Privacy Policy

1. Introduction

BRITHOLIDAY LTD (“Britholiday”, “we”, “us” or “our”) respects your privacy and is committed to protecting personal information in accordance with applicable UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended.

This Privacy Policy explains what personal information we collect, why we use it, how we share and protect it, how long we retain it and what rights you may have.

2. Who We Are

The data controller is the organisation that determines the purposes and means of processing personal information.

If you have questions about this Policy or how your information is handled, contact us using the details above.

3. The Personal Information We Collect

The information we collect depends on how you use our website and services.

A. Contact and enquiry information

This may include your name, email address, telephone number, country of residence and the contents of any enquiry, message or complaint you send us.

B. Booking information

Where relevant to a hotel reservation, this may include:

• Lead guest and other guest names.
• Check-in and check-out dates.
• Destination, property, room type and occupancy details.
• Booking reference and reservation status.
• Special requests or information needed to fulfil a request.
• Correspondence with us or the accommodation provider.

Please do not provide sensitive personal information unless it is genuinely necessary for your request and we have explained the appropriate handling arrangements.

C. Payment and transaction information

Depending on the payment arrangement, we may receive transaction references, payment status, amount, currency, billing details and limited payment-related information.

Payments may be processed by a third-party payment provider or accommodation supplier. We do not intend to collect or retain full payment-card security codes through ordinary website forms or email. Payment information is handled according to the applicable payment arrangement and provider's privacy notice.

D. Technical and usage information

When you visit our website, we or our service providers may process information such as your IP address, device and browser type, operating system, approximate location inferred from technical information, pages viewed, referral source, timestamps, error logs and cookie or similar technology identifiers.

The actual information collected depends on the website configuration, hosting environment, analytics tools and technologies in use.

E. Customer support and complaint information

If you contact us with a question, booking issue or complaint, we may retain the correspondence, booking information relevant to the issue, investigation notes and our response.

F. Information received from third parties

To facilitate a reservation, we may receive relevant information from a hotel, accommodation supplier, booking platform, wholesaler, payment provider or other party involved in the transaction. This may include reservation details, availability, payment status and changes to a booking.

Where a booking is facilitated through a supplier such as TBO or Expedia, the precise information exchanged will depend on the applicable supplier arrangement and the particular reservation.

4. How We Use Your Information

We may use personal information to:

• Respond to enquiries and provide customer support.
• Search for hotel availability and obtain or confirm quotes.
• Create, manage, amend or cancel reservations.
• Communicate booking details, confirmations, changes and important notices.
• Process payments, refunds and related transactions where applicable.
• Investigate complaints, resolve disputes and maintain customer service records.
• Detect and prevent fraud, misuse, security incidents and unauthorised transactions.
• Operate, maintain and improve our website and booking processes.
• Meet legal, regulatory, tax, accounting and record-keeping obligations.
• Establish, exercise or defend legal claims.
• Send marketing communications where permitted by law and where the required consent or other lawful basis exists.

We will not use personal information for a purpose incompatible with the purpose for which it was collected unless the law permits us to do so.

5. Our Lawful Bases for Processing

Under UK GDPR, we must have a lawful basis for processing personal information. Depending on the circumstances, we may rely on the following:

• Contract or steps before entering into a contract: To respond to a booking request, arrange a reservation, communicate with the supplier or perform our obligations to you.
• Legal obligation: To comply with applicable legal, tax, accounting, regulatory or other statutory requirements.
• Legitimate interests: To operate our business, administer bookings, maintain service records, prevent fraud, protect our systems, improve our services and handle complaints, where those interests are not overridden by your rights and interests.
• Consent: Where required, for example for certain non-essential cookies or electronic marketing.
• Vital interests or other lawful grounds: Where applicable in exceptional circumstances permitted by law.

The appropriate lawful basis depends on the particular processing activity. Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

6. Hotel Suppliers and Other Recipients

We may share the minimum information reasonably necessary with:

• Hotels and accommodation providers.
• Booking platforms, wholesalers and travel suppliers involved in a reservation, including TBO or Expedia where applicable.
• Payment processors, banks and fraud-prevention providers.
• Website hosting, IT support, email, CRM and customer service providers.
• Professional advisers, insurers, auditors and legal representatives where necessary.
• Regulators, law enforcement agencies, courts or other authorities where disclosure is legally required or permitted.
• A successor organisation in connection with a genuine business sale, restructuring or transfer, subject to appropriate safeguards and legal requirements.

Recipients may process information as our service providers or as separate controllers, depending on their role and the relevant arrangement. Their own privacy notices may apply to their processing.

