Privacy and Cookie Notice

Last updated: 14 September 2026

This notice explains how Cullerne House Ltd collects, uses, stores and shares personal information when you visit the Cullerne House Findhorn website, contact us, enquire about venue hire, book accommodation or otherwise deal with us.

Who we are

Cullerne House Ltd is the controller of the personal information described in this notice, except where another organisation is identified as a separate or joint controller.

Cullerne House Ltd
Cullerne House
Findhorn
Forres
Moray
IV36 3YY
United Kingdom

Email: hello@cullernehouse.org
Telephone: +44 (0)7873 840944

You can use these details to ask a question about this notice, exercise a data protection right or make a data protection complaint.

Information we collect

We may collect the following information.

General and B&B enquiries

When you use the general contact form, we collect your name, email address, subject, message and any telephone number you choose to provide.

Venue-hire enquiries

When you use the venue enquiry form, we collect the information needed to understand and respond to your proposal. This may include:

  • your name and contact details;
  • your organisation, where relevant;
  • the type and purpose of the proposed workshop, retreat, meeting or event;
  • proposed dates, times and flexibility;
  • expected group size;
  • rooms, accommodation and food requirements; and
  • any other information you include in the form or later correspondence.

B&B bookings

Our website links to Freetobook for B&B availability and booking. When you make a booking, Freetobook and Cullerne House may receive information such as your name, address, email address, telephone number, IP address, payment-related information, booking details and the names of people travelling with you. Payment information is handled by Freetobook and its payment providers; Cullerne House does not receive full payment-card details through the website.

Event and accommodation arrangements

If you ask us to help with accommodation elsewhere in Findhorn, catering or another part of a group booking, we may collect the practical information needed to make introductions or discuss arrangements with relevant providers. We will tell you before passing your contact details or requirements to an external host, caterer, organiser or supplier.

If an organiser supplies information for a public workshop or event listing, we may publish the agreed organiser name, biography, image, event information and booking link.

Information collected when you use the website

Squarespace and connected services may collect technical information such as:

  • your IP address;
  • browser, device and operating-system information;
  • the pages you visit and the date and time of your visit;
  • the page or website that referred you;
  • interactions with forms, buttons and other site features; and
  • cookie preferences and identifiers, where applicable.

We use this information to operate and secure the website, understand how it is used and improve its content. Non-essential analytics cookies are used only where the required consent has been given.

Please do not send unnecessary sensitive information

The free-text fields are not intended for detailed medical records or other highly sensitive information. Please do not include information about health, religion, sexuality or other special-category information unless it is genuinely needed for an accessibility, dietary or similar arrangement.

Where sensitive information is necessary, we will collect only what is needed, restrict access to it and identify an appropriate legal condition. Where appropriate, we will ask for your explicit consent. You can withdraw that consent, although we may then be unable to provide the requested arrangement.

Do not put sensitive personal information about participants or clients into the Teamup calendar. Organisers should give us only the practical information needed for a booking.

How and why we use personal information

We use personal information for the following purposes and lawful bases.

To respond to enquiries and prepare bookings

We use contact details and enquiry information to answer questions, discuss suitability, prepare quotations and take steps towards a venue-hire or accommodation contract.

Our lawful basis is taking steps at your request before entering into a contract, performing a contract, or our legitimate interest in responding to business and general enquiries and managing our services.

To provide venue hire, accommodation and related arrangements

We use booking and contact information to administer reservations, provide agreed services, communicate before and during a stay or event, manage changes and payments, and keep appropriate business records.

Our lawful basis is performing a contract, taking steps before a contract, complying with legal obligations and our legitimate interests in managing bookings and maintaining appropriate records.

To operate and secure the website

We use technical information, security logs and reCAPTCHA to deliver the website, keep forms working, prevent spam and misuse, investigate faults and protect our systems.

Our lawful basis is our legitimate interest in providing a secure and reliable website and, where applicable, compliance with legal obligations. Storage or access that is strictly necessary for a service requested by the visitor does not require cookie consent under the applicable rules.

To understand website use

Where you accept analytics cookies, Squarespace Analytics helps us understand visits, traffic sources and use of the website.

For non-essential cookies and similar technologies, we rely on your consent. You can withdraw consent at any time through the website's cookie controls.

To publish and promote workshops and events

We use information agreed with an organiser to prepare and publish an event listing and, where separately agreed, promote the event through Cullerne House channels.

Our lawful basis is performance of our agreement with the organiser and our legitimate interests in informing the public about confirmed activities at Cullerne House.

To send optional news and updates

If you actively choose to receive news or updates, we use your name and email address for that purpose. Our lawful basis is consent. You can unsubscribe or withdraw consent at any time. Choosing not to receive marketing does not affect service messages about an enquiry or booking.

To meet legal requirements and deal with disputes

We may use and retain relevant information for accounting, taxation, insurance, safeguarding, complaint handling, fraud prevention, legal claims or regulatory requests.

Our lawful basis is compliance with a legal obligation and our legitimate interests in protecting Cullerne House and others and establishing, exercising or defending legal claims.

