Privacy Policy
Last updated: 7 October 2026
THW Retreats respects your privacy. This policy explains how we collect, use, store and share personal information when you visit our website, contact us or take part in a retreat.
1. Who is responsible for your information?
THW Retreats is a trading name of Once upon a Peacock Ltd.
Once upon a Peacock Ltd. is the data controller responsible for the personal information covered by this policy.
Address: Unit 20, 11 North Ave, Clydebank G81 2QP.
Email: [privacy contact email]
2. Information we collect
Depending on how you interact with us, we may collect:
Your name and contact details.
Messages, enquiries, feedback and complaints.
Emergency contact details.
Dietary requirements, allergies, relevant health information and accessibility needs that you provide.
Marketing preferences and records of consent.
Photographs or videos where you have agreed to their use.
Website information, such as your IP address, device, browser and interactions with our pages, depending on the technologies in use and your settings.
3. Where information comes from
We usually collect information directly from you through enquiry forms, emails and retreat communications.
We may also receive relevant information from someone contacting us on your behalf or from suppliers involved in delivering your retreat.
Our website is hosted by Squarespace. We also use Google Analytics and Google Search Console, as explained in section 11.
If you provide another person’s details, please make sure they know you have shared them and direct them to this policy. We will also provide privacy information to them where required.
4. How and why we use your information
Enquiries and customer support
We use your information to answer questions and provide support. Our lawful basis is our legitimate interest in responding to people who contact us. Where your enquiry involves steps you ask us to take before entering into a contract, we rely on that lawful basis instead.
Retreat arrangements
We use relevant information to organise and deliver the services you request. Our lawful basis is performance of a contract, or taking steps at your request before entering into one.
Legal requirements
We use relevant records to meet legal requirements. Our lawful basis is compliance with a legal obligation.
Security, complaints and legal claims
We use relevant information to protect our systems, investigate concerns and establish or defend legal claims. Our lawful basis is our legitimate interest in operating a secure business and resolving disputes, or a legal obligation where applicable.
Emergency contacts
We use emergency contact details for our legitimate interest in supporting guest welfare and contacting an appropriate person if necessary.
Website analytics
We use website analytics to understand how visitors find and use our website and to improve its content and usability. We rely on consent for personal information collected through optional analytics cookies.
Marketing and promotional photographs
We use your information for these purposes with your consent, as explained below.
5. Health, allergies and other sensitive information
Some information about health, allergies or dietary requirements may be special category data.
Where needed to provide arrangements you request, our lawful basis is performance of the contract. We will also ask for your explicit consent to use relevant special category information and share it with the people who need it, such as an instructor or chef.
We request only information relevant to your retreat arrangements.
You may withdraw consent by contacting us. This does not affect processing already carried out lawfully. We will discuss whether we can still provide the arrangements safely and any options available.
In a serious emergency, we may use or share necessary information to protect someone’s vital interests. For special category data, this basis applies only where the person is physically or legally incapable of consenting.
Where necessary for legal claims, we may retain relevant sensitive information under the legal claims condition, with an appropriate lawful basis.
6. Marketing
We will send promotional emails about retreats where you have opted in.
You can withdraw consent at any time using the unsubscribe link or by contacting us.
You have the right to object to the use of your personal information for direct marketing at any time.
Opting out of marketing will not stop essential communications about a retreat you are attending.
We may retain a minimal record of your opt-out to ensure that we respect it.
7. Photographs and videos
We will ask for separate consent before using identifiable photographs or videos of you on our website, social media or other promotional materials.
You can decline without affecting your participation in a retreat.
You may withdraw consent by contacting us. We will stop future use and remove material from channels we control where reasonably possible. We may be unable to recall printed materials already distributed or copies shared independently by others.
8. Who we share information with
We share relevant information only where needed for the purposes described in this policy. Recipients may include:
Accommodation providers and retreat venue staff.
Instructors, chefs and activity providers.
Website, email and IT providers.
Accountants, insurers and professional advisers.
Emergency services or relevant authorities where necessary.
Our website providers include:
Squarespace
Squarespace hosts our website and supports website functions, including forms and cookie preference controls.
Further information is available in Squarespace’s Privacy Policy.
We use Google Analytics for website analytics and Google Search Console for reports about our website’s performance in Google Search.
