Our Privacy Policy
Who we are
Your personal information is collected by Park Holidays UK Ltd. We respect your privacy and value the trust you place in us when you share your personal information. Read more >
Information we collect about youWe collect personal information you give us such as your name, address, phone number, date of birth, gender, e-mail address, password, account settings and preferences. Read more >
How we collect your informationWe collect your personal information when you set up a user account, buy our products and when you subscribe to email updates, newsletters or other subscriptions. Read more >
How we use your informationWe use your personal information to fulfil your order, to allow access to our website/mobile app, keep you up to date with latest offers and to ultimately offer you a better purchasing experience. Read more >
Who we share your information withWe share your information with third parties where we need to, to fulfil our commitments to you or to meet other legal or contractual requirements. We take steps to ensure our suppliers treat your information with the same respect and security that we do. Read more >
How we protect your informationWe have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. Read more >
Your rightsUnder certain circumstances, you have rights under data protection laws in relation to your personal information. If you wish to exercise any of the rights set out above, please contact us. Read more >
How to contact us or make a complaintIf you have any questions about this Privacy Notice or our privacy practices, please contact our Data Protection Officer. Alternatively, you have the right to make a complaint at any time to the Information Commissioner's Office. Read more >
Introduction
Park Holidays UK Ltd. (“we, “our” or “us”) and our parent company (SUN Communities) are committed to protecting the privacy and security of your personal information. We take care to protect the privacy of our customers and anyone that communicates (online or offline) with us either in person, over the phone or through our mobile applications, websites, and social media platforms. We will handle your personal information fairly and legally and are dedicated to being transparent about the information we collect about you and how we use it.
The purpose of this Privacy Notice is to inform you of the information we collect, what we do with it, what we do to keep it secure as well as the rights and choices you have over your personal information.
Applicable data protection legislation includes the Data Protection Act 2018 (DPA2018), United Kingdom General Data Protection Regulation (UK GDPR), the Privacy and Electronic Communications (EC Directive) Regulations 2003 and any legislation implemented in connection with the aforementioned legislation. Where information is processed by a controller or processor established in the European Union or comprises the information of people in the European Union, it also includes the EU General Data Protection Regulation (EU GDPR) and any replacement legislation coming into effect from time to time.
We are the data controller for the personal information we process, unless otherwise stated.
-
Who we are
Park Holidays UK Ltd. is registered in England under Company Number 02434151 and registered with the Information Commissioner’s Office (the ICO) - Registration Number Z7420595.
Park Holidays UK Ltd. can be contacted by post, phone or email, as follows:
Park Holidays UK Ltd
Glovers House
Bexhill-On-Sea
TN39 5ES
United Kingdom
Phone: 01424234234
Email: [email protected]
Website: www.parkholidays.com - Information we collect about you
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
We may collect, use, store and transfer various kinds of personal information about you including but not limited to:
• Identity Data: includes first name, last name, maiden name, gender, marital status, date of birth, username, customer number, title, proof of identity (passport, driving licence etc.), proof of address (inc. previous address if less than 3 years),
• Contact Data: includes billing address, delivery address, email address and telephone numbers.
• Finacial Data: includes bank account details, proof of income, employment status, employment sector, occupation, company name, company address, if proprietor length of time in business, company registration number, VAT number, funding instrument including bank account and credit/debit card details (if appropriate), time at current bank and relevant transaction information (if appropriate).
• Transaction Data: includes details about payments to and from you and other details of products and services you have purchased from us.
• Technical Data: includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access our websites.
• Usage Data: includes information about how you use our website, products, and services.
• Marketing & Communications Data: includes your preferences in receiving marketing from us and our third parties, your communications and correspondence with us. Your interests, feedback and survey responses.
• Publicly available e Data: includes personal information which you have shared via a public platform (for example on X or a public Facebook page).
• Security Data: includes CCTV, ANPR and other images.
This list is not exhaustive and other personal information may be processed for reasonable business purposes related to the running and managing of our Parks. We keep our Privacy Notice under regular review.
It is important that the personal information we hold about you is accurate and current. Please keep us informed if your information changes during your relationship with us.
Special categories of data
Special categories of data are types of personal information that might be seen as more sensitive or private and relates to information about health, disability, race, ethnicity, political opinions, biometrics, or religion.