Who receives personal information

We disclose personal information only where it is reasonably necessary. Recipients may include:

  • authorised Cullerne House directors, staff and management team members who need the information to deal with your enquiry or booking;
  • Squarespace, which hosts the website, provides form and contact storage, website analytics and related services;
  • our email and business-service providers, where information is sent to or stored in the accounts used to administer enquiries and bookings;
  • Freetobook and its payment-service providers when you use the B&B booking service;
  • Teamup, which provides the embedded venue-availability calendar;
  • Google, which provides reCAPTCHA spam protection on Squarespace forms;
  • OpenStreetMap Foundation and relevant map infrastructure when the embedded map is loaded;
  • organisers, local accommodation hosts, caterers or other suppliers where you ask us to make an introduction or arrange a service;
  • accountants, insurers, legal advisers and other professional advisers; and
  • courts, regulators, law-enforcement bodies or public authorities where disclosure is required or permitted by law.

We do not sell personal information.

Squarespace hosting, forms and analytics

The website is hosted by Squarespace. Squarespace processes website content, form submissions, contacts, technical logs and analytics information on our behalf. Forms that contain a required email field are also added to the Squarespace Contacts panel. Squarespace may otherwise retain these submissions until the site owner deletes them, so Cullerne House applies the retention schedule set out below.

Squarespace may use subprocessors and may process information outside the United Kingdom. Its data-processing terms include safeguards for restricted transfers, including recognised data-transfer frameworks and contractual safeguards where applicable.

Further information: Squarespace Privacy Policy and Squarespace Data Processing Addendum.

Freetobook B&B bookings

The B&B booking buttons take you to Freetobook, a service provided by U S Booking Services Ltd. Freetobook states that it and the accommodation provider operate as joint controllers for personal information processed through its accommodation-booking system. Freetobook collects and stores the information entered during the booking process and sends the booking information needed by Cullerne House to administer your stay.

Freetobook and its payment providers are responsible for the parts of the booking service they operate. Their own cookies and privacy terms apply after you follow the booking link.

Further information: Freetobook Guest Privacy Policy.

Teamup venue-availability calendar

The venue-availability page contains a calendar supplied by Teamup Solutions AG. When the embedded calendar loads, your browser connects to Teamup. Teamup may receive your IP address, browser and device information, referring page, usage logs and cookies or similar information needed to provide and monitor its service.

Cullerne House uses Teamup to show room availability and manage booking schedules. The public calendar must not display customer names, contact details, private booking notes or sensitive information. Calendar information entered by Cullerne House is processed by Teamup on our behalf. Teamup also processes visitor logs and service information under its own privacy notice.

Further information: Teamup Privacy Policy and Teamup Data Processing Agreement.

Google reCAPTCHA

Squarespace forms use Google reCAPTCHA to reduce spam and automated misuse. reCAPTCHA analyses technical and interaction information to assess whether a form request appears genuine. Google may receive information including your IP address, browser and device details, the page you are visiting and reCAPTCHA-related cookies or local-storage information. Google states that reCAPTCHA sets the _GRECAPTCHA cookie when it runs for risk analysis.

This processing supports our legitimate interest in securing the website and forms. reCAPTCHA may automatically flag or reject suspected automated submissions, but we do not use it to make decisions that have legal or similarly significant effects on people.

Further information: Google Privacy Policy and How Google uses information from sites or apps that use its services.

Fonts

The website uses Playfair Display, Open Sans and Karla through Squarespace's font library. Although these are font families available through Google Fonts, the current website serves the font files from Squarespace's content-delivery network rather than loading them directly from Google Fonts. Squarespace receives the technical information required to deliver those files as part of hosting the website.

If the font provider or delivery method changes, we will review this notice and the site's cookie and privacy settings.

Embedded map

The Getting here page includes an OpenStreetMap-based map. When the map loads, your browser connects to OpenStreetMap infrastructure and may disclose technical information such as your IP address, browser and device type, operating system, referring page, date and time, and the map resources requested. OpenStreetMap uses this information to deliver, secure and maintain its services.

You can use the separate map link instead of interacting with the embedded map.

Further information: OpenStreetMap Foundation Privacy Policy.

Videos

At the date of this notice, the website does not contain embedded YouTube or Vimeo videos.

Videos uploaded directly to Squarespace may use Squarespace's own video player and content-delivery services. If we add a YouTube, Vimeo or other external video, the player may send the visitor's IP address, device and browser information, referring page and interaction data to the provider and may use cookies or similar technologies.

Before adding an external video service, we will review this notice and configure the site so that non-essential third-party video content is not loaded until the visitor has made the required choice. The relevant provider's privacy terms will then also apply.

Links to other websites

The website links to organisers, accommodation providers, transport providers, Freetobook and other external websites. A normal link does not give the destination website your form submissions, but the destination may receive technical information when you click it and will process information under its own privacy notice. Cullerne House is not responsible for how independent websites use personal information.

