Privacy Policy

Who we are and what this policy covers

Browntravels is a UK-based luxury hotel editorial platform. We publish independent hotel reviews, destination guides and journal features, and we work with hotels on clearly labelled partnership and advertising placements.

This policy explains what personal data we collect when you use the Browntravels website, why we collect it, who we share it with and how you can exercise your rights. It applies to everyone who visits the site, subscribes to our newsletter, contacts us or opens an account. If you have any questions about it, email us at hello@browntravels.org.

The data we collect

We deliberately collect as little personal data as we can. We do not ask for payment details from readers, we do not run booking services and we never buy data about you from third parties. The information we hold falls into a small number of categories.

• Newsletter details: your email address when you subscribe to the Browntravels newsletter, together with a record of your subscription and the emails we have sent you.
• Partnership enquiries: the name, email address, hotel or company name and message details you provide when you contact us about advertising or partnership opportunities.
• Optional accounts: if you choose to create an account, the email address and credentials used to sign in, and any preferences saved to that account.
• Cookies and local storage: small pieces of data stored in your browser that remember your cookie consent choices and any hotels you have saved as favourites.
• Correspondence: emails you send to us, including correction requests and accessibility feedback, so that we can respond and keep a record of the exchange.

How and why we use your data

We use your data only for the purposes you would reasonably expect. Newsletter email addresses are used solely to send you the editions you signed up for, and every email includes a one-click unsubscribe link. Partnership enquiry details are used to respond to your enquiry and, where a partnership goes ahead, to manage that relationship.

Account data is used to sign you in and keep your saved preferences in sync. Cookie and local storage data is used to remember your consent choices and favourites so the site behaves consistently between visits.

Our legal bases under UK GDPR are consent (for the newsletter and non-essential cookies), performance of a contract or steps towards one (for accounts and partnership enquiries) and legitimate interests (for keeping the site secure and responding to correspondence). We never sell your personal data, and we never share it with third parties for their own marketing.

Who processes your data on our behalf

Like most modern websites, we rely on a small number of trusted service providers to run Browntravels. Each acts as a processor on our instructions, under a written agreement, and only for the purposes described in this policy.

• Supabase: hosts our database and provides authentication for optional accounts. Newsletter subscriptions, partnership enquiries and account data are stored here.
• Resend: delivers our email newsletter and transactional emails. Resend processes the email addresses of subscribers in order to send messages on our behalf.

How long we keep your data

We keep newsletter email addresses for as long as you remain subscribed, and we remove them from our active mailing list promptly when you unsubscribe. Partnership enquiry records are kept for as long as needed to handle the enquiry and any resulting relationship, after which they are deleted or anonymised.

Account data is kept while your account is active and deleted when you close it, subject to short technical backup windows. Consent records are retained so we can demonstrate that consent was given, as UK GDPR requires.

Your rights under UK GDPR

UK data protection law gives you a set of rights over your personal data. You can exercise any of them by emailing hello@browntravels.org, and we will respond within one calendar month. There is no charge for a reasonable request.

• The right to access a copy of the personal data we hold about you.
• The right to have inaccurate data corrected.
• The right to have your data erased where we no longer need it.
• The right to restrict or object to certain processing, including any direct marketing.
• The right to receive your data in a portable format where processing is based on consent or contract.
• The right to withdraw consent at any time, for example by unsubscribing from the newsletter or changing your cookie preferences.
• The right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, if you are unhappy with how we have handled your data.

Security, international transfers and changes

We take proportionate technical and organisational measures to protect your data, including encrypted connections, access controls and the minimisation described above. Where our service providers store data outside the UK, transfers are protected by recognised safeguards such as the UK's data bridge arrangements or standard contractual clauses.

We may update this policy from time to time as the site or the law changes. The date at the top of this page shows when it was last revised, and significant changes will be highlighted on the site.