Last updated: 26 August 2026
Welcome to the Privacy Notice for The Spa at Laceby Manor.
Laceby Manor Resort Limited respects your privacy and is committed to protecting your personal information. This notice explains how we collect, use, store and share your personal information when you:
visit our website;
make or manage a Spa booking;
book or receive a treatment;
complete a Treatment Intake Form;
become a member or use our facilities;
contact us by telephone, email, messaging service or another communication channel;
interact with us on social media;
subscribe to marketing communications; or
otherwise interact with The Spa at Laceby Manor.
It also explains your rights under UK data protection law.
ContentsImportant information and who we are
The information we collect about you
Health and treatment information
How we collect your information
How we use your information
Marketing
Sharing your information
International transfers
Data security
Data retention
Your legal rights
Data protection complaints
Cookies and online technologies
Changes to this Privacy Notice
Laceby Manor Resort Limited is the controller responsible for your personal information.
When we refer to “Laceby Manor”, “The Spa”, “we”, “us” or “our” in this Privacy Notice, we are referring to Laceby Manor Resort Limited.
Contact DetailsLegal entity: Laceby Manor Resort Limited
Company registration number: 07502525
VAT number: GB112177058000
Registered office:
107 Cleethorpe Road
Grimsby
DN31 3ER
Business address:
Laceby Manor
Barton Street
Laceby
North East Lincolnshire
DN37 7LD
Data Protection Contact: Head of People & Culture
Email: info@lacebymanor.co.uk
Telephone: 01472 873468
If you have any questions about this Privacy Notice, how we use your information or wish to exercise your data protection rights, please contact us using the details above.
2. THE INFORMATION WE COLLECT ABOUT YOUPersonal information means any information relating to an identified or identifiable individual.
Depending on how you interact with us, we may collect the following categories of information:
Identity Data
Including your name, title, date of birth, username or membership details.
Contact Data
Including your address, email address and telephone number.
Booking & Transaction Data
Including details of Spa Days, treatments, memberships, accommodation packages or other services you have booked or purchased, booking history, appointment details, payments, refunds and other transactions.
Financial Data
Including information required to process payments and refunds. Payment information may be processed on our behalf by third-party payment providers.
Treatment & Health Data
Information you provide to us in connection with a treatment or Spa service, including information concerning:
pregnancy;
allergies;
medical conditions;
injuries;
medication;
recent surgery or procedures;
skin conditions or sensitivities;
treatment contraindications; and
any other health information relevant to assessing whether a treatment is appropriate for you.
Health information is classed as special-category personal data and receives additional protection under data protection law.
Profile Data
Including your preferences, interests, treatment preferences, feedback, complaints and survey responses.
Technical Data
Including your IP address, browser type and version, device information, operating system, login information and other technology used to access our website or online services.
Usage Data
Information about how you use our website, booking services and other digital services.
Marketing & Communications Data
Including your preferences about receiving marketing communications from us and your communication preferences.
We may also create and use aggregated or anonymised information for statistical, analytical and business purposes. Where information has been genuinely anonymised so that an individual can no longer be identified, it is not treated as personal information under data protection law.
3. HEALTH AND TREATMENT INFORMATIONWhere you book a Spa treatment, we may need to collect relevant information about your health to assess whether the treatment is appropriate and whether it should be adapted.
We only ask for health information that we reasonably require for treatment suitability, safety and the provision of the service you have requested.
This information may be collected through:
our Treatment Intake Form;
consultation with your therapist;
information you provide when booking;
information you provide to our Spa Reception or Reservations team; or
subsequent communications with us.
Your health information will only be accessible to members of staff who reasonably require it in order to manage your booking, assess treatment suitability or provide your treatment.
For special-category health information, we will identify an appropriate condition under data protection law. Where we rely upon your explicit consent, we will ask you to provide that consent clearly, for example as part of your Treatment Intake Form.
You may withdraw consent where consent is the basis on which we are processing your health information. However, if the information is necessary for us to establish whether a treatment can safely and appropriately be provided, withdrawing or declining to provide that information may mean that we are unable to provide the treatment.
4. HOW WE COLLECT YOUR INFORMATIONWe collect information in a number of ways.
Information you give us directlyYou may provide information when you:
make a booking;
purchase a service;
become a member;
complete an Intake Form;
speak with a therapist;
contact Reception or Reservations;
complete a form on our website;
subscribe to marketing;
enter a competition;
leave feedback or a review;
make a complaint; or
communicate with us by telephone, email, messaging service or social media.
When you use our website or digital services, certain Technical and Usage Data may be collected automatically through cookies and similar technologies.
