Privacy

We may collect, use, store, and transfer different kinds of personal data about you. This includes, but is not limited to:

Personal Identification Information:

• First name, last name, age, username or similar identifier of all guests (including any children)
• Postal address, email address, and telephone numbers
• Audio and video recordings

Booking and Transaction Data:

• Accommodation booking details (such as property booked, duration, number of guests)
• Payment details, including card information (stored securely by third-party processors) and transaction history
• Communications with our customer service team regarding bookings or inquiries

Technical Data:

• Internet Protocol (IP) address
• Login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access the Site

Usage Data:

• Information about how you use our website, services, and accommodation booking services
• Referrals and URLs that brought you to our site
• Marketing and communication data: your preferences in receiving marketing communications from us and your communication preferences
• Surveys, promotions, or feedback data
• Sensitive Personal Data: special requirements, such as medical, dietary, or accessibility information necessary to fulfil your booking (only collected with your consent)

We use different methods to collect data from and about you, including:

Direct Interactions:

• You may provide us with your personal details when you book accommodation, subscribe to our newsletter, or communicate with us through the website or by phone, email and messenger service.

Automated Technologies or Interactions:

• As you interact with our site, we may automatically collect technical data about your equipment, browsing actions, and usage patterns. This data is collected via cookies, server logs, and other similar technologies.

Third Parties:

• We may receive data about you from third-party booking platforms, analytics providers, and payment processors when you engage their services through our site.

We will only use your personal data when the law allows us to. Most commonly, we will use your data in the following ways:

To fulfil a Contractual Obligation with you and the owner

• To process and manage your accommodation bookings
• To manage payments, fees, and charges, including fraud prevention
• To provide customer support before, during, and after your stay

To Comply with a Legal Obligation

• To maintain accurate financial records for tax, legal, and compliance purposes
• To respond to regulatory or legal inquiries
• To cooperate with law enforcement authorities

For Legitimate Interests

We process your personal data where necessary for our legitimate interests and where your rights do not override those interests. This includes:

• Managing and enhancing our services, such as website maintenance and testing
• Marketing to current customers and analysing feedback to improve our services
• Security and fraud prevention

With Your Consent

We may also process your data with your explicit consent for:

• Sending marketing communications about our services, new products, or offers
• Storing special categories of personal data (e.g. dietary requirements) to enhance your experience

Our legal basis for collecting and using the personal data described in this privacy policy will depend on the data in question and the specific context in which we collect it. However, we will normally collect personal data from you only:

• Where we have your consent to do so
• Where we need the personal data to perform a contract with you, or where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms.

We will only retain your personal data for as long as necessary to fulfil the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements.

• Booking and transaction data will be retained for 7 years in accordance with financial and tax reporting laws.

• Marketing data will be retained until you opt out of receiving further communications.
• Technical data is generally retained for a maximum of 26 months unless anonymised.

Once the retention period expires, we will securely delete or anonymise your data.

Under GDPR, you have several rights concerning your personal data. These include:

• Right to Access: You have the right to request access to the personal data we hold about you. This is known as a Subject Access Request (SAR). To make a SAR, please contact us at info@2cholidays.co.uk with the subject line “Subject Access Request.”

• Right to Rectification: You have the right to request corrections of any inaccurate or incomplete personal data we hold about you.

• Right to Erasure (Right to be Forgotten): You have the right to request the deletion of your personal data where there is no legitimate reason for us to continue processing it.

• Right to Restriction of Processing: You have the right to request the restriction of processing your personal data in specific circumstances, such as when you contest its accuracy or when the processing is unlawful.

• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transfer it to another data controller.

• Right to Object: You have the right to object to the processing of your data where we rely on legitimate interests or when we process it for direct marketing purposes.

• Right to Withdraw Consent: If we process your data based on your consent, you have the right to withdraw that consent at any time.

To exercise any of your rights under GDPR, please contact us at info@2cholidays.co.uk. We will respond to your request within 30 days.

We are committed to ensuring the security of your personal data. To prevent unauthorised access or disclosure, we have implemented appropriate physical, electronic, and managerial procedures to safeguard and secure the information we collect.

These measures include:

• Encryption of sensitive data
• Secure storage on protected servers
• Regular software updates and vulnerability testing
• Access controls and 2-factor authentication procedures for personnel accessing personal data
• In the event of a data breach that affects your personal information, we will notify you and the relevant authorities as required by law.

We may share your personal data with third parties under the following circumstances:

• Service Providers: To facilitate your booking, we may share your data with trusted service providers that assist us in delivering our services, including payment processors, hosting services, customer support platforms, holiday parks, and accommodation owners.
• Legal Obligations: We may disclose your data where required by law or to protect our legal rights.
• Business Transfers: If we are involved in a merger, acquisition, or asset sale, your data may be transferred as part of the business assets. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice.

Some of our third-party service providers are located outside of the European Economic Area (EEA), and their processing of your personal data will involve a transfer of data outside the EEA. Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission or the ICO.
• We may use specific contracts approved by the European Commission which give personal data the same protection it has in the UK. For further details.

Our site uses cookies and similar tracking technologies to enhance your browsing experience. Cookies are small text files stored on your device when you visit our site, which enable us to recognise your browser and capture certain information.

For detailed information on the cookies we use and how to control them, please see our Cookie Policy

We will only send you marketing communications if you have explicitly consented to receive such messages. You may opt out of receiving marketing messages at any time by following the unsubscribe link in the emails we send or by contacting us directly at info@2cholidays.co.uk.

We may update this privacy policy from time to time to reflect changes in our practices or legal obligations. The updated policy will be posted on this page, and where appropriate, you will be notified by email. We encourage you to review this policy periodically to stay informed about how we are protecting your information.

Under the General Data Protection Regulation (GDPR), you have the right to request access to the personal data we hold about you. This is known as a Subject Access Request (SAR). We are committed to responding to any legitimate requests for access to your data in a timely manner.

How to Submit a Subject Access Request

To submit a SAR, you can contact us using the following methods:

Email: info@2cholidays.co.uk

Postal Address: 2cHolidays Ltd, Fitzroy House, 32 Market place, Swaffham, PE37 7QH

When submitting a SAR, please provide the following information to help us identify the personal data you are requesting:

• Your Full Name
• Your Contact Details (email or postal address for correspondence)
• Details of the Specific Information you are requesting (e.g. categories of data, specific transactions, communications, or dates if applicable)
• Proof of Identity: To ensure the security of your data, we may require proof of identity before processing your request. Acceptable forms of ID include a photocopy or scanned copy of your passport, driving license, or a recent utility bill.
• Format: how you would like this information communicated to you, eg email or post.

What Happens Next?

Once we receive your request and confirm your identity, we will:

• Acknowledge receipt of your request within 14 days.
• Respond to your SAR within 30 calendar days from the date of your request, unless the request is complex or involves numerous records, in which case we may extend the deadline by a further 60 days. If this is the case, we will inform you within the initial 30-day period.
• Provide you with a copy of the personal data we hold, and information about how it is being used, including:
• The categories of personal data
• The purposes for which the data is being processed
• The recipients to whom the data has been disclosed (if any)
• How long we intend to retain the data
• Information about your rights regarding your data

Fees

We will not charge a fee for processing a SAR unless the request is manifestly unfounded, repetitive, or excessive, in which case we may charge a reasonable fee or refuse to comply with the request. If a fee applies, we will notify you and request payment before fulfilling your request.

Exemptions

There are certain situations where we may be unable to fully comply with your request, such as when your data involves personal data about another individual, or if disclosing the information would compromise the rights of another person. In these cases, we will explain the reasons for our inability to fulfil the request.