Who we are
Hut & Tide is operated by Darren Swan, trading as Hut & Tide, based in Dorset, United Kingdom. We are the data controller for the personal data collected through this website.
If you have questions about this policy or about how we handle your data, you can contact us at [email protected].
What we collect
The personal data we collect depends on how you use the site. Here is what we may collect and when.
| Data | When collected |
|---|---|
| Name and email address | When you create or update your shared booker/owner account, make a booking request or sign up for email updates. |
| Phone number | When you add it to your account details or provide it as part of a booking request. Account registration does not ask for a phone number. |
| Booking details | For an on-site request: your name, email, optional phone number, hut, dates, guest count, quoted price and charge breakdown, accepted cancellation policy and deadline, consent time, hire terms, published arrival information and booking status. We keep the original agreement when the listing changes. Contact details are encrypted in our application database and available to the owner handling the request. Signed-in requests are linked to your account. Guest requests use a private booking-access link and are not claimed automatically by matching email addresses. |
| Payment information | Where you pay through Hut & Tide, Stripe collects your card details through hosted Checkout. We keep encrypted provider references and limited payment, commission, refund and reconciliation records, not your card number. An external provider's own privacy policy applies to payments made on its website. |
| Identity verification | Hut & Tide does not store identity documents. Stripe collects any identity and bank information it needs for owner payout-account verification through its hosted onboarding. |
| Messages | When you contact us, or receive transactional updates about your request. Booking requests do not subscribe you to marketing emails. |
| Email marketing preferences | When you optionally give or withdraw marketing permission in registration or your account settings, or subscribe to a separate newsletter. |
| Account security and preferences | Your password is stored as a one-way hash. We record email verification, limited sign-in failure and security state, the terms you accepted, and your optional preference to book, list a hut or do both. Verification and password-reset links expire and can be used once. |
| Device and usage data | When you browse the site: public pages visited, broad search/filter choices, hut views, calendar and booking-link interactions, successful contact submissions, browser/device information and approximate location. Consented registration-submission, verified-account and sign-in outcomes may be reported on a later public page. Collected through Google Analytics 4 when enabled and with your consent; Metricool also receives clean public page URLs and viewport dimensions after consent, along with standard network information such as your IP address; we exclude form contents, free-text search terms, URL queries, booking references and account identities from these events. See our cookie policy for details. |
Optional nearby search: On our beach hut locations page, “Find places near me” asks your browser for location permission when you select it. If you allow access, your coordinates are used in that page's memory to sort destinations by approximate straight-line distance. We do not send those coordinates to our servers or the map provider, or save them in cookies, browser storage or the page URL. Reloading the page clears them; you can also clear nearest sorting or revoke permission in your browser.
Advertising-listing performance: With your analytics consent, we record visits to advertising-only hut pages and whether their booking-website link was followed. Each page visit has a random, short-lived reference. The record contains the hut, time, a broad source category and whether a link was clicked; it does not contain your name, email, account ID, IP address, browser details or the referring website's full address. It does not link your activity across pages.
Saved huts and alerts: Browser saves are stored locally after you choose to save. Signed-in saves and optional visit dates are linked to your account. Shared links contain hut IDs and any chosen visit date, not your identity. Availability alerts are separately requested service emails to your verified address and expire with the dates; they do not enrol you in marketing. You can stop them in your account.
Guest reviews: Reviews are linked to completed bookings and held privately until moderated. With your publication consent, your rating and text appear as Verified guest. Owner replies are moderated separately. Contact us to correct or remove a review. Reviews follow the retention of their associated booking; moderation audit records are retained for 365 days.
Private arrival instructions: For on-site bookings, owners can provide encrypted key collection, access codes, directions, contact and departure details. These are shared through the authorised private booking page after confirmation and the release time, until departure or cancellation. We record instruction versions, your explicit acknowledgement and transactional reminder status to help manage your visit. Reminder emails contain a secure booking link, not private access codes; we disable link and open tracking for those emails. Booking-specific records follow booking retention; reusable hut instructions remain while needed to operate the hut. Withdrawing online access cannot erase information a guest has already seen.
Customer support: Authorised staff can view booking contact details, the terms agreed at booking and relevant payment records to handle enquiries, cancellations and refunds. We keep a record of the staff account, action, reason category, amount and time. Payment support does not expose your card details or private key-safe codes.
