Privacy Notice

Who we are

NOOK Cabins is the hospitality brand of NOOK Prefab. We build factory-finished modular guest suites and matched saunas, across our production bases in Spain, Germany and Florida. This website (nookcabins.com) is a business-to-business brochure and enquiry site for glamping operators, boutique hotels and rural landowners.

For any privacy question, or to exercise your rights, email hello@nookcabins.com. The registered company details are published in our legal notice when finalised; they do not change how your data is handled.

What we collect, and why

The enquiry form

When you use the enquiry form, we collect your name, work email, and (optionally) your phone number, together with the context you give us: what you are building, how many units, where your land stands, your timeline and region, and any property name, current key count, land classification or notes you add. We use this only to reply to you and to prepare a configured proposal.

The document gates

The spec-pack, operator-dossier, pro-forma and guides forms collect your work email so we can send the document you asked for. This delivery is transactional — it happens whether or not you opt in to marketing.

What we do not collect

No payment details (this site takes no payment — a sale is agreed offline in a signed statement of work), no special-category data, and nothing from children. We do not knowingly collect personal data from anyone under 16.

The consent model

We keep two things separate. Replying to your enquiry and delivering a document you requested are transactional: we do them because you asked, not because you opted in to anything. Marketing — operator guides and pricing updates — is separate and opt-in: it happens only if you tick the marketing checkbox, and you can withdraw at any time from any email or by writing to us. If you leave the box unticked, we still send the document; we just do not add you to the marketing programme.

Who processes your data on our behalf

We use a small set of service providers (processors) to run the site and handle enquiries. Each processes only what it needs to do its job.

Site analytics today use Cloudflare Web Analytics, which is cookieless and does not fingerprint visitors, or nothing at all — see the cookies notice. We do not run a cross-site advertising pixel on this site.

Legal basis for processing (UK GDPR / EU GDPR)

• Replying to enquiries, delivering documents and preparing a proposal: pre-contract steps taken at your request (Article 6(1)(b)).
• Marketing emails: your consent (Article 6(1)(a)), which you can withdraw at any time.
• Site security and cookieless analytics: our legitimate interest in running and measuring the site (Article 6(1)(f)), balanced against your privacy by using non-tracking tools.
• Record-keeping: compliance with tax, accounting and contractual obligations (Article 6(1)(c)).

How long we keep it

• The raw form submission in Cloudflare KV: 90 days, then it expires automatically. This is the durable copy that guarantees your enquiry is never lost between the form and Klaviyo.
• Your enquiry in Klaviyo: for as long as your enquiry is open, plus 24 months after the last meaningful contact, unless you ask us to delete it sooner and no legal exception applies.
• Customers after install: for the warranty period and any legally required record-keeping period, then deleted or archived.

International transfers

Cloudflare, Klaviyo, Calendly, WhatsApp/Meta and (when live) Google and Sentry are US-headquartered. Transfers from the UK/EU/EEA rely on the EU–US Data Privacy Framework and its UK Extension where the provider is certified, and on standard contractual clauses otherwise.

Your rights

Under UK GDPR and EU GDPR you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data, subject to overriding legal obligations.
• Restrict or object to our processing.
• Port your data to another controller in a machine-readable format.
• Withdraw consent at any time where consent is the basis.
• Complain to your supervisory authority — in the UK the ICO (ico.org.uk), in Spain the Agencia Española de Protección de Datos (aepd.es), or your country's equivalent.

To exercise any of these, email hello@nookcabins.com with the subject "Data request". We respond within one month of receipt.

How we protect it

The enquiry form posts to a Cloudflare Worker that verifies a Turnstile token, applies a per-address rate limit, validates the payload against a strict schema, and writes the raw submission to encrypted key-value storage before anything else — so a lead is never lost. Traffic uses TLS with HSTS. The Klaviyo API key is held as a Worker secret and is never sent to your browser; our logs record a submission's identifier, never your email or name.

Changes to this notice

We post material changes here and update the "Last updated" date above. If a change adds a new processor or extends retention, and we hold an active enquiry from you, we tell you by email.

This notice is published in good faith and has not yet been reviewed by external counsel; the operator behind NOOK Cabins arranges that review before launch. If you spot an error, email hello@nookcabins.com so we can correct it.