Privacy Policy

This Privacy Policy explains how Quay Holiday Lettings collects and uses personal information when you visit our website, make an enquiry or booking, stay at a property, submit a form, provide a review, or use our property-management or key-holding services.

1. Who we are

1.1 Clare Dowding trading as Quay Holiday Lettings (“Quay”, “we”, “us” and “our”) is the controller of personal information used for Quay's own business and agency activities.

1.2 Our contact details are:

• Address: Collaton Farm, Nr Malborough, Kingsbridge, TQ7 3DJ
• Email: clare@quaylets.co.uk
• Telephone: 07580 551336
• Information Commissioner's Office registration number: ZB996927

1.3 For accommodation bookings, Quay acts as booking agent for the relevant property owner. The property owner may be a separate controller for information they use to provide and manage the accommodation. We can identify the relevant owner if you ask us.

2. Who this policy applies to

This policy applies to:

• website visitors and people making enquiries;
• guests, prospective guests and members of a booking party;
• property owners, prospective owners and their representatives;
• key-holding, inspection and property-care clients;
• contractors, suppliers and professional advisers;
• people who provide reviews, correspondence or other information to us; and
• emergency contacts or other individuals whose details are supplied to us for a legitimate operational reason.

3. Personal information we collect

Depending on your relationship with us, we may collect:

• identity and contact information, including name, postal address, email address and telephone number;
• booking information, including dates, property, party members, ages where relevant, pet details, special requests and communications about the stay;
• payment and transaction information, although full card details are handled by our payment provider rather than stored by Quay;
• information needed to manage a property or owner relationship, including ownership and property details, service instructions, emergency contacts, compliance records, invoices and correspondence;
• key-holding and inspection information, including access arrangements and inspection reports, with access credentials handled separately and with restricted access;
• information about accessibility, health or other needs that you choose to provide where it is relevant to a stay or service;
• complaints, incidents, damage reports, photographs and supporting evidence;
• reviews, feedback and marketing preferences;
• technical and usage information, including IP address, device and browser information, pages viewed, referral source and cookie choices; and
• any other information you choose to include in a form, email, telephone call or other communication.

Please do not give us personal information that we have not requested unless it is necessary for your enquiry, booking or service.

4. Where information comes from

We collect information:

• directly from you through our website, booking journey, forms, email, telephone and in-person contact;
• from the person making a booking or enquiry on behalf of others;
• from property owners and their authorised representatives;
• from booking platforms and travel agents where a reservation is made through them;
• from payment, website, analytics and property-management systems used to provide our services;
• from contractors or service providers involved in a property or stay; and
• from publicly available sources where necessary to verify business or property information.

If you give us information about another person, you must have authority to do so and should make this Privacy Policy available to them.

5. Why we use personal information and our lawful bases

We use personal information for the following purposes:

5.1 Enquiries, bookings and guest services

We use information to answer enquiries, check availability, administer bookings and payments, communicate before, during and after a stay, manage access, deal with changes or cancellations and provide customer support. We rely on taking steps at your request before entering a contract, performance of a contract, and our legitimate interests in operating an effective booking agency and guest service.

5.2 Owner, key-holding and property-management services

We use information to assess enquiries, onboard owners and properties, deliver agreed services, arrange inspections and maintenance, manage contractors, prepare reports and administer accounts. We rely on steps before a contract, performance of a contract, legal obligations and our legitimate interests in managing our services and protecting properties.

5.3 Payments, accounting and legal compliance

We use transaction and record information to take and reconcile payments, prevent fraud, maintain tax and accounting records, respond to lawful requests and establish, exercise or defend legal claims. We rely on performance of a contract, legal obligations and legitimate interests.

5.4 Safety, security, incidents and complaints

We use relevant information to protect guests, owners, properties and our business; respond to emergencies; investigate complaints, damage or suspected unlawful activity; and resolve disputes. We rely on legitimate interests, legal obligations and, where necessary, the establishment, exercise or defence of legal claims or protection of vital interests.

5.5 Website operation and improvement

We use essential technical information to operate and secure the website. With your consent where required, we use analytics or similar technologies to understand website use and improve our services. Further details are in our Cookie Policy.

5.6 Reviews and feedback

We use reviews and feedback to assess service quality and, where permitted, display genuine guest experiences. We rely on consent where requested and our legitimate interests in improving and promoting our services. Our Review Policy explains how reviews are sourced and moderated.

5.7 Marketing

We send marketing only where permitted by data-protection and electronic-marketing law—for example, where you have consented or where a lawful existing-customer exception applies. You can unsubscribe at any time using the link in a message or by contacting us. We do not sell personal information.

