Privacy Policy | The Towpath Inn

Who we are

The Towpath Inn Limited (registered in England and Wales, company number 11381721, registered office 49 Main Road, Gilwern, Abergavenny, NP7 0AU) runs The Towpath Inn. We are the data controller for the information described here. Questions or requests: lee@thetowpathinn.co.uk.

What we collect

What we hold depends on how you deal with us:

Group and event enquiries: your name, email, phone number, postcode, the date, group size, occasion and your message.
Offers and sign-up forms: your name, email and mobile number (we text a code to check the number), your postcode if asked, and which form or advert you came from.
Visits and offers you use: when you redeem a voucher or offer, what you spent if staff record it, and any challenge or membership (Towpathers) you buy, including payment status. Card details are handled by our payment provider; we never see or store them.
Reviews and messages: anything you send us in a review, a reply or an email.
Bookings: table bookings are made with our booking provider, who collects what they need and has its own privacy notice.
Your visit to this website: the pages you view, the link or advert that brought you here (for example campaign tags and advert click IDs in the web address), and, only if you accept cookies, the identifiers set by the cookies in our Cookie Policy.

Why we use it, and our lawful basis

To reply to an enquiry, arrange your visit, issue and check vouchers, and run challenges and memberships you sign up for. Basis: taking steps you asked for, or our contract with you.
To stop our enquiry form being misused, we keep a scrambled form of the internet (IP) address it was sent from for about an hour, then delete it. Basis: our legitimate interest in keeping the form working.
To send you offers and news by email or text, only if you agreed to it. Basis: consent. Every message has a way to stop them.
To understand where our guests travel from (your postcode) and which forms, links and adverts bring people in, so we spend our marketing sensibly. Basis: our legitimate interests in running and promoting the pub.
To measure the website and our adverts, and to show our adverts to people who have visited this website, only if you accept those cookies. Basis: consent.
To keep the records the law requires, such as sales records. Basis: legal obligation.

Website analytics, pixels and remarketing

Nothing below runs unless you choose Accept, or switch it on under Choose, in the cookie banner. You can change your mind at any time with the Cookie Settings link at the bottom of every page.

Google Analytics (if you allow analytics cookies) counts visits and shows us which pages help people find us.

Google Ads remarketing (if you allow marketing cookies): Google may add your browser to a list of people who have visited this website, so we can show you our adverts on Google's network, such as Search, YouTube and partner websites, after your visit. We aim these at people within travelling distance of the pub, and you stay on the list for no more than 540 days (most of our campaigns use far shorter windows).

The Meta pixel (if you allow marketing cookies) may tell us whether our Facebook and Instagram adverts led to visits to this website and to enquiries. If we use it, it sends only the events we choose: page views, menu views, contact and enquiry clicks. We may also use it to show our adverts on Facebook and Instagram to people who have visited this website, aimed at people within travelling distance of the pub, for no more than 180 days after a visit (most of our campaigns use far shorter windows). For collecting and sending this data, we and Meta Platforms Ireland Ltd are joint controllers under Meta's Controller Addendum; Meta is responsible for what it does with the data afterwards.

Offline conversions

When something happens in the pub that an advert may have led to, such as redeeming an offer, a visit or a purchase, we may tell Meta or Google about it so they can report which adverts worked. We send the event and the advert click ID that came with you, or your email address or phone number in a scrambled (hashed) form that the platform can match but not read. We only do this if you accepted marketing cookies when you arrived from an advert, or you have agreed to hear from us.

Customer lists (Customer Match and Custom Audiences)

We may in future upload a list of the email addresses and phone numbers of guests who have agreed to hear from us to Meta and Google, in scrambled (hashed) form. The platforms match it against their own users so we can show those guests our adverts, leave existing guests out of adverts meant for new ones, or reach people with similar interests. If you have no account with them, nothing is matched. The platforms delete the list data once matching is done or keep it only under their own terms. Basis: consent, the same consent you gave to hear from us. To be left out, unsubscribe or email lee@thetowpathinn.co.uk and we'll remove you from the next upload.

Who we share it with

We never sell your information. We run our website, sign-up forms, vouchers and guest records on our own platform, Regulars. These companies process information for us, under contract and only on our instructions:

Supabase: the database behind our guest records, forms and vouchers.
Vercel: hosting for this website.
Resend: sending our emails. Google Workspace: our email inbox.
Twilio: text messages, including the code that checks your mobile number.
Stripe: card payments for challenges and memberships. We never see or store your card details.
Google Analytics: website statistics, if you allow analytics cookies.
Lightspeed: our table booking system.
Our accountants and professional advisers, where they need it.

Advertising partners

Meta (Facebook and Instagram) and Google (Google Ads) receive information described above only with your consent, or as hashed lists of guests who agreed to hear from us. They act as controllers in their own right for what they do with it, and for collecting it through the Meta pixel we and Meta are joint controllers. We also share information with authorities where the law requires it.

Transfers outside the UK

Some of these providers store or process data in the United States. Where they do, the transfer is covered by UK-approved safeguards: the UK Extension to the EU-US Data Privacy Framework, or the ICO's International Data Transfer Agreement or Addendum.

How long we keep it

Enquiries: up to 2 years after we last heard from you.
Offers, vouchers, visits and purchases: up to 6 years, because sales records must be kept that long.
Marketing: until you unsubscribe. After that we keep only enough to make sure we don't contact you again.
Website analytics: 14 months. Website visitor lists for adverts: no more than 180 days with Meta and 540 days with Google. Cookie lifetimes are in the Cookie Policy.

Your rights

You can ask for a copy of your information, ask us to correct or delete it, ask us to limit how we use it, object to how we use it (including any marketing, which we will always stop), and withdraw consent at any time. Email lee@thetowpathinn.co.uk; we reply within a month. If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office at ico.org.uk.

Automated decisions and children

We don't make decisions about you by automated means that have legal or similarly significant effects. This website isn't aimed at children, and we don't knowingly collect information from anyone under 13.

Changes

If we change how we use your information, we'll update this page and the date at the top, and tell you directly if the change matters to you.