Further information is available in Google’s Privacy Policy.
Providers acting on our instructions must handle information under appropriate contractual safeguards. Some providers may act as independent data controllers for particular activities.
9. Information used outside the UK
Delivering overseas retreats may require us to share relevant information with suppliers at the destination, including Spain for our Ibiza retreats.
Squarespace, Google and other technology providers may also process information outside the UK, including in the United States.
Where an international transfer requires safeguards, we use an applicable UK adequacy regulation or another lawful transfer mechanism, such as approved contractual safeguards.
You can contact us for information about the safeguards relevant to your data and how to obtain a copy.
10. How long we keep information
We keep personal information only for as long as necessary for its purpose.
When deciding how long to retain information, we consider:
Whether it is still needed to respond to your enquiry or provide a service.
Whether the retreat has ended and any related issues have been resolved.
Whether we have a legal obligation to retain it.
Whether it is needed for an incident, complaint or legal claim.
Whether your consent remains valid and the information is still needed for the purpose you agreed to.
Routine health, allergy, dietary and emergency contact information is deleted when it is no longer needed for your retreat arrangements, unless relevant information must be retained for an incident or legal claim.
We retain marketing information while your consent remains valid and may keep a minimal suppression record after you opt out.
Website analytics information is subject to the retention settings of the relevant service. Cookies and similar technologies may last for a browsing session or a longer period, depending on their function.
We securely delete or anonymise personal information when it is no longer needed.
11. Cookies and website analytics
Our website is hosted by Squarespace and uses its cookie banner and cookie preference settings.
Cookies are small files stored on your device. Similar technologies may also store information or support website functions.
Essential cookies
Essential cookies and similar technologies support necessary functions, such as security and remembering your cookie choices. These do not require consent where they are strictly necessary to provide a service you request.
Optional cookies
Optional cookies may support performance and analytics, helping us understand how visitors use the website.
We ask for your consent before placing optional analytics cookies. You can accept them, decline them or choose your preferences through Squarespace’s cookie banner.
You can change your choices or withdraw consent using the website’s Manage Cookies control. Withdrawing consent does not affect processing carried out lawfully before withdrawal.
Google Analytics
We use Google Analytics to understand website traffic and interactions, including which pages visitors view, how they reach the website and how they navigate it.
Information may include device and browser details, approximate location, page interactions and cookie identifiers. We use this information to improve the website and its content.
Google Analytics cookies are controlled through our cookie consent settings and are used only after you consent to the relevant category.
Google Search Console
We use Google Search Console to understand how our website performs in Google Search. Its reports include search queries, impressions, clicks and indexing information.
Search Console reports do not identify individual searchers to us. Verifying the website with Search Console does not itself add visitor analytics cookies or enable Google Analytics tracking.
Managing cookies
Use the options in our Squarespace cookie banner to accept, decline or manage optional cookies. To revisit your choices, select the website’s Manage Cookies control.
You can also manage or delete cookies through your browser settings. Blocking essential cookies may affect some website functions.
Information about the purposes and durations of Squarespace cookies is available in Squarespace’s cookie guidance.
Information about Google Analytics cookies is available in Google’s Analytics cookie guidance.
12. Keeping information secure
We use appropriate technical and organisational measures to protect personal information. Access is limited to people who need it for their work.
Please avoid sending unnecessary medical information through general enquiry forms.
13. Your rights
Depending on the circumstances, you may have the right to:
Access your personal information.
Correct inaccurate or incomplete information.
Request deletion.
Restrict how we use it.
Receive certain information in a portable format.
Object to processing based on legitimate interests.
Withdraw consent where we rely on it.
These rights are subject to legal conditions and exceptions.
To make a request, contact us using the email address in section 1. We may need to verify your identity. We normally respond within one month, subject to any extension permitted by law.
If information is necessary to provide a service and you do not supply it, we may be unable to provide that service. Optional marketing, analytics and photography consent are not required to attend a retreat.
14. Complaints
If you have a concern about how we handle personal information, contact us using the email address in section 1.
You also have the right to complain to the Information Commissioner’s Office, the UK data protection regulator, without contacting us first.
15. Changes to this policy
We may update this policy when our services or data practices change. The latest version will appear on this page with its update date.
Where required, we will notify you of significant changes or seek fresh consent.