We will usually only process health or disability special category data and only in the following circumstances:
• It is necessary to enter into or perform our contract with you; or
• It is in your vital interests to do so; or
• It is necessary to comply with our legal obligations
And one of these further conditions of processing applies:
• We have your explicit consent; or
• It is in your vital interest; or for
• Health or social care purposes
Criminal offence data
The UK GDPR gives extra protection to the personal information of offenders or suspected offenders in the context of criminal activity, allegations, investigations, and proceedings.
Criminal offence data includes information about criminal allegations, criminal offences, criminal proceedings and criminal convictions. We do not keep a comprehensive register of criminal convictions, however, owing to the nature of our business we often generate, or receive from third parties, data about criminal allegations, offences, proceedings and convictions.
• Where we process criminal offence data, we will only do where it is necessary to comply with our legal obligations
And one of these further conditions of processing applies:
• We have your explicit consent; or
• Is necessary for the purposes of the prevention or detection of an unlawful act
Children
While our website is designed for a general audience, we will not knowingly collect any data from children under the age of 13 . If you are under the age of 18, you are not permitted to register an account, use or submit your data to the website.
If we discover that we have collected any personal information from a child under the age of 18, we will suspend the associated account and remove that information from our database.
If you believe we might have any personal information from or about a person under the age of 18, please email us at [email protected]
Aggregated data
We also collect, use and share aggregated data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal information but is not considered personal information in law as this data will not directly or indirectly reveal your identity.
For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal information so that it can directly or indirectly identify you, we treat the combined data as personal information which will be used in accordance with this Privacy Notice.
If you fail to provide personal information
Where we need to collect personal information by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with goods or services). In this case, we may have to cancel a purchase or service you have with us, but we will notify you if this is the case at the time.
- How we collect your information
We use different methods to collect information from and about you including through:
Direct interactions: You may give us your Identity, Contact and Financial Data by filling in forms or by corresponding with us by post, phone, email or otherwise. This includes personal information you provide when you:
• purchase our products or services
• request marketing to be sent to you
• request support
• give us feedback, respond to surveys or contact us
Automated technologies or interactions As you interact with our website, we will automatically collect information about your equipment, browsing actions and patterns. We collect this information by using cookies and other similar technologies. For more information on cookies please see our Cookies Notice.
- How we use your personal information
We will only use your personal information when the law allows us to. Most commonly, we will use it in the following circumstances:
• Performance of a contract we have or are about to enter into with you.
• Where it is necessary for our business legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Where we need to comply with a legal obligation.
Purposes for which we will use your personal information
We have set out below a description of all the ways we plan to use your data and which of the lawful bases we rely on to do so. We have also identified what our legitimate interests are, where appropriate.
Note that we may process your personal information against more than one lawful basis depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific lawful basis, we are relying on to process your personal information, where more than one basis has been set out in the table below.
Purpose/Activity
Type of data
Lawful basis for processing including basis of legitimate interest
To register you as a new customer:
(a) Create an account for you
(b) Provide our products and services
(c) Manage our systems
(d) Verify your identity
(e) Prevent fraud
(f) Send you marketing communications
(g) Share this information with third parties if you have provided your consent to this
(a) Identity
(b) Contact(c) Information about your interactions with us in person and on our website and apps
(a) Performance of a contract with you
(b) Necessary to comply with a legal obligation(c) Necessary for our legitimate interests (to operate, manage and grow our business)
(d) Consent
To understand the way you use our products:
(a) Identify products/services that may be of interest to you
(b) Monitor usage of website and app
(c) Provide location-based functions
(d) Upload your photos and videos
(e) Send notifications
(f) Personalise our service
(g) Statistical analysis and research
(h) Improve our services
(i) Develop new products and services
(a) Identity
(b) Contact
(c) Information about your interactions with us in person and on our website and apps
(d) Marketing and Communication
Necessary for our legitimate interests (to keep our records updated and to study how customers use our products/services)
To process transactions, including:
(a) Manage payments, fees and charges
(b) Collect and recover money owed to us
(c) Foreign money exchange
(a) Identity
(b) Contact
(c) Financial
(a) Performance of a contract with you
(b) Necessary to comply with a legal obligation