Information from third partiesWe may receive relevant information from third parties where appropriate, including:
booking and reservation platforms;
payment providers;
website and technology providers;
accommodation or hospitality booking systems;
marketing and communications platforms;
analytics providers; and
social media platforms where you interact with us through those services.
We only use personal information where we have a lawful basis to do so.
The lawful bases we most commonly rely upon are:
Performance of a contract
Where the information is necessary to provide a service you have booked or requested or to take steps at your request before entering into a contract.
Legal obligation
Where we need to process information in order to comply with a legal or regulatory requirement.
Legitimate interests
Where processing is necessary for our legitimate business interests and those interests are not overridden by your rights and interests.
Our legitimate interests may include operating and improving Laceby Manor, administering bookings and memberships, maintaining appropriate records, providing customer service, preventing fraud, protecting our systems and understanding how guests use our services.
Consent
Where you have given us consent for a specific purpose.
Where consent is relied upon, you may withdraw it at any time.
We may use your information to:Manage bookings and provide services
To make, confirm, amend and manage your booking and provide the treatment, Spa experience, membership or other service you have requested.
Lawful basis: performance of a contract.
Assess treatment suitability
To review health information, identify contraindications and determine whether a treatment should be provided, adapted or postponed.
Lawful basis: performance of a contract and, where applicable, your explicit consent for special-category health information.
Process payments and refunds
To take payment, administer charges and process refunds.
Lawful basis: performance of a contract and legal obligations where applicable.
Communicate with you about your booking
Including confirmations, reminders, pre-arrival information, operational updates and other information relating to your visit.
Lawful basis: performance of a contract.
Administer memberships
To manage membership access, payments, benefits, guest passes and communications.
Lawful basis: performance of a contract.
Respond to enquiries, feedback and complaints
To investigate and respond appropriately to customer-service or data-protection matters.
Lawful basis: legitimate interests and legal obligations where applicable.
Protect our business and systems
Including fraud prevention, IT security, troubleshooting, system maintenance and establishing, exercising or defending legal claims.
Lawful basis: legitimate interests and legal obligations where applicable.
Improve our services
To understand how guests use our services, analyse feedback and improve our Spa, website, booking journey and customer experience.
Lawful basis: legitimate interests.
Meet legal, accounting and regulatory requirements
Lawful basis: legal obligation.
6. MARKETINGWe may send you information about Laceby Manor experiences, treatments, Spa services, memberships, events and other products or services that we think may be of interest to you where data protection and electronic marketing laws permit us to do so.
Depending on the circumstances, we may send electronic marketing where:
you have given us your consent; or
the law permits us to contact existing customers about similar products or services and the requirements of the applicable “soft opt-in” are satisfied.
Where we rely on the soft opt-in, you will have been given an opportunity to opt out when your details were collected and will be given a clear opportunity to opt out in every subsequent marketing communication.
You can unsubscribe from marketing at any time by:
using the unsubscribe link in a marketing email;
following the opt-out instructions provided in a message; or
contacting us directly.
Opting out of marketing will not prevent us from sending you necessary service communications concerning an existing booking, membership or account.
We will not sell your personal information to third parties.
We will obtain appropriate consent before sharing your personal information with another organisation for that organisation’s own direct marketing where consent is required.
7. SHARING YOUR INFORMATIONWe may share your personal information where reasonably necessary with trusted third parties including:
booking and reservation system providers;
payment processors;
IT, hosting and cloud service providers;
customer relationship and communications platforms;
website and analytics providers;
marketing service providers;
professional advisers including accountants, lawyers and insurers;
HM Revenue & Customs, regulators and other authorities where required by law; and
prospective purchasers, investors or advisers in connection with a sale, merger, restructuring or transfer of all or part of our business.
Where a third party processes personal information on our behalf, we require appropriate contractual and security arrangements to protect your information.
We only provide third parties with the information reasonably required for the relevant purpose.
8. INTERNATIONAL TRANSFERSSome of the technology, booking, payment, communications or other service providers we use may process or store personal information outside the United Kingdom.
Where this constitutes a restricted international transfer under UK data protection law, we will ensure that an appropriate transfer mechanism is in place.
Depending on the circumstances, this may include:
transferring information to a country or organisation covered by UK adequacy regulations;
using the UK International Data Transfer Agreement;
using the UK International Data Transfer Addendum together with applicable contractual clauses;
relying on another legally recognised safeguard; or
relying on a permitted exception where appropriate.
Where required, we will also carry out the appropriate assessment of the protection provided to your information.
You may contact us if you would like further information about safeguards used for a particular transfer.
