Last Updated: August 2026
Flatrock Group respects your privacy and is committed to protecting your personal data.
This Privacy Notice explains how we collect, use and protect your personal information when you interact with us, including when you:
• stay at one of our hotels or holiday properties;
• visit our restaurants, bars or spa facilities;
• make a booking or enquiry;
• purchase products, services or gift vouchers;
• attend an event, wedding or function;
• use our websites;
• apply for employment; or
• contact us.
Flatrock Group operates:
• The Cliff Hotel & Spa
• The Gwbert Hotel & Flatrock Bar & Restaurant
• The Harbourmaster
• The Black Lion Hotel
• The Grosvenor
• The Angel Hotel
• Gwbert Holidays
We process your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data protection laws.
Flatrock Group is the data controller responsible for your personal data.
Correspondence Address:
Flatrock Group
The Cliff Hotel & Spa
Gwbert
Cardigan
SA43 1PP
If you have questions about this Privacy Notice or wish to exercise your data protection rights, please contact us:
Email: customerservices@flatrockgroup.co.uk
The information we collect depends on how you interact with us.
This may include:
• your name and contact details;
• booking and reservation information;
• arrival and departure dates;
• payment and transaction details;
• gift voucher purchases;
• preferences and special requests;
• dietary requirements and allergies;
• accessibility requirements;
• feedback and survey responses;
• marketing preferences;
• information provided when applying for employment.
When you use our websites or digital services, we may collect technical information such as:
• IP address;
• browser type;
• device information;
• operating system;
• pages visited;
• website usage information;
• cookie information where applicable.
We may receive information from trusted third parties, including:
• booking platforms;
• travel agents;
• payment providers;
• reservation systems;
• recruitment agencies;
• event organisers;
• corporate customers arranging bookings on your behalf.
We use your personal data to:
• manage bookings and enquiries;
• provide accommodation, dining, spa and holiday services;
• process payments and refunds;
• communicate with you about your bookings;
• provide customer support;
• manage events and functions;
• improve our services;
• administer gift vouchers and loyalty schemes;
• send marketing communications where permitted;
• maintain website security and functionality;
• protect guests, visitors, employees and property;
• comply with legal obligations;
• manage recruitment and employment.
Under UK GDPR, we must have a lawful basis for processing your personal data.
Depending on the circumstances, we rely on:
Where we need your information to provide services you have requested, such as accommodation, restaurant bookings or spa treatments.
Where we must process information to comply with laws, regulations or official requirements.
Where processing is necessary for our business interests, such as improving services, maintaining security, preventing fraud and managing our operations. We ensure these interests do not override your rights.
Where you have given permission for a specific use of your information, such as receiving marketing communications. You can withdraw consent at any time.
Where processing is necessary to protect someone’s life or safety in an emergency.
Some information requires additional protection under UK GDPR.
This may include:
• health information;
• disability information;
• dietary information where it reveals health or religious information;
• information about accessibility requirements;
• certain employment-related information.
We only process this type of information where permitted by law and where appropriate safeguards are in place.
Examples include:
• providing services safely;
• accommodating accessibility requirements;
• managing allergies or medical considerations;
• meeting employment or health and safety obligations.
We do not use special category personal data for marketing purposes.
We may send you information about:
• accommodation offers;
• restaurants and dining experiences;
• spa treatments;
• events;
• gift vouchers;
• seasonal promotions;
• news and updates.
We only send marketing communications where permitted by law.
You can stop receiving marketing communications at any time by:
• clicking the unsubscribe link in our emails; or
• contacting us directly.
Choosing not to receive marketing will not affect your ability to use our services.
Our websites use cookies and similar technologies.
Cookies help us:
• operate our websites;
• keep them secure;
• remember preferences;
• understand how visitors use our websites;
• improve our services.
We only use non-essential cookies, such as analytics or marketing cookies, where you have provided consent.