We do not sell personal information to third parties in exchange for money. We do not disclose information to third parties for their own direct marketing unless the law permits it and any required consent has been obtained.

7. International Transfers

Some of our suppliers or service providers may process personal information outside the United Kingdom.

Where personal information is transferred internationally, we will take the steps required by applicable data protection law. Depending on the destination and circumstances, these may include an adequacy regulation or decision, the UK International Data Transfer Agreement, the UK Addendum to standard contractual clauses, or another lawful transfer mechanism, together with any necessary risk assessment and supplementary safeguards.

You may contact us for further information about relevant international transfers and safeguards, subject to lawful restrictions.

8. How Long We Keep Information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including to meet legal, accounting, reporting, dispute-resolution and record-keeping requirements.

Retention periods vary according to the type of information, the booking, applicable law and whether a dispute or legal claim is ongoing.

For example, booking records and transaction-related records may need to be retained for several years where required for accounting, tax, contractual or legal purposes. Enquiries that do not result in a booking may be retained for a shorter period consistent with their purpose.

When information is no longer required, we will take reasonable steps to delete it or anonymise it securely, unless we are legally required or permitted to retain it for longer.

9. Data Security

We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, accidental loss, alteration, disclosure or destruction.

These measures may include access controls, restricted permissions, secure service providers, staff procedures and appropriate system protections. The specific measures depend on the systems and information involved.

No method of transmission or storage is completely secure. We cannot guarantee absolute security, but we take reasonable steps to protect the information we handle.

If a personal data breach occurs, we will assess and respond to it in accordance with applicable legal requirements, including notification to the Information Commissioner's Office or affected individuals where required.

10. Your Data Protection Rights

Subject to applicable law and any relevant exemptions, you may have the right to:

• Access: Request a copy of the personal information we hold about you.
• Rectification: Ask us to correct inaccurate or incomplete information.
• Erasure: Ask us to delete information in certain circumstances.
• Restriction: Ask us to restrict processing in certain circumstances.
• Data portability: Request certain information in a commonly used, machine-readable format where the legal conditions apply.
• Object: Object to processing based on legitimate interests and to direct marketing.
• Withdraw consent: Withdraw consent where processing relies on consent.
• Complain: Lodge a complaint with the Information Commissioner's Office (ICO).

These rights are not absolute and may be subject to legal conditions or exemptions. For example, we may need to retain certain booking or transaction records to comply with legal obligations or establish, exercise or defend legal claims.

To exercise your rights, email inquiries@britholiday.com or write to our registered office. Please explain your request and provide enough information for us to identify the relevant records. We may need to verify your identity before responding.

We will respond within the period required by applicable data protection law. In most cases, this is one month, although the law permits extensions in certain circumstances.

11. Marketing Communications

We may send service-related messages necessary to manage an enquiry or reservation, such as booking confirmations, payment information, changes or important notices.

We will send promotional electronic marketing only where permitted by applicable law and where any required consent or other lawful condition has been met.

You can opt out of marketing messages at any time by using the unsubscribe mechanism provided or contacting us. Opting out of marketing will not stop essential communications about an existing booking or service.

12. Cookies and Similar Technologies

Our website may use cookies and similar technologies for essential website functionality, preference management, security, analytics or marketing, depending on the technologies enabled.

Where consent is required, we will ask for it before placing or using non-essential cookies or similar technologies. You should be able to reject non-essential cookies as easily as accepting them and change your preferences later.

For further information, please read our Cookie Policy.

13. Children's Information

Our hotel-booking services are intended to be used by adults making or managing reservations. A parent or responsible adult may need to provide a child's name or age where required for a hotel booking.

We do not knowingly collect children's personal information for unrelated purposes. If you believe that a child has provided information to us inappropriately, please contact us so that we can assess the matter and take appropriate action.

14. Third-Party Websites

Our website may link to third-party websites, including hotel, supplier, payment or booking platforms. We do not control the privacy practices of those websites.

When you follow a third-party link or complete a transaction directly with another provider, please read that provider's privacy notice and terms.

15. Changes to This Policy

We may update this Privacy Policy to reflect changes in our services, data-processing practices or legal requirements. The current version will be published on our website with a revised “Last updated” date.

16. Contact and Complaints

For privacy questions or requests, contact:

If you are dissatisfied with our response, you may complain to the UK Information Commissioner's Office (ICO). Information about making a complaint is available at https://ico.org.uk/.

We encourage you to contact us first so that we have an opportunity to address your concern.