(c) Necessary for our legitimate interests (to recover debts due to us)
Information when you communicate with us whether in person, through our website or app, via email, over the phone, through social media or via any other medium. We use this to:
(a) Answer any of your issues or concerns
(b) Monitor customer communications for quality and training purposes
(c) Develop new services
(d) Improve our services based on the feedback you provide
(a) Identity
(b) Contact
(c) Information about your interactions with us in person and on our website and apps
(d) Marketing and Communications
(a) Performance of a contract with you
(b) Necessary for our legitimate interests (to provide a better service)
To manage our relationship with you which will include:
(a) Notifying you about changes to our terms or Privacy Notice
(b) Resolving technical issues
(c) Asking you to provide feedbackon our service
(a) Identity
(b) Contact
(c) information about your interactions with us in person and on our website and apps
(d) Marketing and Communications
(a) Performance of a contract with you
(b) Necessary to comply with a legal obligation
(c) Necessary for our legitimate interests (to keep our records updated and to study how customers use our products/services)
To administer and protect our business and this website (including troubleshooting, data analysis, testing, system maintenance, support, reporting, hosting of data, and anti-money laundering checks).(a) Identity
(b) Contact
(c) Information about your interactions with us in person and on our website and apps
(a) Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise)
(b) Necessary to comply with a legal obligation
To deliver relevant website content(a) Identity
(b) Contact
(c) Usage
(d) Marketing and Communications
(e) Information about your interactions with us on our website and apps
Necessary for our legitimate interests (to study how customers use our products/services, to develop them, to grow our business and to inform our marketing strategy)
To use data analytics to improve our website, products/services, marketing, customer relationships and experiences(a) Information about your interactions with us in person and on our website and apps
(b) Usage
Necessary for our legitimate interests (to define types of customers for our products and services, to keep our website updated and relevant, to develop our business and to inform our marketing strategy)
To make suggestions and recommendations to you about services that may be of interest to you(a) Identity
(b) Contact
(c) Information about your interactions with us in person and on our website and apps
(d) Usage
(e) Marketing and Communications
Necessary for our legitimate interests (to develop our products/services and grow our business)
Information that we collect incidentally from other sources or public sources, including information presented on our social media or wider social media platforms including Facebook, Twitter and Instagram. We use this information, including to:
(a) Maintain market awareness
(b) Build and maintain social media branding
(a) Usage
(b) Marketing & Communications
Necessary for our legitimate interests (to develop our products/services and grow our business)Change of purpose
We will only use your personal information for the purpose it was collected, unless we consider that we need to use it for another reason and that reason is compatible with the original purpose. If you would like an explanation with regard to the ways in which any new processing is compatible with the original purpose, please contact us.
• We rely on the Legitimate Interest lawful basis for the following types of processing:
• Selling and supplying goods and services to our customers
• Sending promotional marketing communications which are tailored and relevant to our customers
• Understanding our customers’ preferences and behaviours
• Handling customer queries, complaints and disputes
• Fulfilling our duties to our employees, customers and other stakeholders
• Protecting our customers, employees and other individuals to maintain their safety, health and welfare
• Protecting Park Holidays UK Ltd., its employees and customers by taking legal action against third parties against third parties who have committed criminal acts or are in breach of their legal obligations to Park Holidays UK Ltd.
• Improving our products and services and developing new products and services
• Complying with legal and regulatory requirements
• Managing legal and insurance claims
• Handling legal or regulatory enforcement actions taken against Park Holidays UK Ltd.
• Managing corporate matters, including selling or transferring part or all of our business to third parties, acquisitions and mergers, or any other corporate restructuring activity
• Prevention, investigation and detection of crime, fraud and antisocial behaviour and the prosecution of offenders, in conjunction with law enforcement agencies
Marketing
We use your personal information to provide you with promotional messages via email, text, and other electronic means, based on your consent. strive to provide you with choices regarding certain personal information uses, particularly around marketing and advertising.
Opting out - You can ask us to stop sending you marketing messages at any time, by following the opt-out link we provide in all our marketing messages or contacting us at [email protected]
Online advertising - If you visit our websites, you may be presented with personalised advertisements for our products and services whilst using other websites and social media platforms. The advertisements will relate to products you have previously viewed on our websites on your computer or other devices that we believe will be of interest to you. The advertisements are presented to you by us via specialist providers using cookies and other similar technologies placed on your device. You can disable or remove cookies at any time – see below for details.
