What we hold, and why.

Controller. Eight Obsidia Ltd, trading as Avory Astoria, registered in England and Wales, company number 16955167. Contact: info@avoryastoria.com.

What we collect. Your name, email address and phone number when you reserve or enquire; the details of your reservation; the messages you send us; and, if you reach us from an advertisement or referral, the campaign reference that brought you. Nothing else.

Why, and our lawful basis. We use your details to confirm and deliver what you reserve and to respond to your enquiries — this is the performance of our contract with you (UK GDPR Article 6(1)(b)). We keep client-relationship records and measure how well the site and our outreach work under our legitimate interest in running and improving the business (Article 6(1)(f)). Advertising and measurement that rely on non-essential cookies happen only where you consent (Article 6(1)(a)). We do not sell your data.

Who processes it. Stripe processes payments — your card details go to Stripe directly and never touch our servers. Our site runs on Vercel with data held in Supabase (London region); confirmation email is sent by Resend; WhatsApp messages are carried by WhatsApp Business; our client-relationship records, and the live chat widget on this site, are held in GoHighLevel (HighLevel Inc); and, where you consent, advertising measurement is carried out by Meta (Facebook) using a hashed, non-reversible form of your email and phone. Each acts under its own published terms and only on our instructions.

International transfers. Some of these providers — including Stripe, Vercel, Resend, GoHighLevel and Meta — are based in the United States. Where your personal data is transferred outside the UK we rely on the UK International Data Transfer Agreement (or the UK Addendum to the EU Standard Contractual Clauses), together with each provider’s own safeguards, to protect it to UK standards.

Accounts. If you create an account we also hold your sign-in email and the reservations made under it, so you can see them in one place. Ask us to delete your account at any time by writing to info@avoryastoria.com; we remove it within one month, keeping only what accounting law requires us to keep.

Retention. Reservation records are kept for as long as accounting law requires — six years — then removed. Enquiry messages that do not become reservations are removed within twelve months.

Your rights. Under UK GDPR you may ask for a copy of what we hold, ask us to correct it, ask us to delete it, or object to processing based on legitimate interests. Write to info@avoryastoria.com; we respond within one month. Complaints lie to the ICO, ico.org.uk.

Cookies. Essential cookies keep your itinerary, your sign-in and checkout working; the site cannot function without them, so they are always on. Advertising and measurement cookies — for example Meta’s _fbp and _fbc — are set only if you accept them in our cookie banner. Decline, and nothing non-essential is set. You can change your choice at any time.

Live chat. The chat widget on this site sets nothing until you start a conversation. If you message us there, the conversation and the details you give are held in GoHighLevel as an enquiry, on the same basis as a message sent by email or WhatsApp.