Rivendell Retreat Centre – Data Protection Policy

Last updated: 4/12/2025

1. Introduction

Rivendell Retreat Centre (“we”, “us”, “our”) is committed to protecting the personal data of everyone who engages with us—retreat attendees, enquirers, volunteers, contractors and staff. This policy explains how we handle personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy applies to all personal data processed by Rivendell Retreat Centre in any form—electronic, paper, audio or otherwise.

2. Data Protection Principles

We follow the six principles of UK GDPR. Personal data must be:

1. Processed lawfully, fairly and transparently

2. Collected for specified, explicit and legitimate purposes

3. Adequate, relevant, and limited to what is necessary

4. Accurate and kept up-to-date

5. Retained only for as long as necessary

6. Kept secure

We are also responsible for ensuring and demonstrating compliance (“accountability”).

3. What Personal Data We Collect

Depending on the nature of your interaction with us, we may collect:

3.1 Retreat bookings

• Name

• Contact details (email, phone, address)

• Accommodation details and booking history

• Dietary requirements

• Health information (in order to understand people's needs and assess their ability to attend/participate in aretreats).
• Gender information (in order to be able to allocate accomdation)

• Payment details (processed through secure third-party providers; we do not store card data)

• Emergency contact information (in order to contact people in case of emergency)

3.2 Mailing lists & communications

• Name (optional)

• Email address

• Subscription preferences

3.3 Volunteers, teachers, and staff

• Contact details

• Training or experience relevant to retreat work

• Payment and employment information (where applicable)

3.4 Website

• Cookies and usage data (via analytics tools if used)

• Information submitted via online forms - such as contact forms

4. Lawful Bases for Processing

We rely on one or more of the following lawful bases:

• Consent – for newsletters and some forms of communication.

• Contract – to manage retreat bookings and provide services.

• Legal obligation – for accounting, tax, safeguarding or regulatory purposes.

• Legitimate interests – for internal administration, record-keeping, and improving our services, where these do not override your rights.

• Vital interests – in rare cases, such as an emergency.

Where we rely on consent, you may withdraw it at any time by contacting us directly via the contact page

5. Special Category Data

We may collect limited special-category data such as:

• Dietary requirements

• Accessibility needs

• Health information relevant to participation in retreats

We collect and use this information only when necessary, store it securely, restrict access, and delete it when no longer required - though as people often return to retreats annually and they can be updated themseleves they can aedit as required and remove as required. This information may be required to be held for upto 8 years for legal purposes.

6. How We Use Personal Data

We may use your information to:

• Administer and manage retreat bookings

• Allocate room usage

• Communicate important pre-retreat information

• Meet catering and accommodation needs

• Provide emergency support where required

• Maintain financial records and comply with legal obligations

• Manage volunteer involvement

• Send newsletters and updates (only with your consent)

• Improve our services and understand how people engage with us

We do not use personal data for automated decision-making or profiling.

7. Data Sharing

We will never sell your personal data.

We may share personal data with trusted third parties when necessary, such as:

• Payment processors (e.g., Stripe, PayPal)

• Email newsletter platforms (e.g., Mailchimp)

• IT service providers involved in secure hosting or communication (e.g Website developer (Circular Cube), Siteground (Hosting service provider), Retrtea Guru (Booking system provider) -  each of these services have their separate privacy policies please refer to their websites.

• Emergency services (in exceptional circumstances)

In all cases, we request that third-party processors comply with data-protection requirements.

If data is transferred outside the UK, we ensure adequate safeguards are in place.

8. Data Security

We implement technical and organisational measures including:

• Restricted access to personal information

• Password protection and encryption where appropriate

• Secure physical storage of paper records (paper records kept only where neccesary)

• Security protocols for email, cloud storage and online services

• Regular monitoring and updating of systems

• Staff/volunteer awareness and good data-handling practices

9. Data Retention

We retain personal data only as long as necessary for the purpose collected.

Typical retention periods:

• Retreat bookings: 6 years (for accounting/legal obligations)

• Mailing lists: until unsubscribed

• Emergency contact / health information: deleted shortly after retreat completion

• Volunteer/staff records: in line with employment and safeguarding best practice

We review and delete data that is no longer required.

10. Data Subject Rights

Under UK GDPR, you have the right to:

• Access your personal data

• Rectify inaccurate information

• Request deletion (where legally permissible)

• Restrict or object to processing

• Withdraw consent (for consent-based processing)

• Request data portability (where applicable)

Requests can be made to the contact address below.
We will respond within one month, extendable in complex cases where legal advice is required.

11. Data Breaches

In the event of a personal data breach:

• We will act quickly to contain the issue

• Assess potential risks

• Notify the Information Commissioner’s Office (ICO) if legally required

• Inform affected individuals where there is a high risk to their rights

• Maintain records of all breaches and responses

12. Accountability

To demonstrate compliance, we will:

• Maintain records of processing activities

• Review data-protection practices regularly

• Provide training and guidance to staff and volunteers

• Review and update this policy annually or when changes occur

13. Contact Information

If you have questions, concerns or requests about your data, please contact us:

Rivendell Retreat Centre
Chillies Lane
High Hurstwood
East Sussex
TN22 4AB

Email: bookings@rivendellretreatcentre.com

Website: https://rivendellretreatcentre.com

You may also raise concerns with the Information Commissioner’s Office (ICO):
https://ico.org.uk