Privacy Notice | The Noble House of Brattleby

1. Who we are

This Privacy Notice describes how The Noble House of Brattleby (the "House", "we", "us", "our") — comprising the Feudal Barony of Brattleby in Lincolnshire, England — collects, processes, stores and shares personal data when you visit brattleby.com, attend our events, correspond with the Household, or otherwise engage with our services.

For the purposes of the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018, the Data Controller is the Private Office of the Baron of Brattleby, acting through the Household of Honorary Lord Răzvan Vasile (by marriage) and Lady Nicoleta Vasile, 12th Baroness of Brattleby.

2. Information we collect

We may collect and process the following categories of personal data:

Identity & contact data — full name, title, postal address, email, telephone number.
Correspondence data — letters, enquiries, event registrations, RSVPs, dietary or accessibility requirements.
Membership & patronage data — payment and patronage records where a transaction exists, and attendance records. The House does not currently accept donations.
Technical data — IP address (in hashed form), browser type, operating system, device identifiers, referring URL.
Usage data — pages visited, time on page, interactions with interactive features (Ancestor Chat, Living Portraits, Sound Map, Ghost Stories, gamification).
Marketing & communications data — preferences in receiving newsletters and ceremonial announcements.
Photographic & filming data — images and recordings captured at House occasions and public events (subject to signage and opt-out).

We do not knowingly collect special category data (health, religion, ethnicity, biometric or political data) unless you provide it voluntarily for accessibility or pastoral purposes.

3. Lawful bases for processing

Under Article 6 of the UK GDPR, we rely on the following lawful bases:

Consent (Art. 6(1)(a)) — for marketing emails, optional cookies, voluntary registrations.
Contract (Art. 6(1)(b)) — to fulfil ticketing, membership, weddings, corporate hire, and event obligations.
Legal obligation (Art. 6(1)(c)) — to comply with HMRC, charity reporting, safeguarding and licensing duties.
Legitimate interests (Art. 6(1)(f)) — to safeguard House occasions, prevent fraud, maintain heritage records, conduct ceremonial archives.
Vital interests (Art. 6(1)(d)) — in medical or safety emergencies at House occasions.

4. How we use your data

To respond to enquiries, RSVPs and correspondence addressed to the Household.
To administer membership of the Society of Brattleby and the Order of Honour.
To organise events including the Winter Banquet, Noble Tea, Leaders' Awards Gala and private hire.
To send the Brattleby Chronicle newsletter. Your address is recorded only with an explicit consent tick, and is held as awaiting confirmation until it is confirmed. Confirmation is possible only from a link inside a message delivered to that address itself; the confirmation code is never shown in your browser, returned by our interfaces, or recorded in analytics. Where no email provider is configured, the address simply stays awaiting confirmation and you are shown a management link so you can remove it. Nothing is sent to an unconfirmed address, and any address can be removed at any time from its unsubscribe link.
To safeguard House occasions, family, staff, guests and historic collections.
To improve the website experience, accessibility and SEO performance.
To maintain ceremonial archives of significant historical record.

5. Data sharing

We never sell your personal data. We share it only with carefully selected processors bound by appropriate data-processing terms. Categories of processors we may use include:

Hosting & backend — managed cloud infrastructure (EU/UK regions where available) for website, database and serverless functions.
Payments — Stripe Payments Europe Ltd, which processes card payments and holds the payment record. The House does not receive or store card details.
Email — a transactional email provider, used only once configured, for newsletter confirmation and correspondence delivery.
Analytics — Google Analytics 4 (Google Ireland Ltd). The GA4 library may load with analytics_storage denied by default. Analytics storage and Brattleby conversion events are enabled only after explicit analytics consent; limited consent-mode pings may occur before consent. It receives only a fixed allow-list of non-identifying event parameters. Your name, email address, message text, payment identifiers and session identifiers are never sent to it.
Public authorities — only where required by law (e.g. court order, safeguarding, HMRC).

International transfers (e.g. to the United States for AI inference) are safeguarded by Standard Contractual Clauses and the UK International Data Transfer Addendum where applicable.

6. Retention policy

There is no automated deletion job on this website, so we do not publish fixed retention periods we could not honour. Records are kept only for as long as they are required for the service you asked for, for legal, tax and accounting obligations, for security, and for suppression records that keep an unsubscribed address unsubscribed. Retention is reviewed manually and records are deleted at that review, or earlier on request.

Enquiry correspondence — kept while the matter is live and for a reasonable period afterwards.
Event and banquet registrations, payment and patronage records — kept as long as UK tax and accounting law requires.
Newsletter addresses — kept until you unsubscribe; the unsubscribed record is then kept as a suppression entry so you are not re-added.
Website and function logs — retained by the hosting provider on its own schedule.
Editorial and heritage archives — kept indefinitely, in the public interest.

You may ask for earlier erasure at any time by writing to privacy@brattleby.com.

7. Your rights under UK GDPR

You have the right to:

Be informed — about the collection and use of your data (this notice).
Access — request a copy of your personal data (Subject Access Request).
Rectification — correct inaccurate or incomplete data.
Erasure — request deletion ("right to be forgotten") subject to legal exceptions.
Restrict processing — limit how we use your data.
Data portability — receive your data in a structured, machine-readable format.
Object — to processing based on legitimate interests or for direct marketing.
Withdraw consent — at any time, without affecting prior lawful processing.
Lodge a complaint with the Information Commissioner's Office (ico.org.uk, 0303 123 1113).

To exercise any right, write to the Private Secretary at privacy@brattleby.com. We respond within one calendar month.

8. Security

We employ reasonable, industry-standard safeguards: encrypted database storage and transit (TLS), row-level security on personal records, hashed credentials, restricted Household access, audit logs and automated backups. No system is wholly impregnable; we will notify the ICO and affected individuals where a qualifying breach occurs, in line with statutory timeframes.

9. Children's privacy

Our services are not directed at children under 13. We do not knowingly collect personal data from children without verifiable parental consent. School visits are organised exclusively through accompanying institutions who act as data controllers for pupil records.

10. Automated decisions & AI

We employ AI systems (Lovable AI Gateway) for content generation, the Ancestor Chat experience and Living Portrait narration. None of these systems make legal or significant decisions about you. We do not send names, email addresses or account identifiers into these prompts, and we do not use conversations to train any model ourselves. We cannot independently guarantee what an upstream model provider does with data it receives, so please do not enter personal or confidential information into these features; they are governed by the gateway and model providers' own terms.

11. Changes to this notice

We may update this Privacy Notice to reflect legal, technical or ceremonial changes. The "last updated" date above always reflects the current version. Material changes will be announced via the homepage and to confirmed newsletter recipients.

12. Contact us

Data protection enquiries are handled by the Private Office by email. No statutory Data Protection Officer has been appointed, and no public postal address is published for this website.
Email: privacy@brattleby.com
General correspondence: office@brattleby.com