Privacy policy

The Little John is a public house with rooms at Station Road, Hathersage, Hope Valley, Derbyshire S32 1DD. It is operated by The Bank House Bar & Restaurant Ltd, registered in England and Wales under company number 10348087, whose registered office is The Glass House, Hathersage Hall Business Centre, Main Road, Hathersage, Hope Valley S32 1BB.

For the purposes of UK data protection law that company is the data controller for everything described on this page, which means it is the one that decides what is collected and what happens to it. Where this page says "we", that is who it means.

You can reach us about anything on this page by email at info@littlejohnhotel.co.uk, by telephone on 01433 650225, or by post at the address above.

Table bookings on this website are taken through Stampede, which appears as a booking form on our Book a Table page. When you book, you give Stampede your name, your email address, your telephone number, the date and time you want, how many of you there are, and anything you choose to add in the notes, which in practice is usually a dietary requirement, an access need or the fact that a dog is coming.

We use that information for one purpose: to hold your table and to be able to reach you about it if something changes. The lawful basis is the contract between us, or the steps you have asked us to take before making one.

Stampede acts as our data processor, meaning they handle the information on our instructions rather than for their own purposes. Stampede is operated by Stampede AI Ltd, registered in Scotland under company number SC503985, at Clockwise, Commercial Quay, 84 Commercial Street, Edinburgh EH6 6LX. Booking data is held on their hosted services in the Republic of Ireland.

The form is not on our website. Choosing "Book a table" opens Stampede's own booking page in a new tab, and what you type goes in there rather than here. Because it is their website, they set their own cookie, anon_session, which is what keeps your table held for five minutes while you finish. Their page also loads type from Google Fonts and reports its own faults to an error monitoring service, so your IP address is visible to those two companies while you are on it. Their privacy policy governs what happens once you are there.

If you would rather not use the online form at all, you can book any table by telephoning us on 01433 650225, and then only we hold your details.

Rooms and cottages are booked through Q-Book, which is operated by Queensborough Group. Choosing your dates on our Book a Stay page takes you to their website at web-bookings.hotels.uk.com, in a new tab, and the booking itself happens there rather than here.

All our website sends them is the dates you picked and the reference number of this pub. Nothing about you goes from our site to theirs. You give them your name, your contact details, how many of you there are and anything you add about a dog, an access need or a dietary requirement, at the point you fill their form in. Where a deposit or a payment is taken, your card details go to the payment provider rather than to us.

Because their booking pages are their own website, they set their own cookies: one to keep your booking session together, one for security, and a set that keeps you on the same server while you book. Their pages also use Google reCAPTCHA to check you are not a robot, which involves Google and leaves a Google cookie on your device for about six months. The cookie choice you make on our site does not reach theirs, because we cannot set or clear cookies for another company's website. Their privacy policy governs what happens once you are there.

We use all of it to hold your room, to reach you if something changes, and to look after you while you are here. The lawful basis is the contract between us. Q-Book acts as our data processor, handling the information on our instructions.

Q-Book also connects us to booking agencies such as Booking.com, Expedia and Airbnb. If you book through one of those rather than directly with us, that company collects your details first and passes what we need through to Q-Book. What they do with your information is governed by their own privacy policy, not by this one. Booking directly with us means fewer companies hold your details, which is one of several reasons it is worth doing.

If you stay with us, we also keep the record of the booking and the payment for our accounts, which we are required by law to retain.

Two things that can happen after a stay is booked involve the card you booked with, so they belong on this page and not only in the small print.

Cancelling inside 48 hours. If you cancel a room or a cottage within 48 hours of the arrival date and time you booked, a £50 cancellation charge applies, taken from the card used to make the booking.

Damage during a stay. You are responsible for any damage caused to the property, its contents, fixtures or fittings beyond reasonable wear and tear. Where damage is identified after you have checked out, we may charge the same card. Any charge reflects the reasonable costs the business actually incurs in putting things back as they were, which can include repairing or replacing what was damaged, specialist cleaning where it is needed, and other direct costs reasonably incurred.

The card is held by our booking and payment provider rather than by us. We ask them to take a charge against your booking, and we never receive or store your full card number. What we hold is the record of it: the amount, the reason for it, the booking it relates to, and any supporting information, correspondence or refund that goes with it.

We do this to administer your booking and the contract between us. We keep the record afterwards because we may need it to establish, exercise or defend a legal claim if a charge is ever questioned, and because our legal and accounting obligations require it. How long we keep it is in the list further down this page.

None of this applies to booking a table, where there is no deposit, no card and no cancellation charge.

This website sets two cookies, both of them ours, and both of them necessary for the site to work at all. Neither is used to track you, build a profile or advertise to you.