Cookies
For more information about the cookies we use, please see here.
How long will we hold your personal information for
We will only retain your personal information for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal information for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.
To determine the appropriate retention period for personal information, we consider the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
Sometimes we will anonymise your personal information (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.
In all other cases we will archive or delete your personal data in accordance with the rules set out in our Retention Policy and Schedule.
- Who we share your information with
We share your information with certain suppliers or service providers to help us deliver our products and services to you. We will do this either when we receive your consent or because it is necessary for them to see your information in order for us to provide our products or services to you. These suppliers and service providers may process your personal information as data processors or as a data controller in their own right.
We only share your personal information with suppliers and service providers where they have confirmed they apply appropriate data protection and security controls. The information we provide to third party data processors, will be limited to only that required to complete the processing for which they have been engaged. They will not be permitted to use your information for any purposes other than those outlined in this Privacy Notice.
• If we are not able to share your information with these third parties, we may not be able to provide our products and services to you.
There are certain circumstances where we transfer your personal information to other parties. For example, we will:
• share information with advertising networks and social networks that require the data to select and serve relevant adverts to you and others. make use of the personal information we have collected from you to present you with advertisements that are more likely to be relevant to you
• share your personal information with and access information from analytics and search engine providers that assist us in the improvement and optimisation of the website and app and for better personalisation of content and advertising
Your personal information may also be transferred to other third-party organisations in certain scenarios, for example:
• if we discuss selling or transferring part or all of our business – the information may be transferred to prospective purchasers under suitable terms as to confidentiality
• if we are reorganised or sold, information may be transferred to a buyer who can continue to provide services to you
• if we're required to by law, or under any regulatory code or practice we follow, or if we are asked by any public or regulatory authority. For example, the police, regulators, local authorities, governmental bodies etc., to comply with our legal obligations and for the prevention, detection or investigation of crime
• if we are defending a legal claim your information may be transferred as required in connection with defending such claim
• if there is an emergency which requires us to share your data to protect the health and safety of our website users or the general public
Social Media Platforms and Search Engines
When you accept cookies on our websites and you also use search engines like Google or have accounts on a Meta platform (e.g., Facebook or Instagram) or TikTok, your purchasing and browsing data will be shared with them. ‘Meta’ means Meta Platforms Inc. (a US company) and other Meta Group companies. ‘TikTok’ means TikTok Information Technologies UK Ltd. in the UK and TikTok Technology Ltd. in Ireland. ‘Google’ means Google LLC (a US company) and Google Ireland Ltd. This enables social media companies and search engines to present you with personalised advertisements relating to our products and services when you use them.
You can find out more about how these organisations use your personal information and how you can exercise your data subject rights in the links below:
Meta - Privacy Centre - Manage your privacy on Facebook, Instagram and Messenger - Facebook Privacy
How Google uses information from sites or apps that use our services – Privacy and Terms - Google
As required under data protection legislation, Park Holidays UK Ltd. has agreements in place with social media platforms which detail each party’s responsibilities and obligations. We are responsible for providing you with the information above and relevant social media platforms are responsible for enabling your rights under the UK GDPR, for the data they process.
Our relationships with social media platforms may not be limited to those explicitly referenced in this Notice nd may change from time to time.
Third Party Links
This website may include links to trusted third-party websites, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their processing of your personal information. When you leave our website, we encourage you to read the Privacy Notice of every website you visit.
Mergers and Acquisitions
In the event that our business is acquired, either wholly or partly, by another business (e.g. a merger or sale) we may need to disclose your personal information to that company in order for them to continue providing services to you. Should this occur, your data will only be used by that company for the purposes set out in this Privacy Notice.
Your personal information may also be shared with another company, during preliminary discussions around a merger or acquisition of our business, prior to entering a contract. In this event, the data will be shared securely and kept confidential and deleted if the merger or acquisition does not complete.
International data transfers
In order to deliver our services and products to you, we sometimes need to transfer your information outside of the UK or European Economic Area (EEA) to countries which have different data protection rules.
