The Baxters Collection
NEW TOWN
Privacy Policy
Last updated: 26/08/2026
1. Who we are
This Privacy Policy explains how Sovo Apartments of 7 Baxters Place, Edinburgh EH1 3AF, Collects, uses and protects your personal data when you visit our website (sovo.co.uk), enquire about a stay, or book one of our apartments.
We are the data controller responsible for your personal data. If you have any questions about this policy or how we handle your data, you can contact us at:
- Email: [email protected]
- Phone: 0131 564 0047
- Post: 7 Baxters Place, Edinburgh EH1 3AF
2. What personal data we collect
Depending on how you interact with us, we may collect:
- Contact details – name, email address, phone number, postal address
- Booking details – check-in/check-out dates, number of guests, apartment selected, special requests
- Payment information – processed securely by our payment provider, Stripe (see Section 5)
- Communications – messages you send us by email, phone, WhatsApp, or our website’s contact and enquiry forms
- Website usage data – pages visited, time on site, and browser/device type, collected via Google Analytics (see our Cookie Policy for details)
We collect data about the lead guest who makes the booking.
3. How we use your data and our legal basis for doing so
| What we use it for | Legal basis |
|---|---|
| Processing and managing your booking | Performance of a contract |
| Taking payment | Performance of a contract |
| Responding to enquiries and guest communications | Performance of a contract / legitimate interests |
| Sending pre-arrival information and access instructions | Performance of a contract |
| Improving our website and services | Legitimate interests |
| Complying with legal and tax obligations | Legal obligation |
| Sending marketing communications | Consent |
| Preventing fraud and keeping guests and properties safe | Legitimate interests |
4. Who we share your data with
We only share personal data where necessary, with:
- Stripe, our payment processor, to process card payments securely.
- Google, via Google Analytics, to understand how visitors use our website (see our Cookie Policy)
- Hostify (PMS)
- Our professional advisers (e.g. accountants, solicitors), where necessary
- Law enforcement or regulatory authorities, where we’re required to by law
We do not sell your personal data to third parties.
If you contact us via WhatsApp, your message and phone number are also handled under WhatsApp’s own privacy policy, as WhatsApp is operated by Meta.
5. Payments
Card payments made on our website are processed by Stripe, a PCI-DSS compliant payment provider. We do not store your full card details on our own systems. For details of how Stripe handles your data, see Stripe’s privacy policy.
Security deposit is taken via stripe after confirmation of reservation.
6. Marketing communications
With your consent, we may email you about offers, news and updates from SOVO. You can opt out at any time by clicking “unsubscribe” in any marketing email, or by emailing [email protected].
Regardless of your marketing preferences, you’ll always receive essential communications relating to a booking you’ve made with us (e.g. confirmation and arrival instructions), as these are necessary to fulfil our contract with you.
Our website uses cookies to help it function and to understand how visitors use it, including Google Analytics. For full details of the cookies we use and how to control them, see our Cookie Policy.
8. International data transfers
Some of the third parties we use (such as Google and Stripe) may store or process data outside the UK. Where this happens, we ensure appropriate safeguards are in place – such as Standard Contractual Clauses, or the provider’s participation in a recognised data protection framework – to keep your data protected to UK standards.
9. How long we keep your data
We keep booking and guest data for 6 years after your stay, primarily to meet our accounting, tax and legal record-keeping obligations. Enquiry data from people who don’t go on to book is kept for 12 months and then deleted. You can ask us to delete your data sooner – see Section 11.
10. Keeping your data secure
We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or misuse, including secure payment processing via Stripe and restricted access to our booking systems. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.
11. Your rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate or incomplete data
- Erase your data (“right to be forgotten”), in certain circumstances
- Restrict how we use your data
- Object to our use of your data, including for marketing
- Data portability – receive your data in a portable format
- Withdraw consent at any time, where we rely on consent
To exercise any of these rights, contact us at [email protected]. We will respond within one month, as required by law.
If you’re unhappy with how we’ve handled your data, you also have the right to complain to the UK’s data protection regulator:
Information Commissioner’s Office (ICO) Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF 0303 123 1113 | ico.org.uk
12. Children
Our services are intended for adults. Bookings may only be made by, and our website is not directed at, individuals under 18. We do not knowingly collect personal data from children.
13. Changes to this policy
We may update this Privacy Policy from time to time – for example, to reflect changes in our practices or in the law. The version in force at the time you use our website or make a booking will apply. We recommend checking this page periodically.
14. Contact us
If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:
- Email: [email protected]
- Phone: 0131 564 0047
- Post: 7 Baxters Place, Edinburgh EH1 3AF