Last updated: [date] · This document is a template pending legal review.
aGrandstay(“we”, “us”) operates this website. For the purposes of the EU/UK General Data Protection Regulation (GDPR), the data controller is [legal entity name], [registered address]. Our Data Protection Officer can be reached at [dpo@your-domain].
With your consent we share pseudonymous identifiers (a non-identifying account/visitor id, and — for marketing — a securely hashed email) with the processors below so we can understand usage and measure campaigns. Nothing loads or is shared before you opt in via the cookie banner.
These partners may process data in the United States. Transfers rely on the EU-US / UK Data Privacy Framework(to which Google, Microsoft and Meta self-certify) together with the European Commission’s Standard Contractual Clauses and our data-processing agreements with each partner. A copy of the relevant safeguards is available on request.
Account data is kept for the life of your account and a reasonable period thereafter. Analytics data is retained for [2–14] monthsin line with our analytics configuration. Enquiry records are kept for [retention period].
Under the GDPR you may request access, rectification, erasure, restriction, portability, and object to processing; and you may withdraw consent at any time via the control in the footer. To exercise a right, contact [privacy@your-domain]. Where we share an identifier with a partner, an erasure request is propagated to them (Google User-Deletion, Meta data-deletion, Clarity deletion).
You also have the right to complain to your supervisory authority (e.g. the UK ICO, or [your lead EU authority]).
We use a granular, opt-in consent banner (Google Consent Mode v2). Consent is remembered for up to 6 months and then re-requested, and we honour the browser’s Global Privacy Control signal as an opt-out. Manage or withdraw your choices anytime via the control in the footer. See also our Terms of Use.
