Privacy Policy

Who we are

Land & Legacy operates landandlegacy.uk, a heritage property discovery platform, and Hidden Britain (hiddenbritain.uk), a weekly newsletter about places worth remembering across the UK. The data controller for both is Land & Legacy.

Contact: [email protected]

What data we collect and why

Newsletter subscribers

When you subscribe to Hidden Britain, we collect your email address. We use it to send you the newsletter and manage your subscription. Optional subscription analytics are described below.

Subscriptions are managed via Beehiiv (beehiiv.com), a US-based email platform. Beehiiv acts as a data processor on our behalf under a data processing agreement. Your email address is stored on their infrastructure. Beehiiv's own privacy policy is available at beehiiv.com/privacy.

We do not sell or rent subscriber data. The service providers described in this policy process data on our behalf.

Map and web app usage

You can browse the map and property pages without an account and without submitting any personal data. If you save visited or wishlist properties while signed out, that data is stored locally on your own device and is not transmitted to us.

The map uses Mapbox to render tiles. Mapbox may collect technical data about tile requests in accordance with their privacy policy (mapbox.com/legal/privacy).

Accommodation partners

Stay Nearby links use a heritage property's coordinates to find accommodation through Stay22. We may earn commission on bookings. If you allow accommodation partners in Cookie settings, Stay22's LetMeAllez script also runs to optimise links and attribute bookings, and may process page, device and browser storage information. This is separate from analytics consent. You can withdraw permission in the footer. See our cookie policy and Stay22's privacy policy. Booking providers apply their own privacy notices when you visit them.

Accounts

Creating an account is optional. It lets you back up your saved places and use them across devices. When you create an account we collect your email address and store your saved places (visited properties, wishlist, visit dates and notes) on our database, hosted by Supabase (supabase.com) on servers in the European Union. Supabase acts as a data processor on our behalf.

Sign-in codes are sent by email via Resend (resend.com), which acts as a data processor for that purpose only.

Account sign-up includes a subscription to the Hidden Britain newsletter, stated plainly at the point of sign-up. You can unsubscribe at any time via the link in any issue without affecting your account.

You can delete your account at any time from your account page. Deletion removes your email address and all saved places from our database. Saved places held locally on your device are unaffected.

Contact and correspondence

If you contact us by email, we retain that correspondence in order to respond and for our records. We do not use it for any other purpose.

Property owners and managers

If you update a listing, we store your name, role, organisation, email address and phone number. We use these only to verify who you are and to process the update.

These details are not published. The exception is general enquiries contact details you choose to add to the listing itself, such as a public phone number or email address.

Photos you send are kept privately until we approve them. To ask us to remove your details, email [email protected].

Analytics and cookies

With your optional analytics consent, we use PostHog and Google Analytics 4 to measure visits, acquisition channels and newsletter sign-up activity. Analytics can use pseudonymous browser identifiers and technical device information. Google Analytics receives page paths, campaign labels and form events, but not newsletter email addresses, account identifiers, search text or journey endpoints. Advertising features and Google signals are disabled. Google's processing may take place outside the UK. See our Cookie policy and how Google processes information from sites using its services. You can withdraw analytics consent using Cookie settings in the footer.

Confirmed newsletter sign-up measurement

If you accept analytics cookies, we can link a newsletter sign-up to the Google Analytics browser and session identifiers for that visit. On Hidden Britain, the submitted email address and these identifiers travel over HTTPS to our private automation service. The email is immediately converted to a keyed hash in our Supabase database; the matching system does not retain the email itself. A signed confirmation from Beehiiv verifies that a subscription succeeded before we send a conversion event to Google. Neither the email address, its hash nor the Beehiiv subscriber ID is sent to Google.

The private matching record is deleted after 48 hours. We keep a separate confirmation record containing a subscriber reference, confirmation time and campaign labels to avoid duplicate counting. Analytics consent is optional and separate from newsletter consent. Declining analytics does not prevent you subscribing. Withdrawing analytics consent stops new matching and requests cancellation of pending matching records from the current browser tab.

Legal basis for processing

For newsletter subscribers, our legal basis is consent. You gave consent when you subscribed. You can withdraw it at any time by unsubscribing via the link in any newsletter email.

For correspondence, our legal basis is legitimate interests in responding to enquiries directed to us.

For listing updates from property owners and managers, our legal basis is legitimate interests in keeping visiting information accurate. The image licence is consent. A newsletter tick is separate consent for Hidden Britain.

For accounts, our legal basis is contract: we process your email address and saved places in order to provide the account features you signed up for.

Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request erasure of your data
• Object to processing
• Withdraw consent at any time

To exercise any of these rights, contact [email protected]. We will respond within 30 days.

Account holders can delete their data directly from their account page without contacting us.

If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Information Commissioner's Office (ico.org.uk).

Retention

Subscriber email addresses are retained for as long as you remain subscribed. On unsubscribing, data is deleted in accordance with Beehiiv's retention policy. Correspondence is retained for up to two years.

Account data is retained while your account exists and deleted when you delete your account.

Changes to this policy

We may update this policy from time to time. The date at the top of this page reflects the most recent revision. Significant changes will be noted in the Hidden Britain newsletter.