Privacy Policy
Last updated: 21/10/2026
This policy explains how Data First collects, uses and protects personal data when you visit data-first.co.uk or contact Data First through it.
In short: Data First collects only what it needs to respond to you and run the website. Data First does not sell personal data. You can ask to see, correct or delete your data at any time by emailing info@data-first.co.uk.
Who we are
Data First develops, builds and supports technology for hotels, spas and resorts: booking engines, websites and system integrations.
Data First is a trading name of Lyon Paul Ltd, a company registered in England and Wales (company number 12334928). Registered office: Unit 10, Homelands Commercial Centre, Vale Road, Bishops Cleeve, Cheltenham GL52 8PX.
For the personal data described in this policy, Data First is the data controller. This means Data First decides how and why that data is used and is responsible for protecting it.
Contact for privacy questions: info@data-first.co.uk, or write to Data First at the registered office address above. Please mark your message "Privacy".
What this policy covers
This policy covers personal data collected through data-first.co.uk about:
visitors to the website
people who contact Data First through the website, using the contact form or the email address shown on it
people who ask to receive update emails from Data First
This policy does not cover other websites linked from data-first.co.uk. Please read their privacy policies separately.
The personal data Data First collects
Data First collects only the information you choose to send and basic website usage data. Please don't include sensitive information, such as health details, in your message.
Who | Data collected | How it is collected |
|---|---|---|
Website enquiries | Name, organisation, job title, email address, phone number and your message | From you, through the contact form or by email |
Update emails | Name, email address and organisation | From you, when you ask to receive updates |
Website visitors | IP address, device and browser type, pages viewed, how you arrived at the site, approximate location (town or region level) | Cookies, only if you accept them (see section 5) |
How Data First uses your data
Data protection law requires a lawful basis for each use of personal data. The table below sets out what Data First uses your data for and the basis it relies on.
Purpose | Lawful basis |
|---|---|
Replying to enquiries and providing information you ask for | Legitimate interests (responding to people who contact the business), or steps before entering a contract |
Following up an enquiry about working together | Legitimate interests |
Sending update emails you have asked for | Consent. You can unsubscribe at any time using the link in every email. |
Running and securing the website | Legitimate interests (keeping the site working, secure and useful) |
Measuring website use with Google Analytics | Consent, given through the cookie banner |
Measuring advertising, such as Google Ads | Consent, given through the cookie banner |
Complying with the law, handling complaints and protecting Data First's legal rights | Legal obligation and legitimate interests |
Where Data First relies on legitimate interests, it has balanced those interests against your rights. You can ask for details of that assessment.
No automated decisions. Data First does not make decisions about you based solely on automated processing that have legal or similarly significant effects.
AI tools. Data First may use AI tools to help with everyday work such as drafting and summarising. Data First uses business-grade tools, does not use them to make decisions about you, and does not enter personal data from enquiries into them unless the tool has appropriate data protection terms in place.
Cookies and analytics
Cookies are small files stored on your device when you visit a website. Data First uses them to make the site work, to understand how it is used, and, with your consent, to measure advertising.
Type | What it does | Your choice |
|---|---|---|
Strictly necessary | Keeps the site secure and working, and remembers your cookie choices | Always on, as the site cannot work without them |
Analytics | Google Analytics counts visits and shows which pages are useful, so Data First can improve the site. Data is reported in aggregate. | Off until you accept |
Advertising | Measures whether Data First's Google Ads lead to visits or enquiries, and may help show relevant ads | Off until you accept |
You can change your choices at any time using Cookie settings in the website footer, or through your browser settings. Blocking some cookies may affect how the site works.
