled form that we can’t read), the billing and delivery details you saved, and a list of your past orders.
Why: to let you sign in, reuse your details at checkout and see your order history.
Lawful basis: contract — providing the account you opened.
How long we keep it: until the closure date above. Closing your account deletes your login and saved details. Records of past orders are kept for six years, as described under Tickets for events above.
Enquiries — through our contact and events forms, by email or by phone
What we collect: your name, email address, phone number, anything you include in your message, and how you heard about us (optional).
Why: to answer your enquiry and, for parties and events, to prepare a quote and arrange your booking.
Lawful basis: legitimate interests — responding to an enquiry you’ve made — and, where you’re asking about a booking, taking steps at your request before entering into a contract.
How long we keep it: copies held on the website itself are deleted after 14 days. The enquiry and our replies are kept in our mailbox for up to 2 years after our last contact, because party and event bookings are often made many months ahead and we need a record of what we quoted. If you book with us, the booking periods above apply.
Our mailing list
What we collect: your name and email address, the date you signed up and where on the site you did so.
Why: to send you news, special events and offers from Winslade Manor.
Who sends it: our newsletters are sent on our behalf by our sister company, Winslade Park Limited, which holds our mailing list (see section 3).
Lawful basis: consent — you choose to sign up, by ticking a box or using our sign-up form.
Unsubscribing: every email has an unsubscribe link, or you can contact us. We keep a record of your email address after you unsubscribe so that we don’t email you again.
Email statistics: our newsletters count how many times they are opened and which links are clicked, so we can see what’s useful. These are totals only — we don’t record whether you personally opened an email or clicked a link. Opens are counted by a small image in the email; you can prevent this by turning off images in your email app.
How long we keep it: until you unsubscribe.
2. Cookies and similar technologies
When you first visit, we ask whether you’re happy for us to use marketing cookies. Nothing that needs your permission runs until you say yes, and you can change your mind at any time using the Privacy settings link at the foot of every page.
Essential. Some storage is needed for the site to work and is used without asking: keeping the site secure (Cloudflare Turnstile, which protects our forms from spam), your basket and checkout (WooCommerce and Stripe), the table-booking widget (DesignMyNight), and remembering your cookie choice.
Marketing — only with your consent. If you accept, we use Google Ads and the Meta Pixel (Facebook and Instagram) to measure whether our adverts lead to bookings and ticket sales, and so that those platforms can show our adverts to people likely to be interested. If you decline, neither loads.
Full details of every cookie and similar item, including how long each lasts, are in our .
Our website analytics doesn’t use cookies at all — see section 3.
3. Who has access to your data
We use trusted providers to run the website and our bookings. They act on our instructions and only as needed to provide their service:
HLB Solutions, who build, maintain and arrange hosting for this website. In the course of that work they may have access to the personal data held on it.
Webnestify s.r.o. (Slovakia), who provide the hosting, on servers operated by Hetzner Online GmbH in Germany.
QUIC.cloud (QUIC Cloud Inc), which delivers the website’s pages quickly from servers near you.
DesignMyNight (Access UK Ltd, Loughborough), for table bookings. When you’re on DesignMyNight’s booking pages, their own privacy policy also applies.
Stripe (Stripe Payments UK Ltd, London), for card payments. Stripe also uses some payment data for its own purposes, such as preventing fraud and meeting its legal obligations, under its own .
Cloudflare, for Turnstile, which checks that form submissions come from a person rather than a bot. Cloudflare also uses some of this data to improve its bot detection, under its own privacy policy.
Maileroo, which delivers the emails our website sends, such as booking and enquiry confirmations.
Amazon Web Services (Amazon SES), which delivers our newsletters from servers in London.
Plausible Analytics, for website statistics — see below.
Google and Meta. If you accept marketing cookies, Google and Meta receive information about your visit (such as the pages you view and whether you made a booking or purchase) together with identifiers set in your browser. When you buy tickets, Google also receives your email address in a scrambled form (known as hashing) so that it can match the purchase to a Google account and tell us more accurately whether our adverts led to it. Google can’t turn the scrambled version back into your email address, but it can match it to an account that uses the same address. Google and Meta use this information for their own purposes as well as ours, under their own privacy policies: and . Apart from that scrambled email address, we don’t send them your name, email address or other details you give us.
