The Pax

Privacy Policy

Last updated: August 2026 · Version 2026-08-3

The Pax is committed to protecting your privacy and handling your personal information responsibly.

This Privacy Policy explains what personal information we collect, how we use it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

The Pax provides short-term holiday accommodation and optional wellbeing experiences.

The Pax is the data controller responsible for your personal information. You can contact us at wearethepax@gmail.com, or by post at Shride Barn, Othery, Somerset, TA7 0QL.

If you have any questions about this Privacy Policy or how your personal information is handled, please contact us using the details above.

2. Information We Collect

Depending on how you interact with us, we may collect:

  • Your name
  • Email address
  • Telephone number
  • Billing address
  • Booking information
  • Payment information (processed securely by our payment provider – we do not store your card details)
  • Information you provide when making enquiries
  • Information relevant to optional wellbeing experiences, where you choose to provide it
  • Any communications between you and The Pax
  • If, and only if, you accept advertising cookies: limited technical information about your visit – your IP address, basic browser and device information, and which pages of this website you viewed. This is described in full in section 11 and in our Cookie Policy.

3. How We Use Your Information

We use your information to:

  • Process and manage your booking
  • Communicate with you before, during and after your stay
  • Provide any optional wellbeing experiences you choose to book
  • Respond to enquiries
  • Process payments and refunds
  • Improve our services
  • Meet our legal and accounting obligations
  • Send you news, offers and discounts by email, if you have asked us to
  • Measure whether our advertising on Facebook and Instagram leads to bookings – but only where you have accepted advertising cookies

We only collect information that is reasonably necessary to provide our services.

4. Lawful Basis for Processing

We process your personal information because:

  • It is necessary to fulfil our contract with you when you make a booking.
  • It is necessary to comply with legal obligations.
  • It is in our legitimate interests to operate and improve our business.
  • You have given your consent. This is the basis we rely on for advertising cookies and for marketing emails, and for nothing else.

Where we rely on your consent, you can withdraw it at any time, and withdrawing it is as easy as giving it. Withdrawing consent does not affect anything done before you withdrew it, and it does not affect your booking.

5. Payment Information

Payments are processed securely by Stripe. The Pax does not receive or store your debit or credit card details.

6. Who We Share Your Information With

We will never sell your personal information.

We share information only where necessary with the following service providers, who process it on our behalf and on our instructions:

  • Stripe – payment processing and refunds
  • Google (Firebase) – booking database, member accounts and website functions
  • Webflow – website hosting
  • Resend – sending booking, account and mailing list emails

We may also share information with professional advisers (such as accountants) where required, and with government authorities where we are legally obliged to do so.

These organisations are only given the information necessary to perform their services.

Meta – advertising, and only with your consent

If you accept advertising cookies, this website loads the Meta Pixel, which shares the technical information described in section 11 with Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland.

Meta is not a service provider acting on our instructions in the way the four above are. For the collection of that information and its transmission to Meta, we and Meta act as joint controllers. In plain terms: we decide to place the pixel and we benefit from the measurement; Meta decides how the data is handled once it has it, and uses it for its own purposes as well as ours. We are responsible for asking your permission first and for telling you what happens, which is what this section and the Cookie Policy do. What Meta does with the information afterwards is governed by Meta’s own privacy policy, and you can exercise your rights against either of us.

We do not send Meta your name, email address, telephone number or any details of your booking. If you reject advertising cookies, or make no choice at all, nothing is sent to Meta.

7. International Transfers

Our booking database and website functions are hosted in Europe.

Some of the providers listed above are based outside the UK, or may process limited data outside the UK. Where personal information is transferred outside the UK, we rely on one of the following safeguards:

  • UK adequacy regulations, where the destination country or the receiving organisation is covered by them; or
  • Contractual protections approved for use in the UK, such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

Meta and the United States. Information collected by the Meta Pixel goes first to Meta Platforms Ireland Limited, which is inside the European Economic Area, and is then transferred onward to Meta Platforms, Inc. in the United States. For that onward transfer Meta relies on the UK Extension to the EU–US Data Privacy Framework, and, where that framework does not apply, on Standard Contractual Clauses with the UK Addendum. You should be aware that United States law gives its public authorities powers of access to data that have no exact equivalent in the UK. If you would rather your data did not go there, reject advertising cookies – nothing is transferred, and the website works the same.