Owner listing content: Owners can save private revisions of descriptions, facilities and photographs. Approved content appears on the public listing. Uploaded photos have embedded metadata removed, but owners should only upload images they have permission to share and should avoid including private information. Drafts, review notes and retained revisions are accessible only through authorised owner and administrative processes.
Why we collect it
Under UK GDPR, we must have a lawful basis for processing your personal data. The bases we rely on are:
- Contract: We need your name, email and booking details to fulfil a booking you make through the platform. Without this data, we cannot process your reservation or put you in contact with the hut owner.
- Consent: We send marketing emails only if you have actively opted in. You can withdraw marketing consent using the unsubscribe link or by contacting us. Optional analytics, including advertising-listing performance, follow your cookie-banner consent; you can change that choice through the banner.
- Legitimate interest: We keep relevant service records to operate and improve the service, resolve disputes and provide customer support. Optional analytics collection remains subject to your consent.
- Legal obligation: We may need to retain certain transaction records to meet tax and accounting requirements.
Sharing your details with hut owners
When you submit an on-site request, we share your name, email and optional phone number with the owner handling that hut so they can review the request, respond to you and arrange an approved hire. The private owner page checks hut ownership before returning these details.
This is necessary to fulfil the booking. The hut owner receives only the information they need to manage your hire. They do not receive your payment card details.
Hut owners are required to use your details only for the purpose of managing the booking. They must not add you to their own marketing lists or share your details with anyone else.
Advertising-only owners receive aggregate performance figures for their own hut, such as recorded visits and visits with a booking-website click. These reports do not reveal individual visitors or confirm what anyone booked on another website.
We use the service providers described below to operate the website and send requested updates. We do not sell, rent or trade your data to advertisers or data brokers.
Marketing emails
We use Brevo to manage our email marketing. If you sign up for email updates (for example, to be notified when beach huts become available in your area), we store your email address and any preferences you provide (such as your preferred location) in our Brevo account.
We will only send you marketing emails if you have given your explicit consent to receive them. We will never subscribe you to marketing emails as a side effect of making a booking or creating an account.
We retain a digest of a newsletter email address for up to seven days to limit repeated confirmation requests. Public forms use Cloudflare Turnstile to help prevent abuse. A request is not a subscription: you must confirm using the separate newsletter email.
The optional account-registration checkbox records your marketing permission. After you verify your account email, we share your name, email and choice with Brevo to manage those updates. You must also follow a separate newsletter confirmation link before receiving marketing emails. Change your choice in email preferences or use an email’s unsubscribe link. Withdrawing account permission stops Hut & Tide marketing to that address, including sign-ups through our public forms. We honour unsubscribe and delivery suppression; essential account and booking messages remain separate.
Every marketing email we send contains an unsubscribe link. You can also manage your preferences or unsubscribe entirely by contacting us at [email protected]. We will process your request promptly.
Transactional emails (booking confirmations, check-in instructions, password resets) are not marketing. These are sent as part of the service and do not require separate marketing consent.
Payment processing
For on-site hire, Stripe Checkout collects your card details directly to authorise the agreed hire price before approval. Payment is captured when the booking is approved. We share the information needed to process that payment and receive limited authorisation, payment and refund status information. Payments arranged separately with an owner or external provider follow that provider's terms and privacy policy.
When you claim an existing directory listing, we store your account reference, the listing, your explanation of authority and our verification response. Evidence and review text are encrypted and accessible to you and authorised staff. Do not send identity documents, passwords or card details. We use this information to verify authority and prevent unauthorised listing changes. Private evidence and review text are removed after one year without an update; minimal claim and transfer records are retained while the related listing exists. Claim status and decisions are available in your account.
Creating an account does not create a payment-provider customer record or charge you. When you set up an owner listing, we store the hut details, chosen rental route, permission and terms acknowledgements, review status and relevant billing or payout-setup status.
Advertising subscriptions use Stripe Checkout and its billing portal. Payout-account setup uses Stripe’s hosted onboarding. Stripe collects the payment, identity and bank information needed for those services directly. We store encrypted Stripe references and limited subscription and account-readiness information to operate your listing; we do not store your payment-card number, bank details or identity documents.
Stripe sends signed service updates so we can reconcile booking payments and refunds, subscriptions and payout-account status. We retain event identifiers, necessary financial references and processing status rather than the full webhook body. Stripe explains its handling of personal data at stripe.com/gb/privacy.