Our sister company. Winslade Manor and Winslade Park are separate companies with the same owners and directors. Mailing-list sign-ups from this website, including those made after a booking, are sent to a customer database managed by Winslade Park Limited (company number 10018492, ICO registration ZB605854), which also sends our newsletters. It uses this information only for Winslade Manor’s purposes as described in this policy.
We do not sell your data.
Website statistics — Plausible Analytics. We use Plausible Analytics to see which pages people find useful and which of our adverts and campaigns lead to bookings:
It sets no cookies and stores nothing on your device.
It doesn’t collect personal data. Your IP address and browser details are used only to work out a rough location and device type, and are then discarded — they are never stored.
It doesn’t track you across pages, days, devices or websites. Statistics are aggregated; there is no way to follow an individual visitor or recognise you when you come back.
Your data stays in Europe. Plausible is a European company and its servers are in the EU.
Because it collects no personal data and stores nothing on your device, we don’t need to ask your permission to use it. Plausible’s data policy is at .
Cookie preferences. We use Real Cookie Banner to ask for and record your cookie choices. When you make a choice, it stores what you agreed to and when, so we can show it was properly given and honour it if you change your mind. It does not store your IP address; it keeps a scrambled reference derived from it, which can’t be read back. These records stay in our own website database and are kept for up to six years (72 months).
Transfers outside the UK. Some of our providers are based outside the UK. Where data is transferred abroad, we rely on the safeguards required by UK data protection law:
Google and Meta are based in the United States. Both are certified under the UK Extension to the EU–US Data Privacy Framework, and their terms also include standard contractual clauses with the UK Addendum.
Cloudflare is based in the United States and processes data in both the United States and Europe. We rely on its certification under the UK Extension to the EU–US Data Privacy Framework, together with the standard contractual clauses and UK Addendum in its data processing agreement.
QUIC.cloud is based in the United States. We rely on the standard contractual clauses in its data processing agreement.
Amazon Web Services sends our newsletters from its London region, so they are stored in the UK. Where AWS accesses data from outside the UK, we rely on the standard contractual clauses and UK Addendum in its data processing terms.
Maileroo contracts through an Australian company and processes email in the EU, in Germany, the Netherlands and Finland. Australia is not covered by a UK adequacy decision, so we rely on the standard contractual clauses and the UK International Data Transfer Addendum in its data processing agreement.
Our own hosting is in the European Economic Area, on servers in Germany. The UK recognises the EEA as providing an adequate level of data protection, so no additional safeguards are needed.
4. Disclosure required by law
We may disclose personal information where we’re required to by law, a court order, or a request from a law enforcement or regulatory authority.
5. Security
We take appropriate measures to keep your personal data secure and to limit access to it to those who need it.
6. Links to other websites
This policy doesn’t cover other websites linked from ours, including DesignMyNight’s booking pages once you’re on them. We’d recommend reading their own privacy policies.
7. Your rights
You have the right to: be told how your data is used; access the data we hold about you; have it corrected or deleted; restrict how we use it; ask for it to be transferred to you or someone else; and withdraw consent where we rely on it. You also have the right to object to processing based on our legitimate interests, and you can always object to direct marketing — we’ll stop. To exercise any of these rights, contact us using the details below. We’ll respond within one month.
8. Children
Our website isn’t aimed at children. If you’re under 13, please ask a parent or guardian before giving us any details or accepting cookies.
9. Changes to this policy
We may update this policy from time to time. The “last updated” date above shows when it last changed.
10. Complaints
If you’re unhappy with how we’ve handled your data, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, at .
11. Contact details
Winslade Park Estate Limited, trading as Winslade Manor.
Address: Winslade House, Manor Drive, Clyst St Mary, Exeter EX5 1FY
Email: bookings@winslademanor.com