This privacy policy explains how HolidayHost Ltd collects, uses and protects personal data when you visit holidayhost.co.uk, send us an enquiry or sign up to our newsletter. It also explains your rights and how to use them.
This policy covers our website. It does not cover the Owner portal at clients.holidayhost.co.uk or the Owner app, or the data we handle when we manage your property, which are covered separately when you join us.
Who we are
HolidayHost Ltd is the controller of the personal data described in this policy. We are a limited company registered in England and Wales, company number 12722792.
Registered office: Suite D, Modbury House, Modbury, Ivybridge, PL21 0TP
Email: info@holidayhost.co.uk
Phone: 01548 800 426
If you have any questions about this policy or how we use your data, please get in touch using the details above.
What we collect, why, and on what legal basis
UK data protection law says we need a legal basis for using your personal data. The ones we rely on are:
- Consent: you have clearly agreed to us using your data for a specific purpose. You can withdraw your consent at any time.
- Legitimate interests: we have a genuine business reason to use your data, and it does not override your own interests, rights and freedoms.
- Steps before a contract: you have asked us about our services and we need your details to respond.
- Legal obligation: the law requires us to keep or use the data.
Enquiries through our contact forms
What We Collect: Your name, email address, phone number, the area you are interested in and your message. When you contact a local Host through their page, we also record which Host and page you contacted, and how you found our website (for example, from a Google search, an advert or a campaign link).
Purpose: To reply to your enquiry, put you in touch with the local Host for your area, and understand which pages and campaigns bring enquiries.
Retention Period: Up to 2 years from our last contact with you. If you go on to work with us, we keep your details for as long as we work together and for 6 years afterwards, to meet our legal and accounting obligations.
Legal Basis: Steps before a contract, and legitimate interests
Newsletter
What We Collect: Your email address, and your name if you give it.
Purpose: To send you our newsletter with news and advice for holiday let Owners.
Retention Period: Until you unsubscribe. Every newsletter has an unsubscribe link.
Legal Basis: Consent
Website analytics (Google Analytics)
What We Collect: The pages you visit, how long you spend on them, how you arrived at our website, the actions you take (such as sending a form or clicking a phone number), your device type, browser, screen size and approximate location (town or region). Google Analytics uses cookies to recognise you between visits.
Purpose: To understand how our website is used and which parts of it work well, so we can improve it.
Retention Period: 14 months
Legal Basis: Consent. Google Analytics only runs if you accept Performance cookies in our cookie banner.
Heatmaps, session recordings and testing (Matomo)
What We Collect: The pages you visit and how you arrived at them; where you click, move and scroll on a page (heatmaps); recordings of those same interactions during your visit (session recordings); which version of a page you were shown when we are testing changes (A/B testing); your device type, browser, screen size and approximate location (country or region); and a randomly generated visitor ID stored in a cookie. Your IP address is anonymised before it is stored, and session recordings do not record anything you type into forms.
Purpose: To see which parts of the website help visitors and which do not, and to test changes to our pages.
Retention Period: 13 months
Legal Basis: Consent. Matomo only runs if you accept Performance cookies in our cookie banner.
Website security and spam protection
What We Collect: Your IP address, browser details and the content of any form you send.
Purpose: To keep our website secure, block attacks and stop spam reaching our forms.
Retention Period: Security logs are kept for a short period and then deleted automatically.
Legal Basis: Legitimate interests
Your cookie choices
What We Collect: The choices you make in our cookie banner, with an anonymous ID and the date.
Purpose: To remember your choices and show that we asked for your consent.
Retention Period: Until your choices expire or you change them.
Legal Basis: Legal obligation
Cookies
Cookies are small files saved on your device by a website. We use them in these categories, and you choose which to allow when you first visit:
- Strictly necessary: needed for the website to work and to remember your cookie choices. These are always on.
- Performance: used by Google Analytics and Matomo to measure how the website is used. These only run if you accept them.
- Functionality and targeting: may be set by content from other services, such as YouTube videos. These only run if you accept them.
To see the full list of cookies we use, or to change your choices at any time, open the cookie settings from the icon in the bottom corner of any page.
Who we share your data with
We never sell your personal data. We share it only where we need to, with:
- Your local Host: if you contact a Host or ask about their area, we pass your enquiry to them so they can reply.
- Service providers who work for us: companies that host our website, send our emails and newsletter, protect our forms and measure how our website is used. They can only use your data to provide their service to us, and must keep it secure.
- Professional advisers and authorities: where we need to for legal, accounting or insurance reasons, or where the law requires it.
The service providers we currently use are:
- Nimbus Hosting (UK): website hosting
- Cloudflare: website delivery and security
- Google: Google Analytics, Google Tag Manager, Google Fonts and YouTube
- Matomo (InnoCraft Ltd): heatmaps, session recordings and testing, stored on servers in the European Union
- Twilio SendGrid: sending emails from our website, such as passing on your enquiry
- MailerLite: our newsletter
- CleanTalk: spam protection for our forms
- Wordfence (Defiant Inc): website security
- CookieScript: our cookie banner and consent records
Transfers outside the UK
Some of our service providers, including Google, Cloudflare, Twilio SendGrid and Wordfence, are based in or use servers in the United States or other countries outside the UK. Where your data is transferred outside the UK, we make sure it is protected, either because the country has been approved by the UK government as having adequate protection (including the UK-US Data Bridge), or because the provider has agreed to the safeguards approved by the Information Commissioner’s Office.
Your rights
Under UK data protection law you have the right to:
- Access: ask for a copy of the personal data we hold about you.
- Rectification: ask us to correct information that is wrong or incomplete.
- Erasure: ask us to delete your personal data, in certain circumstances.
- Restriction: ask us to limit how we use your data, in certain circumstances.
- Portability: ask for your data in a structured, commonly used, machine-readable format, or for us to send it to another organisation.
- Object: object to us using your data on the basis of legitimate interests, and to any direct marketing at any time.
- Withdraw consent: where we rely on your consent, you can withdraw it at any time. For cookies, change your choices in the cookie settings. For the newsletter, use the unsubscribe link. Withdrawing consent does not affect anything we did with your data before you withdrew it.
To use any of these rights, email info@holidayhost.co.uk. We may need to confirm your identity first. We will reply within one month, or tell you within that month if we need longer because your request is complex. There is normally no charge.
Complaints
If you are unhappy with how we have used your data, please contact us first and we will do our best to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.
Security
We take appropriate technical and organisational steps to protect your personal data from loss, misuse and unauthorised access. Access is limited to the people who need it to do their jobs, and our service providers are required to keep it secure. No website or system is completely secure, but we work to keep the risks as low as we can.
Children
Our website and services are for property owners and are not aimed at children. We do not knowingly collect data from anyone under 18.
Changes to this policy
We review this policy regularly and will update it when the way we use personal data changes. The date at the top of this page shows when it was last updated.