The cookies used on data-first.co.uk are:
Cookie | Set by | Type | Purpose | How long it lasts |
|---|---|---|---|---|
df_consent | Data First | Necessary | Remembers your cookie choices | 12 months |
XSRF-TOKEN | Data First | Necessary | Protects forms against cross-site request forgery | 2 hours |
laravel_session | Data First | Necessary | Keeps your session working as you move between pages | 2 hours |
_GRECAPTCHA | Google reCAPTCHA | Necessary (security) | Protects the contact form from spam and abuse. Set on google.com | 6 months |
_ga | Google Analytics | Analytics | Distinguishes visitors so they can be counted | 2 years |
_ga_4JXS8Y34FE | Google Analytics | Analytics | Keeps track of your visit | 2 years |
_gcl_au | Google Ads (once advertising is live) | Advertising | Measures whether ads lead to visits or enquiries | 90 days |
Analytics and advertising cookies are only set if you accept them.
Who Data First shares your data with
Data First does not sell your personal data. It shares data only where needed, with:
Service providers who help run the website and the business, such as website hosting, email, Google Analytics and Google reCAPTCHA. They act on Data First's instructions and must keep your data secure.
Advertising platforms, such as Google, only where you have accepted advertising cookies.
Professional advisers, such as accountants, lawyers and insurers, where needed.
Regulators, law enforcement or courts, where the law requires it.
A buyer or investor, if Data First is involved in a sale, merger or investment. Any recipient would have to protect your data in line with this policy.
A list of Data First's main service providers is available on request.
International transfers
Some of Data First's service providers store or access data outside the UK, for example in the European Economic Area or the United States.
When this happens, Data First makes sure your data stays protected by using one of the safeguards UK law allows. These include countries the UK recognises as having adequate protection, the UK-US Data Bridge, or approved contract terms such as the UK International Data Transfer Agreement.
You can ask for more information about these safeguards.
How long Data First keeps your data
Data First keeps personal data only as long as it needs it for the reason it was collected.
Data | How long it is kept |
|---|---|
Enquiries that do not lead to work | Up to 2 years from the last contact |
Enquiries that lead to work | Moved into client records and kept under the agreement with that client |
Update email subscribers | Until you unsubscribe |
Analytics data | 14 months |
Unsubscribe records | Kept indefinitely as a short suppression record, so Data First does not contact you again |
At the end of these periods, Data First securely deletes or anonymises the data.
Keeping your data secure
Data First uses technical and organisational measures to protect personal data from loss, misuse and unauthorised access. These include access controls so only people who need data can see it, multi-factor authentication on key systems, encrypted connections, and confidentiality terms with subcontractors.
No system is completely secure. If a data breach is likely to put your rights at risk, Data First will tell you and the ICO where the law requires it.
Your rights
Under UK data protection law you have the right to:
Access a copy of the personal data Data First holds about you
Correct data that is wrong or incomplete
Delete your data in certain circumstances
Restrict how your data is used in certain circumstances
Object to Data First using your data based on legitimate interests, including for direct marketing at any time
Data portability: receive data you gave Data First in a common format, or have it sent to another organisation, where the processing is based on consent or contract
Withdraw consent at any time, where Data First relies on consent. This does not affect anything done before you withdrew it.
How to make a request. Email info@data-first.co.uk with "Privacy request" in the subject line. Tell Data First which right you want to use and give enough detail to find your data. Data First may ask you to confirm your identity.
What happens next. Data First will respond within one month of receiving your request. If a request is complex, this may be extended by up to two more months, and Data First will tell you why. There is usually no charge.
Making a complaint
If you are unhappy with how Data First has handled your personal data, please tell Data First first, so it can put things right.
How to complain. Email info@data-first.co.uk with "Data protection complaint" in the subject line, or write to the registered office address in section 1.
What happens next. Data First will acknowledge your complaint within 30 days of receiving it. It will then look into it and reply without undue delay, explaining what it found and any action taken.
Complaining to the ICO. You also have the right to complain to the Information Commissioner's Office, the UK regulator for data protection. Website: ico.org.uk/make-a-complaint. Helpline: 0303 123 1113.
Changes to this policy
Data First reviews this policy regularly and will update it if the way it uses personal data changes. The date at the top shows when it was last updated. If a change significantly affects you, Data First will let you know directly where it can.
Contact
For any question about this policy or your personal data:
Email: info@data-first.co.uk
Post: Data First, Unit 10, Homelands Commercial Centre, Vale Road, Bishops Cleeve, Cheltenham GL52 8PX