9. DATA SECURITYWe take appropriate organisational and technical measures to protect personal information against accidental loss, unauthorised access, alteration, disclosure or misuse.
Access to personal information is restricted to employees, contractors and service providers who reasonably require access for their role or for the provision of services to us.
Individuals with access to personal information are required to respect its confidentiality and process it appropriately.
We have procedures in place for responding to suspected personal-data breaches and will notify affected individuals and the Information Commissioner’s Office where we are legally required to do so.
Because health information is particularly sensitive, we take additional care to limit access to Treatment Intake Forms and other health information to those who reasonably require it.
10. DATA RETENTIONWe keep personal information only for as long as reasonably necessary for the purposes for which it was collected, including satisfying legal, accounting, insurance, regulatory and reporting requirements and establishing, exercising or defending legal claims.
Different categories of information may therefore be retained for different periods.
When determining an appropriate retention period, we consider:
the purpose for which the information was collected;
the amount and nature of the information;
its sensitivity;
the potential risk of harm if it were accessed or disclosed without authorisation;
legal and regulatory requirements;
insurance requirements;
relevant limitation periods; and
whether the purpose can be achieved using less information.
Certain financial, VAT and accounting records are normally retained for six years where this is necessary to meet applicable tax and accounting requirements.
Treatment consultation and health information is retained only for as long as reasonably required for treatment records, continuity of service, safety, complaints, insurance and legal purposes and in accordance with our retention procedures.
Marketing information may be retained for as long as you remain subscribed. We may retain a limited record that you have unsubscribed to ensure that your marketing preference continues to be respected.
Where information is no longer required, it will be securely deleted or anonymised.
Where information has been irreversibly anonymised so that it can no longer identify you, we may retain and use that anonymous information for statistical or analytical purposes.
11. YOUR LEGAL RIGHTSDepending on the circumstances, data protection law gives you the right to:
Request access
Ask for a copy of personal information we hold about you.
Request correction
Ask us to correct inaccurate or incomplete information.
Request erasure
Ask us to delete personal information where there is no lawful reason for us to continue holding it.
Object to processing
Object to certain processing based upon legitimate interests and to the use of your personal information for direct marketing.
Request restriction
Ask us to suspend or limit the way we use your information in certain circumstances.
Request data portability
Ask for certain information you have provided to us to be supplied in a structured, commonly used and machine-readable form where the right applies.
Withdraw consent
Withdraw your consent at any time where we rely upon consent to process your information.
Withdrawal of consent does not affect the lawfulness of any processing carried out before consent was withdrawn.
Some of these rights are subject to exceptions and will not apply in every circumstance.
You will not normally have to pay a fee to exercise your rights.
We may need to request information from you to confirm your identity before responding to a request.
We will normally respond to a valid request within one month, subject to any extension permitted by law.
12. DATA PROTECTION COMPLAINTSIf you are concerned about the way we have collected, used, stored or shared your personal information, you have the right to make a data-protection complaint directly to us.
You can do this by contacting:
Data Protection Contact
Head of People & Culture
Laceby Manor Resort Limited
Email: info@lacebymanor.co.uk
Telephone: 01472 873468
We will acknowledge a data-protection complaint within 30 days of receiving it.
We will take appropriate steps to investigate the complaint, keep you informed where appropriate and communicate the outcome without undue delay.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection.
We would appreciate the opportunity to consider and resolve your concerns directly in the first instance.
13. COOKIES AND ONLINE TECHNOLOGIESOur website and digital services may use cookies and other technologies which store information on, or access information from, your device.
These technologies may be used to:
make our website function correctly;
remember preferences;
maintain security;
understand how our website is used;
measure performance; and
support advertising or marketing where applicable.
Where consent is required by law, we will ask for your consent before using non-essential cookies or similar technologies.
Some technologies may be used without consent where an applicable legal exception allows us to do so.
You can manage your choices through the cookie controls provided on our website and may withdraw or change your consent where applicable.
For further information about the technologies we use, their purposes and how long they remain active, please refer to our separate Cookie Policy.
14. CHANGES TO THIS PRIVACY NOTICEWe may update this Privacy Notice from time to time to reflect changes to:
our services;
the way we use personal information;
the systems and providers we use; or
applicable laws and regulatory guidance.
The most recent version will be published on our website and the last updated date will be shown at the top of this notice.
Please keep us informed if your personal information changes during your relationship with us so that the information we hold remains accurate and current.
THIRD-PARTY LINKSOur website or communications may contain links to websites, applications or services operated by third parties.
We do not control those third-party services and are not responsible for their privacy practices. We encourage you to review the privacy information provided by those organisations when using their services.