Privacy Policy

Last updated: March 2026

1. Who We Are

Ingliston Country Club Limited (company number SC344970) of Old Greenock Road, Bishopton, Renfrewshire, PA7 5PA is the Data Controller in respect of the personal data we collect from you as a guest, visitor or enquirer.

This means we are responsible for deciding how and why your personal data is used, and for ensuring it is handled in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Contact: If you have any questions about this Privacy Notice or how we handle your personal data, please contact us at general@ingliston.com or by telephone on 01505 864333.

We do not have a statutory Data Protection Officer. Responsibility for data protection compliance is managed by the hotel’s management team with the support of external IT and data protection advisors.

2. What Personal Data We Collect

Depending on how you interact with us, we may collect the following categories of personal data:

• Booking and reservation data: your name, email address, telephone number, booking reference, arrival and departure dates, and details of your stay.

• Payment data: payment card details where required. Payment information is processed through a secure, PCI-compliant and tokenised payment environment. We do not retain full card details.

• Communications data: records of correspondence between you and us, including enquiries, special requests, and complaints.

• Marketing data: your name, email address, and date of birth where you have signed up to receive our newsletter and promotional communications via Airship.

• Event and wedding enquiry data: your name, email address, telephone number, and event preferences when you submit an enquiry about weddings, corporate events or other functions.

• Touring park data: for guests of The Paddocks Touring Park, we may collect vehicle registration details and pitch preferences in addition to standard contact information.

• Special category data: we may collect information about dietary requirements or accessibility needs where you provide this to us. We will only use this information to fulfil your request.

• Website usage data: information about how you use our website, including pages visited, time spent, and device information, collected via Google Analytics and Facebook Pixel (see section 9).

3. How We Collect Your Personal Data

We collect personal data in the following ways:

• Directly from you when you make a booking by telephone, email or via our website booking system

• Through our third-party online booking platform, Guestline (part of The Access Group)

• When you submit an enquiry via our website (weddings, events, contact forms)

• When you sign up to our newsletter or marketing communications

• Automatically when you visit our website via cookies and tracking technologies

4. Why We Use Your Personal Data and Our Lawful Basis

We only process your personal data where we have a lawful basis to do so. The purposes for which we process personal data and the lawful basis for each are as follows:

5. Who We Share Your Personal Data With

We do not sell your personal data. We may share your personal data with the following service providers where necessary to deliver our services:

• Guestline (The Access Group): our booking platform provider, acting as a Data Processor under contract.

• Airship: our email marketing platform provider, who manages our newsletter communications. Airship processes your name, email address and date of birth on our behalf.

• Google (Google Analytics): website analytics. Please see section 9 and our Cookies Policy for further detail.

• Payment processor (Trust Payments): our PCI-compliant payment processing provider.

• Business IT Specialists Ltd (IT support): our managed IT service provider, who supports the security and operation of our systems. They act as a Data Processor and access personal data only as necessary to provide IT services.

• Legal and regulatory authorities: where required by law, including the Information Commissioner’s Office.

6. International Transfers

Some of our third-party service providers, including Google and Meta, may process personal data outside the United Kingdom. Where this occurs, we ensure that appropriate safeguards are in place in accordance with UK GDPR, such as the UK International Data Transfer Agreement or equivalent standard contractual clauses.

7. How Long We Keep Your Data

• Booking and guest records: 7 years following your stay

• Marketing data: until you withdraw consent or unsubscribe

• Enquiry and correspondence records: 3 years from date of last contact

• CCTV footage: 14 days unless required for an incident or legal matter

• Touring Park records: 7 Years following your stay

8. Your Rights Under UK GDPR

You have the following rights in relation to your personal data:

• Right of access: request a copy of the personal data we hold about you.

• Right to rectification: ask us to correct inaccurate or incomplete data.

• Right to erasure: ask us to delete your data in certain circumstances.

• Right to restriction: ask us to restrict processing in certain circumstances.

• Right to data portability: receive your data in a structured, machine-readable format (where processing is based on consent or contract).

• Right to object: object to processing based on legitimate interests, or to direct marketing at any time.

• Right to withdraw consent: withdraw consent at any time without detriment. This does not affect the lawfulness of processing before withdrawal.

To exercise any of these rights, please contact us at general@ingliston.com. We will respond within one month at no charge, unless a request is manifestly unfounded or excessive.

9. Cookies and Website Tracking

Our website uses cookies and tracking technologies including Google Analytics and Facebook Pixel. You can manage your cookie preferences via the cookie consent banner displayed when you first visit our website. Please refer to our Cookies Policy for full details of the cookies we use, what they do, and how to manage or withdraw your consent.

10. Data Security

We take the security of your personal data seriously and have implemented appropriate technical and organisational measures including:

• Secure, PCI-compliant and tokenised payment processing

• Password protection and two-factor authentication on booking system access

• Access controls limiting system access to authorised staff only

• Regular review of security measures with our IT support partners

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the ICO without undue delay and, where required, we will contact you directly.

11. Third Party Websites

Our website may contain links to third-party websites. This Privacy Notice applies only to our website and services. We are not responsible for the privacy practices of any third-party sites.

12. Changes to This Privacy Notice

We may update this notice from time to time. The most current version will always be available at ingliston.com/privacy-policy. The date at the top indicates when it was last updated.

13. Complaints

If you have concerns about how we handle your personal data, please contact us at general@ingliston.com. If you remain unsatisfied, you have the right to complain to the Information Commissioner’s Office:

• Website: www.ico.org.uk

• Telephone: 0303 123 1113

• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF