Privacy notice: how the hub handles personal data

This notice is for the team at Bluewood Lodges and for the people whose details pass through the hub. Version 2026-10.

What the hub holds

• Customer and guest emails sent to the business's connected mailboxes, the drafts written in reply, and the record of who approved and sent each reply. Message text is kept for as long as the business needs it to deal with its customers, unless the business sets a period under Settings, Data, after which the text is wiped; the audit line (that an email was handled, by whom, when) is kept either way.
• Bookings from the booking system: dates, party size, the lead guest's name, and whether a phone number or email is held (never the number or address themselves).
• Guest book and consent: names, email addresses, stays, and whether someone has asked for news, with how we know.
• Guest emails about a booking: a pre-arrival note and a thank-you with a review request, written once by the business and approved by an admin, then filled in from each booking. The guest's address is read from the booking system at the moment of sending and is not kept in the hub; the hub keeps the booking reference and that the email was sent. These are about the guest's own stay, not marketing.
• Front-of-house logs: lost property, complaints and what was given, and damage claims, each naming a guest by first name and booking reference only; the handover book and noticeboard, which hold no guest contact details.
• Team records: logins, roles, work patterns, leave, training certificates, documents read and signed.
• The incident book: names, contact details and injuries of people involved in accidents, visible to reception and admins only, kept for at least three years as the law requires.
• Operations: maintenance jobs, orders, certificates, renewals, contractors (business contact details), checks and readings, with who did what and when.

Who sees what

• Each login sees the parts of the hub its role allows. Housekeeping and maintenance do not see customer email addresses, booking contact details or the names in the incident book.
• An admin can look at the hub as another person to help them, but cannot change anything while doing so; the hub records that it happened.
• The business's own Claude connection, if switched on, reads what the chosen login would see, with customers shown by first name only. Nothing can be changed through it.

Where it goes

• The hub runs on a server in the UK or EU controlled by the business or its provider. Nightly backups are kept for 30 days.
• To draft replies, triage emails and write newsletters, the text of the message (never passwords or payment details) is sent to the AI provider under an agreement that forbids training on it.
• Newsletters are sent through Brevo to people who asked for them; Brevo holds their address and handles unsubscribes.
• Phone alerts go through ntfy to each person's own private topic, and never carry a customer's email address.

Your rights

• Customers and staff may ask the business what the hub holds about them, to have it corrected, or to have it deleted where the law allows. Ask reception or the business's data protection contact.
• The business is the data controller. Its provider, where one looks after the hub, acts only on the business's instructions as a processor.

Security

• Sign-in is by username and a password of at least 12 characters, with a limit on failed attempts. All traffic is encrypted. Keys for connected services are held on the server, never shown in the hub, never written to logs.
• Every change in the hub is recorded in the activity log with who made it.