Privacy policy

This website is operated by Duncton Mill Trout Farm Ltd, trading as Duncton Mill Paddleboarding, a company registered in England & Wales (company number 14772856). Our registered office is Dye House Lane, Duncton, West Sussex, GU28 0LF, United Kingdom.

We are the “data controller” responsible for your personal information when you book a session or use this website. If you have any questions about this policy or how we handle your data, you can reach us at hello@dunctonpaddles.co.uk or by phone on 07376 642706.

When you make a booking through this website, we collect:

• Your contact details — your name, email address and, if you choose to provide it, your phone number.
• Your booking details — the date and time of your session, the number of adults and children in your party, how many boards you wish to hire, any extra hours added, and the amount paid.
• A supervision confirmation — where your party includes children, a record that you have confirmed your group meets our adult supervision ratios.
• Payment information— your card payment is processed securely by Stripe (see “Payments” below). We never see or store your full card number; we only keep a record of the amount, whether it was paid, and a payment reference.

We also collect a limited amount of technical informationautomatically when you use the site, such as your IP address. We use this only for short-lived security and abuse-prevention purposes (for example, limiting repeated payment attempts) and in standard server logs kept by our hosting provider.

We use a privacy-friendly analytics tool (Umami) to understand how our website is used — for example, which pages are popular and how visitors found us. It is cookieless and collects only aggregated, anonymous information; it does not identify you, does not track you across other websites, and is not used for advertising. We do not build marketing profiles or send marketing emails. See “Cookies and analytics” below for more detail.

For online bookings we do not collect any personal details about the children in your party — only the number of children, so we can manage capacity and supervision. A booking is always made by a supervising adult. Any paper safety waivers completed on site are held separately at our premises.

We use your information to:

• take and manage your booking, send your confirmation email, and prepare for your visit — on the basis that this is necessary to perform our contract with you;
• take payment and keep accounting and tax records — to meet our legal obligations;
• keep our website and booking system secure and prevent abuse or fraud, and respond to enquiries you send us — in our legitimate interests in running a safe and reliable service.

Card payments are handled by Stripe, a global payment provider. When you pay, your card details are entered directly into Stripe's secure payment fields and sent to Stripe — they do not pass through our own systems. Stripe acts as a separate data controller for the payment and processes your information in line with its own privacy policy, available at stripe.com/privacy. We share your email address with Stripe so it can issue your payment receipt.

We do not sell your personal information. We share it only with the service providers that help us run our booking system, and only as far as needed:

• Stripe — to process your card payment (see above).
• Postmark — to send your booking-confirmation email. It receives your name, email address and booking details for that purpose.
• Railway — our website and database hosting provider, which stores your booking data on our behalf.
• Umami — our website analytics provider, which processes anonymous, aggregated statistics about visits to our site (no personal data — see below).

We may also disclose information if required to do so by law, or to establish, exercise or defend our legal rights.

Some of these providers may process data on servers outside the UK. Where they do, they are required to protect your information to a standard comparable to UK data protection law (for example, through approved contractual safeguards).

This website does not use advertising cookies. We use a single strictly necessary cookie only for staff members logging in to the booking system — it is not set when you browse the site or make a booking as a customer.

For website analytics we use Umami, a privacy-focused service. It is cookieless — it does not store anything on your device and does not collect information that identifies you or track you across other websites. It gathers only aggregated statistics, such as the pages viewed, the website or search that referred you, and general details like your browser type, device type and country. Your full IP address is not stored.

Some pages embed content from third parties that may set their own cookies or receive your IP address when that content loads — specifically the Stripe payment form on the checkout page and the embedded Google Map on our homepage. These are governed by Stripe's and Google's respective privacy policies.

We keep booking and payment records for 6 years after the relevant booking, to meet UK accounting and tax record-keeping requirements, after which they are deleted. Any paper safety waivers completed on site are retained for the relevant period appropriate to their purpose and then securely destroyed.

Under UK data protection law you have the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct information that is inaccurate or incomplete;
• ask us to delete your information, where there is no continuing reason for us to keep it;
• object to, or ask us to restrict, certain uses of your information;
• ask us to provide your information to you, or another provider, in a portable format.

To exercise any of these rights, please contact us at hello@dunctonpaddles.co.uk. We will respond within the time limits set by law. Please note that we may need to keep some information to meet our legal obligations (for example, accounting records).

If you are unhappy with how we have handled your information, you have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk. We would, however, appreciate the chance to address your concerns first.

We may update this policy from time to time. When we do, we will change the “last updated” date at the top of this page. Please check back occasionally to stay informed.