Guest booking links contain a private access code. Redeeming it creates a short-lived, booking-specific essential session so you can view and manage that booking. We store the information needed to expire and revoke access. Keep these links private; knowing a booking reference or matching email address does not itself grant access.
Cookies
This website uses cookies for essential functionality, analytics, marketing and payment processing. For full details of which cookies are set, what they do and how to manage your preferences, please read our cookie policy.
You can change your cookie preferences using the cookie icon on our public browsing pages. Analytics and consent-banner scripts are not loaded on account, authentication or private booking pages. With existing analytics consent, a protected first-party cookie may briefly retain a fixed account-action label and time so a successful action can be counted once on a public page within 30 minutes. It contains no account identity; expired outcomes are discarded.
Third-party services
We use a small number of third-party services to operate the platform. Each service processes data under its own privacy policy. Here is who they are and what they do.
| Service | What it does | Privacy policy |
|---|---|---|
| Cloudflare Turnstile | Checks registration, sign-in and account-link request forms for automated abuse using browser and network information. | Cloudflare privacy policy |
| OpenFreeMap (OpenStreetMap data) | Supplies map styles, tiles and labels when you choose a map on a public page or in owner setup. MapLibre runs on our website; your browser requests map data from OpenFreeMap, which receives standard network information such as your IP address and the map area being viewed. We omit credentials and referrers from these map requests. We do not send it account details, booking information or coordinates obtained for nearby sorting. | OpenFreeMap privacy policy |
| Stripe | Processes hosted guest hire payments and refunds, owner advertising subscriptions and payout-account onboarding. Receives the information needed for those services and returns limited financial and account-readiness updates. Registration does not take payment. For on-site hire, Stripe authorises the card before approval and captures payment when the booking is approved. | stripe.com/gb/privacy |
| Google Analytics 4 | Collects pseudonymous usage data to help us understand how visitors use the site. Only active with your consent. | policies.google.com/privacy |
| Metricool | Receives consented public page visits and viewport dimensions to help us understand site traffic. We omit URL queries, fragments, referrers, form contents and account identities. The network request includes standard connection information such as your IP address. | Metricool privacy policy |
| SendGrid | Sends verification, password-reset, contact and transactional booking-request emails. Account security emails go only to the account address; you can request another link if one does not arrive. Booking-request updates use a retrying notification queue and contain the reference, hut, dates, guests, price, terms and status. Recipient mailboxes and the provider have their own retention. | Twilio SendGrid privacy policy |
| Brevo | Manages email newsletter subscriptions and sends marketing emails. Processes newsletter sign-ups, confirmation, delivery status and unsubscribe suppression. | brevo.com/legal/privacypolicy/ |
| Cookie-Script | Manages the cookie consent banner and stores your cookie preferences. | cookie-script.com/privacy-policy |
We do not share your personal data with any other third-party services, advertisers or data brokers.
International data transfers
Some of the third-party services we use (Stripe, Google Analytics, Brevo and SendGrid) process data on servers located outside the United Kingdom, including in the United States and the European Economic Area.
Where data is transferred outside the UK, these providers rely on safeguards recognised under UK data protection law, such as Standard Contractual Clauses approved by the UK Information Commissioner's Office, or they are certified under frameworks that provide an adequate level of protection. You can find details of the specific safeguards in each provider's privacy policy linked above.
We only use providers that we are satisfied offer appropriate protection for your data.
How long we keep your data
- Account data (name, email, phone): kept for as long as your account is active. Deleted when you request account closure (see below).
- Booking requests and contacts: routine cleanup removes eligible requests, encrypted contact details, guest-access and notification records after 180 days have passed since both the end of hire and the latest request update. Future hires and unresolved payment, hold, refund or review matters remain protected until they can be settled.
- Booking financial records: minimal payment, commission, refund and reconciliation facts have a separate configured retention period of 2555 days. Only settled records qualify for cleanup; unresolved financial matters are retained. These records do not copy guest names, email addresses or telephone numbers, and their request link is cleared when the related contact record is deleted. We retain the encrypted financial references and original payment-operation details needed to verify payments and handle interrupted processing safely. Provider systems, backups and legal obligations can require separate retention.