You can manage your cookie preferences through our cookie settings or your browser controls.
Further information is available in our Cookie Policy.
We do not sell, rent or trade your personal information.
We may share information with trusted organisations where necessary, including:
• booking and reservation providers;
• payment processors;
• IT and website providers;
• email marketing providers;
• professional advisers;
• payroll and HR providers;
• law enforcement or regulators where legally required.
Where third parties process information on our behalf, we require them to protect your data appropriately.
Some suppliers may process information outside the UK.
Where this happens, we ensure appropriate safeguards are in place so that your personal data receives protection equivalent to UK data protection standards.
We keep personal data only for as long as necessary.
Retention periods depend on the type of information and why we use it.
Examples include:
• booking and customer records: generally 6 years;
• financial records: generally 6 years;
• CCTV footage: generally 30 days;
• unsuccessful recruitment records: generally 6 months.
Some information may be retained longer where required by law or where needed for legal claims.
We use appropriate technical and organisational measures to protect your personal data.
These include:
• restricting access to authorised people;
• staff confidentiality requirements;
• security training;
• secure systems and backups;
• appropriate supplier checks;
• secure payment processing arrangements.
Although we take reasonable steps to protect your information, no online system can be guaranteed to be completely secure.
We operate CCTV at certain locations to help protect:
• guests;
• visitors;
• employees;
• property and facilities.
CCTV may be used for:
• security;
• crime prevention;
• investigating incidents;
• health and safety purposes.
CCTV footage is normally retained for 30 days unless it is required for an ongoing matter.
CCTV is not used for marketing purposes.
Under UK GDPR, you may have the right to:
• access your personal data;
• correct inaccurate information;
• request deletion of your information;
• restrict how we use your information;
• object to certain processing;
• request transfer of your information where applicable;
• withdraw consent where processing is based on consent.
To exercise your rights, contact:
Email: customerservices@flatrockgroup.co.uk
Post:
Data Protection Enquiries
Flatrock Group
The Cliff Hotel & Spa
Gwbert
Cardigan
SA43 1PP
We may ask you to verify your identity before responding.
If you have concerns about how we use your personal data, please contact us first so that we can investigate.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection.
Further information is available from the ICO website.
We may update this Privacy Notice from time to time to reflect changes to our services, technology, legal requirements or privacy practices.
Any updated version will be published on our websites with a revised update date.
Contact Us
Flatrock Group
The Cliff Hotel & Spa
Gwbert
Cardigan
SA43 1PP
Email: customerservices@flatrockgroup.co.uk
This Cookie Policy explains how Flatrock Group (“we”, “us” or “our”) uses cookies and similar technologies when you visit our websites.
This policy should be read alongside our Privacy Policy, which explains how we collect, use and protect personal data.
We are committed to ensuring that cookies are used responsibly and in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
Cookies are small text files that are placed on your device when you visit a website. They allow the website to recognise your device and remember certain information about your visit.
Cookies help websites function correctly, improve user experience, provide website security and help organisations understand how their websites are used.
Cookies may collect information such as your device type, browser information, website preferences and how you interact with our website. Cookies do not usually identify you directly, although some cookies may be linked to personal information where you have provided it.
We use cookies for the following purposes:
These cookies are essential for our websites and online services to function properly. They enable core features such as:
These cookies cannot usually be disabled because they are required for the website to operate.
These cookies allow our websites to remember choices you make and provide enhanced functionality, such as:
Where required by law, we will ask for your consent before placing these cookies.
Analytics cookies help us understand how visitors use our websites. They allow us to measure website performance and identify areas where we can improve.
Information collected may include:
Analytics information is generally collected in an aggregated or anonymised form where possible.
We only place non-essential analytics cookies where you have provided consent.
Where used, marketing cookies help us understand the effectiveness of our marketing activity and may allow us to measure interactions with online campaigns.
These cookies may be used to:
We only place marketing cookies where you have provided consent.