• the-northern-collective-session, which keeps your visit working as you move between pages, and expires when you close your browser or shortly after.
• XSRF-TOKEN, a security cookie that stops other websites submitting things on your behalf.

Because both are strictly necessary, we are allowed to set them without asking. Everything else, we will ask.

We also use Google Analytics to count visits and see which pages people actually find useful. It sets two cookies, one called _ga and one beginning _ga_, which last two years and tell us that the same browser has been here before. They do not tell us who you are.

Nothing is set until you say yes. The bar at the foot of the screen asks once. Refusing costs you nothing: the site behaves identically either way, and if you refuse we do not even download the tag from Google, so your visit is not counted and Google is not contacted at all. You can change your mind whenever you like using the Cookies link at the bottom of any page, and we ask again after a year in case your view has changed.

We use no advertising cookies, we do not build profiles, and we do not remarket to you anywhere.

Our web server keeps ordinary access logs, which include the address your request came from and which page you asked for. They exist so we can keep the site running and secure, and they are not used to identify anybody.

Booking is the one place where another company is involved. Booking a table takes you to Stampede's website and booking a room takes you to Q-Book's, and each sets its own cookies once you are there, in Q-Book's case including a Google one through reCAPTCHA. Neither is covered by the choice you make here, and both are described in the two booking sections above.

CCTV is in operation at The Little John, inside the building and around it. It is there to keep customers and staff safe and to help prevent and investigate crime, which is our legitimate interest in running licensed premises. Signs are displayed so you know before you are recorded.

Recordings are kept for around 30 days and then overwritten automatically, unless something has happened that means a particular recording has to be kept for longer, for example an incident we have reported. We do not put footage online, we do not use it to work out who our customers are, and we share it only with the police or our insurers where there is a proper reason to.

You can ask for a copy of footage of yourself. Tell us roughly when you were here and where, because CCTV cannot be searched by name, and ask within the 30 days while the recording still exists. Where other people appear in the same footage we may need to obscure them before we can release it.

Number plate recognition in the car park is planned but not yet in use. When it is installed there will be signs at the entrance, and this page will be updated first to say who operates it, what it records and how long for. We are not describing it as running while it is not.

We intend to send occasional emails about what is happening at the pub. You will only ever get one if you have opted in. We will not add you to a list because you booked a table, stayed in a room or sent us a question, and we will not treat silence as agreement.

Every marketing email will say who it is from and carry a one-click unsubscribe that works. You can also tell us to stop by replying, by emailing info@littlejohnhotel.co.uk or by telling somebody behind the bar. The lawful basis is your consent, and you can withdraw it at any time without giving a reason.

Emails about a booking you have actually made, such as a confirmation or a change of plan, are not marketing and will be sent whether or not you have opted in.

Very few people, and never for money. We share personal information only with the suppliers who make the pub work: Stampede for table bookings, Q-Book for room and cottage bookings, the companies that host this website and our email, and our accountants and payment providers where the law requires a record. Each of them handles it on our instructions.

Google appears twice without us sending them anything directly: the booking form loads its type from Google Fonts, and Q-Book uses Google reCAPTCHA. In both cases it is your browser contacting Google rather than us passing anything on, but your IP address is visible to them at that moment, so it belongs on this page.

We will also disclose information where we are legally obliged to, for example to the police under a valid request, or to protect someone's safety.

We never sell, rent or trade your personal information, and we do not pass it to advertisers. If we ever want to email you about something we are doing, we will ask you first, and every email will have a one-click way out.

• Table bookings: held in Stampede for two years from your visit, then deleted.
• Room and cottage enquiries and correspondence: two years from our last contact with you.
• Records of a completed stay or a paid bill: six years, because tax law requires it.
• A cancellation or damage charge: kept with the bill for the same six years, so we can account for it and answer for it if it is ever questioned.
• CCTV recordings: around 30 days, then overwritten.
• Marketing consent: until you withdraw it, and a record of the withdrawal after that.
• Website access logs: a matter of weeks.

If you ask us to delete something sooner, we will, unless it is one of the records we are legally required to keep, in which case we will tell you so.

Under UK data protection law you can ask us to show you what we hold about you, to correct it if it is wrong, to delete it, to stop or limit what we are doing with it, to hand it over in a portable form, and to object to us using it. You can also withdraw consent at any time where we relied on consent.

Ask by email at info@littlejohnhotel.co.uk or by telephone on 01433 650225. It costs nothing and we will answer within one month. We may ask you to confirm who you are first, which is to protect you rather than to obstruct you.

If you are not happy with how we have handled it, you can complain to the Information Commissioner's Office, the UK regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. We would rather you came to us first, but it is your right either way.

We will update this page when what we do changes, and the date at the top will change with it. If the change is a significant one, such as introducing analytics or email marketing, we will make that plain rather than simply editing a paragraph.