- Rental-day usage: we keep a minimal record of the hut, hired dates and whether hire was arranged here or recorded by its owner, so annual rental allowances remain accurate after booking-contact records are removed. The record contains no guest name, email or phone number; its link to a booking request is cleared when that request is deleted. Owners can also record additional historical usage and confirm that their records are complete.
- Transactional emails and support messages: application notification records follow the request retention period above. Copies in recipient mailboxes and provider systems have their own retention; contact us with any deletion request.
- Staff account support records: minimal account-action and newsletter-retry audit records are kept for one year, without copied contact details.
- Marketing subscribers: kept until you unsubscribe. Once you unsubscribe, your email address is removed from our active marketing list. Brevo may retain a suppression record to ensure we do not email you again.
- Analytics data: retained by Google Analytics according to their standard data retention settings (currently 14 months for GA4). We do not send account identities, contact details or booking references as analytics event parameters.
- Advertising-listing performance: our own visit records become eligible for cleanup after 190 days. Cleanup runs in bounded batches as new observations arrive, so older records may remain during inactivity or a backlog. Reports show aggregate figures only.
- Listing revisions and photographs: retained while needed to provide the listing, review changes and resolve service questions. Removing a photo from a draft does not immediately erase every retained revision or backup. Contact us about content removal or account closure.
Your rights under UK GDPR
Under UK data protection law, you have the following rights in relation to your personal data:
- Right of access: You can request a copy of the personal data we hold about you. We will respond within one calendar month of receiving your request.
- Right to rectification: If any data we hold about you is inaccurate or incomplete, you can ask us to correct it.
- Right to erasure: You can ask us to delete your personal data. See the account closure section below for how this works in practice.
- Right to restrict processing: You can ask us to limit how we use your data while a complaint or correction request is being resolved.
- Right to data portability: You can request your data in a structured, commonly used format so you can transfer it to another service.
- Right to object: You can object to processing based on legitimate interest. You can also object to receiving marketing emails at any time.
- Right to withdraw consent: Where we process data based on your consent (marketing emails, analytics cookies), you can withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.
To exercise any of these rights, email us at [email protected]. We will verify your identity before processing your request and respond within one calendar month. If your request is complex or we receive a large number of requests, we may extend this by a further two months, but we will let you know within the first month if that is the case.
If you are not satisfied with how we handle your request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO). You can contact the ICO through their website at ico.org.uk or by phone on 0303 123 1113.
Account closure and deletion
You can request closure of your account and deletion of your personally identifiable information at any time by emailing us at [email protected].
When we process an account closure request, we will:
- Delete your account profile, including your name, email address, phone number and any saved preferences.
- Remove your details from any active marketing lists.
- Remove your name and contact details from booking records when they are no longer needed, while retaining the minimal financial references and accounting facts required for outstanding obligations and applicable retention periods. Financial references can still be indirectly associated with a payment; removing contact details does not make them anonymous.
- Delete any messages associated with your account.
We will confirm deletion by email within one calendar month of your request. Some data may persist in encrypted backups for a short period after deletion, but it will not be used or accessible and will be permanently removed when the backup cycle completes.
Children
Hut & Tide is not intended for use by anyone under the age of 18. You must be at least 18 years old to create an account, make a booking or list a beach hut. We do not knowingly collect personal data from anyone under 18. If we become aware that we have collected data from someone under 18, we will delete it promptly.
Security
We take reasonable technical and organisational measures to protect your personal data from unauthorised access, loss, misuse or alteration. These include:
- All data transmitted between your browser and our servers is encrypted using HTTPS/TLS.
- Stripe-hosted pages collect payment-card details; we do not store card numbers. Guest contact details, booking-access secrets and provider identifiers are encrypted in the database and available only through authorised application operations.
- Access to personal data within our systems is restricted to authorised personnel only.
- Our database is hosted on infrastructure with regular security updates and automated backups.
No system is completely secure. If you become aware of any security issue affecting your account, please contact us immediately at [email protected].
Changes to this policy
We may update this privacy policy from time to time, for example if we add new services, change how we process data, or if the law changes. When we update it, we will change the "last updated" date at the top of this page. If the changes significantly affect how we handle your personal data, we will notify you by email or through a notice on the website.
Contact us
If you have questions about this privacy policy, want to exercise any of your data rights, or have a concern about how we handle your personal data, please contact us at:
Hut & Tide
Email: [email protected]
You also have the right to contact the Information Commissioner's Office at ico.org.uk if you have a concern about how your data is being handled.