Skip to content

Privacy Policy

Who we are

The Marsham Arms is a pub and inn based at 40 Holt Road, Hevingham, Norwich NR10 5NP. Our website address is https://www.marshamarms.co.uk.

The Marsham Arms is operated by Marsham Arms Limited, registered in England and Wales under company number 16735043, with its registered office at 13 The Close, Norwich, NR1 4DS.

You can contact us about this policy or about the data we hold on you at info@marshamarms.co.uk or 01603 754268.

What personal data we collect and why we collect it

Bookings and reservations

When you book a table, reserve a room, or buy a gift voucher, we collect your name, email address, phone number, the date and size of your booking, and any dietary or accessibility requirements you choose to share. We collect this on the legal basis of fulfilling our contract with you — without it, we can’t manage your booking or contact you about it. Bookings are processed through ResDiary (restaurant and function room bookings) and Caterbook (room bookings), who also handle payment processing securely on our behalf.

Contact forms

If you send us a message through our contact form, we keep your name, email address, phone number (if provided), and your message. We use this only to respond to your enquiry and to follow up where needed. We keep contact form submissions for [12 months] after the enquiry is resolved, and we don’t use them for marketing.

Mailing list

If you sign up to our mailing list, we collect your name and email address and use them — on the basis of your consent — to send you news, events, and offers from The Marsham Arms. Emails are sent via Klaviyo. You can unsubscribe at any time using the link in any email.

Cookies

If you leave a comment on our site you may opt-in to saving your name, email address, and website in cookies. These are for your convenience so that you do not have to fill in your details again when you leave another comment. These cookies will last for one year.

If you visit our login page, we will set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.
When you log in, we will also set up several cookies to save your login information and your screen display choices. Login cookies last for two days, and screen options cookies last for a year. If you select “Remember Me”, your login will persist for two weeks. If you log out of your account, the login cookies will be removed.

If you edit or publish an article, an additional cookie will be saved in your browser. This cookie includes no personal data and simply indicates the post ID of the article you just edited. It expires after one day.

We also use cookies for analytics. You’ll be asked to consent to these the first time you visit the site, and you can change your preferences at any time via our cookie banner.

Analytics

We use Google Analytics 4 to understand how visitors find and use our website so we can improve it. The data is aggregated and, where possible, anonymised — we don’t use it to identify individuals. You can opt out via our cookie banner, or by installing the Google Analytics opt-out browser add-on at https://tools.google.com/dlpage/gaoptout. Google’s privacy policy is at https://policies.google.com/privacy.

Embedded content from other websites

Pages on this site may include embedded content (e.g. videos, images, maps, articles). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.

These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.

Who we share your data with

We do not sell your personal data. We share it only with the following, and only where necessary:

  • ResDiary and Caterbook — to manage bookings.
  • Klaviyo — to send our newsletter.
  • Siteground — who hosts the site and its database.
  • Authorities or regulators — where we are legally required to disclose information

If you request a password reset, your IP address will be included in the reset email.

How long we retain your data

  • Booking and payment records: kept for 7 years to meet HMRC and accounting obligations.
  • Mailing list subscribers: kept until you unsubscribe.
  • Contact form enquiries: kept for 12 months after the enquiry is resolved.
  • Analytics data: retained for 14 months in Google Analytics, then automatically deleted.
  • Registered user accounts: for users that register on our website, we store the personal information they provide in their user profile. All users can see, edit, or delete their personal information at any time (except they cannot change their username). Website administrators can also see and edit that information.

What rights you have over your data

Under UK GDPR you have the right to:

  • Request a copy of the personal data we hold about you
  • Ask us to correct any data that’s inaccurate or incomplete
  • Ask us to delete personal data we hold about you (this does not include any data we are obliged to keep for administrative, legal, or security purposes)
  • Object to certain types of processing, including direct marketing
  • Withdraw your consent to marketing at any time

If you have an account on this site or have left comments, you can also request an exported file of the personal data we hold about you.

To exercise any of these rights, email us at info@marshamarms.co.uk. We’ll respond within one month.

If you’re unhappy with how we’ve handled your data, you also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator: ico.org.uk.

Where your data is sent

Some of the providers we use (notably Google Analytics and Klaviyo) may process data outside the UK. Where this happens, we rely on safeguards such as the UK’s International Data Transfer Agreement, the EU-US Data Privacy Framework, or Standard Contractual Clauses to ensure your data is protected to UK GDPR standards.

Contact information

For any questions about this policy, or to make a data request, please contact:

Aaron Hall, Operations Director
The Marsham Arms
Marsham Arms, 40 Holt Rd, Hevingham, Norwich NR10 5NP
info@marshamarms.co.uk
01603 754268

How we protect your data

We take the security of your data seriously. Our website runs over an encrypted (HTTPS) connection, payment data is handled entirely by our PCI-compliant payment processor (we never see or store full card details), and access to personal data is limited to staff who need it. Our website and booking systems are protected by strong passwords and, where available, two-factor authentication. We review our security arrangements regularly.

What data breach procedures we have in place

If a personal data breach occurs, we will assess the risk to those affected, contain the breach as quickly as possible, and — where the breach is likely to result in a risk to your rights and freedoms — notify the ICO within 72 hours and inform you directly without undue delay.

This policy was last updated on 01 June 2026.