6. Special-category information

Information about health, accessibility or similar needs may be special-category personal information. Please provide only what is necessary. Where required, we will use it with your explicit consent; in an emergency we may use it to protect vital interests; and we may use relevant information where necessary for legal claims. You may withdraw consent, although this will not affect processing already carried out lawfully and may limit our ability to meet a particular request.

7. Who we share information with

Where necessary for the purposes above, we may share information with:

• the owner of the booked or managed property and their authorised representative;
• Hostfully, which provides property-management and direct-booking functionality;
• Stripe and other relevant payment or banking providers;
• booking platforms or travel agents involved in a reservation;
• our website host and website technologies, including WordPress, Elementor and WPForms;
• Google services used for business email, documents, forms, spreadsheets, storage, analytics and website management;
• cleaners, housekeepers, maintenance providers, inspectors and other contractors involved in a property or stay;
• SafetyCulture or another inspection/reporting provider where used for an agreed property service;
• accountants, insurers, legal advisers and other professional advisers;
• technology, communications and data-storage providers supporting our business; and
• regulators, law-enforcement bodies, courts, tax authorities or other parties where disclosure is required or permitted by law.

We share only information that is reasonably necessary for the relevant purpose. Service providers acting on our behalf must handle information under appropriate data-protection obligations.

8. International transfers

Some providers may store or access personal information outside the United Kingdom. Where UK data-protection law requires safeguards, we use an applicable UK adequacy regulation, the UK International Data Transfer Agreement or UK Addendum, or another lawful transfer mechanism. You may contact us for more information about safeguards relevant to your information.

9. How long we keep information

We keep personal information only for as long as reasonably necessary. Our usual retention approach is:

• enquiry records that do not lead to a service: normally up to two years after the last meaningful contact;
• booking, payment, invoice, accounting and contractual records: normally up to seven years after the relevant transaction or end of the relationship;
• owner, property-management and key-holding records: for the relationship and normally up to seven years afterwards, unless a longer or shorter period is justified;
• complaints, incidents, damage and legal-claim material: normally up to six years after resolution, or longer if a claim or legal obligation requires it;
• unsuccessful owner or supplier applications: normally up to two years after the last contact;
• marketing records: until you unsubscribe or object, followed by retention of minimal suppression information so that we respect your choice;
• access credentials: only while operationally required, stored with restricted access and removed or replaced when no longer needed; and
• analytics and cookie information: for the periods described in our Cookie Policy and consent controls.

We may keep information longer where required by law, an insurer, a regulator, an active dispute or the establishment, exercise or defence of legal claims. We may delete it sooner where it is no longer needed.

10. Security

We use reasonable organisational and technical measures designed to protect personal information, including access controls, restricted handling of sensitive operational information, appropriate account security and limiting access to people who need the information. No online service can guarantee absolute security, so please contact us promptly if you believe information has been lost, misused or disclosed improperly.

11. Children and booking parties

The lead guest for a direct booking must be at least 21 years old. We may receive limited information about younger members of a booking party where needed for occupancy, safety or service arrangements. The lead guest must be authorised to provide this information. Our services are not directed at children making their own bookings.

12. Cookies and website analytics

Our website uses essential cookies and, with consent where required, analytics or other optional technologies. You can accept, reject or manage optional cookies using the website's consent controls. Details of providers, purposes and durations are in our Cookie Policy at https://quaylets.co.uk/cookie-policy-uk/.

13. Your rights

Depending on the circumstances and lawful basis, you may have rights to:

• ask for access to your personal information;
• ask us to correct inaccurate or incomplete information;
• ask us to erase information;
• ask us to restrict how information is used;
• object to processing based on legitimate interests;
• object at any time to use of your information for direct marketing;
• receive certain information in a portable format;
• withdraw consent at any time where processing relies on consent; and
• complain to the Information Commissioner's Office.

These rights are not absolute, and an exemption or another lawful reason may sometimes allow or require us to retain or continue using information. We will explain our response.

To exercise a right, email clare@quaylets.co.uk. We may need information to verify your identity. We normally respond within one month, subject to lawful extensions for complex or multiple requests.

Your right to object: You have the right to object to direct marketing at any time. You may also object to processing based on our legitimate interests. Contact clare@quaylets.co.uk to do so.

14. Complaints

Please contact us first at clare@quaylets.co.uk so that we can try to resolve a privacy concern.

You can also complain to the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/ or by calling 0303 123 1113. If you live outside the UK, you may also have the right to contact your local data-protection authority.

15. Automated decisions

We do not currently use personal information to make solely automated decisions that produce legal or similarly significant effects about you. Website analytics may group or measure usage but are not used by Quay to make such decisions.

16. Changes to this policy

We may update this policy when our services, systems or legal obligations change. The effective date and version below identify the current policy. Material changes will be brought to people's attention where reasonably required.

Effective date: 10 August 2026

Version: 1.0

Review by: 10 August 2027