The cookies used on our websites may vary depending on the services, functionality and third-party providers in use. The table below provides examples of the categories of cookies that may be used and their purpose.
We regularly review the cookies placed on our websites and update this table where necessary.
| Cookie Category | Provider | Cookie Purpose | Information Collected | Duration | Consent Required |
| Strictly Necessary | Website platform/provider | Enables essential website functionality, security and basic services such as page navigation and website operation | Technical information required for website functionality | Session or as defined by provider | No |
| Strictly Necessary | Online booking provider | Enables customers to search availability, make reservations and manage bookings | Booking session information and information required to complete reservations | Session or as defined by provider | No |
| Strictly Necessary | Online check-in provider | Allows guests to complete online check-in and provide information before arrival | Booking reference, guest session information and details required to complete check-in | Session or as defined by provider | No |
| Strictly Necessary | Payment provider | Supports secure payment processing and fraud prevention | Transaction-related information and security identifiers | As defined by provider | No |
| Functional / Preference | Website platform/provider | Remembers user preferences and improves website functionality | User preferences and selected settings | As defined by provider | Yes where required |
| Analytics | Analytics provider (e.g. Google Analytics) | Helps us understand how visitors use our websites and improve performance | Pages visited, website interactions, device information, approximate location and browsing activity | As defined by provider | Yes |
| Marketing / Advertising | Marketing platforms (e.g. Mail Chimp) | Measures the effectiveness of marketing campaigns and helps us understand engagement with online promotions | Online interactions, campaign responses and advertising identifiers | As defined by provider | Yes |
| Gift Voucher Services | Gift voucher provider (e.g. Gift Pro) | Enables purchase, delivery and redemption of gift vouchers | Transaction and voucher-related information | As defined by provider | No or Yes depending on technology used |
| Customer Relationship / Loyalty Services | Loyalty platform/provider (e.g. Kurve) | Supports loyalty programme functionality and personalised customer communications | Account information, preferences and customer interactions | As defined by provider | Yes where required |
Some of the services we use may place cookies on our websites. These providers may include:
These providers process information collected through cookies in accordance with their own privacy policies. We recommend reviewing their policies for further information about how they use cookies and similar technologies.
When you first visit our websites, you will be given the opportunity to manage your cookie preferences.
You can choose to accept or reject non-essential cookies through our cookie preference settings.
You can change your preferences or withdraw consent at any time by accessing the cookie settings available on our websites.
You can also manage cookies through your internet browser settings. Most browsers allow you to:
Please note that disabling certain cookies may affect the functionality and performance of our websites.
We may update this Cookie Policy from time to time to reflect changes in the cookies we use, the services we provide or changes in legal requirements.
Any updated version will be published on our websites with the date of revision shown below.
Last updated: August 2026
If you have any questions about our use of cookies or this Cookie Policy, please contact us:
Email: customerservices@flatrockgroup.co.uk
Post:
Data Protection Enquiries
Flatrock Group
The Cliff Hotel & Spa
Gwbert
Cardigan
SA43 1PP
FOR OUR GUESTS
JULY 2020
OUR KEY COVID-19 SAFETY MEASURES
We consider the safety of our guests and our team a priority.
We are following UK and Welsh government guidelines and have undertaken an extensive risk assessment for the safety of guests and teams.
We ask you to be mindful of social distancing, in corridors and on arriving and leaving the building.
Hand sanitizer stations are available at the entry doors and in your room.
All team members have been re-trained in the correct hand washing method and frequency and temperatures are checked daily.
The frequency of cleaning and disinfection of rooms, surfaces, including, tables, chairs and touch points has been increased.
Bedrooms will be disinfected with a ‘fogger’ disinfectant mist prior to guest arrival.
We have reviewed all disinfectants and confirm they are effective against the virus.
If you or any of your party becomes unwell during your stay, please stay in your room, inform us immediately.