Where this is necessary, we ensure the transfer is secure and will be compliant with prevailing laws and regulation. Our standard practice is to use standard contract clauses (SCC’s) which have been approved by the European Commission and the relevant UK authorities. These clauses can be viewed here.
Where we share data with our US-based parent company, we rely on our Inter Group Agreement, which incorporates the UK Addendum to the EU Standard Contractual Clauses.
- How we protect your information
We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed. In addition, we limit access to your personal information to only those employees, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions, and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal information breach and will notify you and any applicable regulator of a breach, where we are legally required to do so.
Examples of the measures we take to protect your data include:
• Encryption of data
• Security measures that protect and monitor our IT systems to protect from external attack and unauthorised access
• Regular penetration testing of our systems
• Information security assessments of third parties we share your data with
• Internal policies and regular staff training relating to data protection
Measures you can take to protect your data
We will never ask you to confirm your bank or credit card details via email or text. If you receive such a request, please ignore it, and do not respond.
When accessing your account in a public location, we recommend you log out and close your browser when you have finished.
We recommend that you keep your account and password details private and do not share them. It is also recommended that when setting passwords, you use at least 8 characters and a mixture of letters and numbers. You should make your password hard to guess, not use the same password for different online accounts and consider changing it regularly.
- Your rights
You have the following rights under data protection laws in relation to your personal information:
Right to be informed in a clear and concise way about how we process your personal information. This is referred to as privacy information and we rely on this Privacy Notice to meet this requirement.
Right of access to your personal information (commonly known as a "Data Subject Access Request", “DSAR” or “SAR”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it
We are committed to providing the information you request as part of your Data Subject Access Request and have procedures in place to ensure this occurs in a timely fashion.
Right to rectification of the personal information that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
Right to erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal information to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
Right to restrict processing of your personal information. This enables you to ask us to suspend the processing of your personal information in the following scenarios:
• If you want us to establish the data's accuracy.
• Where our use of the data is unlawful, but you do not want us to erase it.
• Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims.
• You have objected to our use of your data, but we need to verify whether we have overriding legitimate grounds to use it.
Right to data portability of your personal information to you or to a third party. We will provide to you, or a third party you have chosen, your personal information in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
Right to object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal information for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate reasons to process your information which override your rights and freedoms.
Right related to automated decision making and profiling based on the personal information we hold about you. Where we do this, you have the right to be informed of the processing and to request human intervention. Where we rely on this type of processing, we will carry out regular checks to ensure our systems are working as intended.
Right to withdraw consent based on the personal information we hold about you. Where we do this, you have the right to be informed of the processing and to request human intervention. Where we rely on this type of processing, we will carry out regular checks to ensure our systems are working as intended.
Please note we do not have agreements in place with any third-party platforms that offer “Data Subject Rights Requests as a Service.” As a responsible controller of your personal information, we recognise doing so would present significant risks. The rights afforded to you do not obligate us to interact with third parties. We will however endeavour to action requests received from third parties. Following receipt of a request we will continue our interactions with the you (or the requestor themselves) directly.
If you wish to exercise any of the rights set out above, please contact us at [email protected].
Time limit to respond
We endeavour to respond to all legitimate requests within the required one calendar month timeframe. If your request is particularly complex or you have made a number of requests, we may need to extend the response window by up to a further two calendar months. In this case, we will notify you and keep you updated.
No fee usually required
You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. Alternatively, we may refuse to comply with your request in these circumstances.
What we need from you
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information (or to exercise any of your other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
- How to contact us or make a complaint
Our Data Protection Officer helps ensure we protect the personal information we process and that we comply with data protection legislation.
If you have any questions about this Privacy Notice or our privacy practices, please contact our Data Protection Officer at [email protected].
You also have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the opportunity to deal with your concerns before you approach the ICO, so please contact us in the first instance.
Changes to this Privacy Policy
Park Holidays UK reserve the right to amend or modify this Privacy Policy at any time and any changes will be published on our website. The date of the most recent revision will appear on this web page. If we make significant changes to this policy, we may also notify you by other means such as sending an email. Where required by law we will obtain your consent to make these changes. If you do not agree with any changes, please do not continue to use our website and let us know that you wish to have your personal data deleted.
Last Updated: 4th April 2024