Cookies and similar technologies

Cookies are small files or browser-storage entries used to operate websites, remember choices and understand use. The exact cookies used can change when Squarespace or another enabled service is updated.

Necessary website and consent cookies

Squarespace uses necessary cookies and storage entries to operate the site, protect it and remember cookie choices. These may include:

  • ss_performancecookiesAllowed, which records the performance and analytics cookie choice for 30 days; and
  • ss_marketingcookiesAllowed, which records the marketing cookie choice for 30 days.

Other necessary Squarespace cookies may be used according to the features enabled on the site. Google reCAPTCHA may set _GRECAPTCHA when it runs for spam and abuse protection.

Squarespace analytics cookies

If you accept analytics cookies, Squarespace may use:

  • ss_cid, ss_cpvisit and ss_cvr, each retained for up to two years; and
  • ss_cvisit and ss_cvt, each retained for up to 30 minutes.

These cookies help distinguish visits and sessions and produce Squarespace Analytics reports.

Third-party embeds

Teamup, OpenStreetMap and any future external video provider may receive technical information and may use their own cookies or similar technologies when their content loads. Squarespace's cookie banner does not automatically block every third-party Code Block or iframe, so these services must be checked separately whenever the site configuration changes.

Managing cookies

On your first visit, the Squarespace cookie banner provides choices about non-essential cookies. You can change or withdraw your choice through the Manage cookies control on the website. You can also delete or block cookies in your browser, although some site features may then work differently.

International transfers

Some providers and their subprocessors may process information outside the United Kingdom, including in the European Economic Area, Switzerland and the United States.

Where UK data protection law requires a safeguard for a restricted transfer, we rely on the provider's applicable safeguard, such as UK adequacy regulations, the UK Extension to an approved data privacy framework, the UK International Data Transfer Agreement or Addendum, or contractual clauses combined with relevant security measures. Further details are available in the provider notices and data-processing terms linked above, or from us on request.

How long we keep information

We keep personal information only for as long as it is needed for the purpose for which it was collected, including legal, accounting and dispute-handling requirements. Our normal periods are:

  • General and B&B enquiries that do not lead to a booking: up to 12 months after the last substantive contact.
  • Venue enquiries that do not lead to a booking: up to 24 months after the last substantive contact, recognising that group programmes may be planned well in advance.
  • Confirmed bookings, contracts, invoices and related financial records: normally six years from the end of the company financial year to which the record relates, and longer where required by law, an insurer or an active dispute.
  • Practical sensitive information: only for as long as it is needed to make and deliver the relevant arrangement, unless a longer period is required for a legal or safety reason.
  • Event-listing information: while the listing is current and for a reasonable archive period, unless the organiser asks for earlier removal and no overriding reason requires retention.
  • Marketing records: until consent is withdrawn or the information is no longer useful for the agreed purpose. We review inactive marketing records and normally remove them after 24 months without engagement. We may keep a minimal suppression record so that we respect an opt-out.
  • Website analytics: according to the cookie periods above and Squarespace's underlying retention arrangements.

We review and delete form submissions from Squarespace Contacts, connected email accounts and any working records in line with these periods. A record may be kept longer where necessary to establish, exercise or defend a legal claim, deal with a complaint, comply with law or protect someone from harm.

Freetobook, Teamup, Google, OpenStreetMap and other independent providers apply their own retention periods to information they process for their own purposes. Teamup states that customer calendar data is deleted no later than 90 days after termination of the service, subject to its standard backup and retention process.

How we protect information

We use proportionate organisational and technical measures to protect personal information. These include limiting account access to authorised people, using password-protected services, using encrypted connections where supported, keeping software and services under review, and deleting information when it is no longer required.

No online service can guarantee absolute security. Please avoid sending highly sensitive information through ordinary web forms or email. Contact us first if a more appropriate method is needed.

Your data protection rights

Depending on the circumstances, you may have the right to:

  • ask for access to your personal information;
  • ask us to correct inaccurate or incomplete information;
  • ask us to erase information;
  • ask us to restrict how information is used;
  • object to processing based on legitimate interests or to direct marketing;
  • receive information you provided in a portable format where the right applies;
  • withdraw consent at any time, without affecting earlier lawful processing; and
  • complain about how your information has been handled.

These rights are not absolute and exemptions may apply. We may ask for reasonable information to confirm your identity and locate the relevant records. We normally respond within one month, subject to the extensions permitted by law.

To exercise a right or make a data protection complaint, email hello@cullernehouse.org or write to the postal address above. Please state that your message concerns data protection and explain what you would like us to review. We will acknowledge a data protection complaint within 30 days and provide an outcome without undue delay.

You also have the right to complain to the Information Commissioner's Office. We would appreciate the opportunity to address your concern first.

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
United Kingdom

Telephone: 0303 123 1113
Website: ico.org.uk

Changes to this notice

We may update this notice when the website, services, providers or legal requirements change. The current version will be published on this page and identified by the date at the top. We will draw attention to a material change where it is reasonable to do so.