If you would like more detail about the safeguards applying to a particular transfer, please contact us using the details in section 1.

8. How Long We Keep Your Information

We keep personal information only for as long as we need it:

  • Booking and financial records – 6 years from the end of the financial year they relate to. This meets HMRC record-keeping requirements and covers the period during which a claim could be brought in relation to your booking.
  • Enquiry correspondence that does not lead to a booking – 24 months.
  • Member account information – for as long as your account is open. If you delete your account, this information is removed at that point, apart from booking and financial records we are required to retain as above.
  • Marketing list membership – until you unsubscribe.
  • Advertising cookies – the cookies set in your browser expire after about 90 days. How long Meta retains what it receives is determined by Meta and set out in its privacy policy. We hold no copy of it ourselves.

When information is no longer required, it is securely deleted.

9. Marketing

If you choose to join our mailing list, we may occasionally send you updates about The Pax, future stays, wellbeing experiences and events, together with offers and discounts.

We ask you to tick a box to confirm you want these emails. We record that you ticked it, the wording you agreed to, and the date, so that we can show your consent was freely given. We use your email address for this purpose only. We do not sell or share it, and we do not use it to build advertising audiences.

You can unsubscribe at any time by clicking the unsubscribe link in our emails or by contacting us directly. Unsubscribing takes effect immediately and we do not ask you to give a reason.

We will not send marketing communications without your consent where consent is required by law.

10. Your Rights

Under UK data protection law, you have the right to:

  • Request access to your personal information.
  • Request correction of inaccurate information.
  • Request deletion of your personal information where applicable.
  • Request restriction of processing in certain circumstances.
  • Object to certain types of processing.
  • Request transfer of your personal data where applicable.
  • Withdraw your consent at any time where processing is based on consent.

If you hold a member account, you can delete it yourself at any time from your dashboard. Deleting your account removes your profile, your messages and your activity records. Booking and financial records are retained for the period set out in section 8, because we are required to keep them.

To withdraw your consent to advertising cookies, use the Cookie settings link at the bottom of any page. You do not need to contact us, and you do not need an account.

To exercise any of these rights, please contact us at wearethepax@gmail.com.

11. Cookies

We use no analytics cookies, and we do not sell browsing data.

The cookies always set on this website are those strictly necessary for it to work:

  • Firebase – keeps you signed in to your member account
  • Stripe – fraud prevention during payment
  • Webflow and Cloudflare – basic site functionality and protection from automated abuse

Cookies of that kind do not require your consent under UK law.

Advertising cookies are different, and we ask first. We advertise The Pax on Facebook and Instagram. To see whether those adverts lead to bookings, we can load the Meta Pixel, which sets cookies in your browser and sends Meta the address of the page you are on, your IP address, and basic browser and device information.

Those cookies are not strictly necessary, so they are not set unless you agree. On your first visit a banner appears offering Reject all and Accept all as equally sized choices. Nothing is loaded, contacted or stored until you press one. If you reject, nothing happens and the site behaves identically.

The full detail – every cookie name, how long each lasts, exactly what is sent and how to change your mind – is set out in our Cookie Policy.

12. Security

We take appropriate technical and organisational measures to protect your personal information from unauthorised access, loss, misuse or disclosure.

While no method of internet transmission is completely secure, we take reasonable steps to safeguard the information you provide.

13. Changes to This Policy

We may update this Privacy Policy from time to time.

The most recent version will always be published on this website with the latest revision date.

14. Contact

If you have any questions about this Privacy Policy or how we handle your personal information, please contact us at wearethepax@gmail.com.

If you are not satisfied with how your information has been handled, you also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk.

← Back to The Pax