Three Mile Beach Privacy Policy

Personal information we collect about you

We collect personal information about you when you access our website, make a booking with us or otherwise contact us (via telephone, email, social media or our website).

We collect this personal information from you either directly, such as when you make a booking with us or contact us, or indirectly, such as your browsing activity while on our website (see “Cookies” below).

We also collect personal information about you from other sources as follows:

• Third party travel agents when you book one of our properties via them
• Booking platforms such as Booking.com, Expedia and Air BnB

In addition, we will collect certain personal information about other members of your party, such as name and contact details. Where you are providing us with personal information of third parties, please tell them where to access our privacy policy and give them our contact details if they have any queries. Please make sure you let us know if any of these third parties would like to speak to us directly, either about the trip or about our use of their data.

The personal information we collect depends on the purpose for which you engage with us. This information includes the following:

• Identity Data - full name and title
• Contact Data - address, geographic location, email address and telephone numbers
• Financial Data - bank account and payment card details
• Transaction Data - details about your bookings, payments to and from you and other details of services you have purchased from us
• Technical Data - internet protocol (IP) address, your distributor portal login data, browser type and version, time zone setting and geographical location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website including, where the data is available, information about the identity of the owner of fixed IP addresses
• Profile Data – account details such as username and log-in details, bookings made by you, your interests, special requirements and booking preferences and requests, such as particular a property or third party service provider that you prefer to use
• Usage Data - information about how you use our website and services, including survey responses
• Marketing and Communications Data - your preferences in receiving marketing from us and your communication preferences

Some of this personal information is required to provide our properties to you. If you do not provide personal information we ask for, it may delay or prevent us from making or fulfilling your booking.

This website is not intended for use by children.

In addition, we may process some special categories of personal data about you e.g. specific details of any relevant health conditions, disabilities, access requirements or special dietary requirements that you may have. We collect this information directly from you to try to ensure that your trip is appropriate for your needs and to try and keep you safe during any trip that you plan through us. We will only collect this information from you where you have opted to share it with us and with your explicit consent.

How and why we use your personal information

Under data protection law, we can only use your personal information if we have a legal basis for doing so for example:

• Contract: where our use of your personal information is necessary for a contract we have with you, or because you have asked us to take specific steps before entering into a contract
• Legal obligation: where our use of your personal information is necessary for us to comply with the law (not including contractual obligations)
• Legitimate interests: where our use of your personal information is necessary for our legitimate interests or the legitimate interests of a third party (unless there is a good reason to protect your personal information which overrides our legitimate interests) – further details of our specific legitimate interests are set out in the table below
• Consent: where you have given us clear consent for us to process your personal information for a specific purpose – although generally we do not rely on consent as a legal basis for processing your personal data, other than in relation to non-essential cookies and sending direct marketing communications via electronic means

Purposes for which we will use your personal data

We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so.

Purpose/Activity

Type of data

Legal basis for processing including basis of legitimate interest

To register you as a new customer (a) Identity

(b) Contact

(c) Financial Performance of a contract with you To deal with and respond to enquiries you may make about our properties and services (a) Identity

(b) Contact

(c) Profile a) Performance of a contract with you

(b) Necessary for our legitimate interests (to engage with prospective and existing customers to grow our business) To make and process your booking with us, including:

(a) Collecting information about your location, details of your stay and your booking preferences

(b) Managing payments, fees and charges

(c) Collecting and recovering money owed to us (a) Identity

(b) Contact

(c) Financial

(d) Transaction

(e) Profile

(f) Marketing and Communications (a) Performance of a contract with you

(b) Necessary for our legitimate interests (to recover debts due to us) To manage our relationship with you which will include:

(a) Fulfilling your booking and providing services to you during your stay with us

(b) Making arrangements and third party bookings on your behalf for during your trip

(c) Notifying you about changes to our services, terms or privacy policy

(d) Asking you to leave a review or take a survey

(a) Identity

(b) Contact

(c) Profile

(d) Marketing and Communications (a) Performance of a contract with you

(b) Necessary to comply with a legal obligation

(c) Necessary for our legitimate interests (to keep our records updated, to study how customers use our properties and services and grow our business) To administer and protect our business and this website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data) (a) Identity

(b) Contact

(c) Technical

(d) Usage (a) Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise)

(b) Necessary to comply with a legal obligation To deliver relevant website content and marketing materials to you and measure or understand the effectiveness of the marketing we send to you (a) Identity

(b) Contact

(c) Profile

(d) Usage

(e) Marketing and Communications

(f) Technical Necessary for our legitimate interests (to study how customers use our properties and services, to develop them, to grow our business and to inform our marketing strategy) To use data analytics to improve our website, properties, services, marketing, customer relationships and experiences (a) Technical

(b) Usage Necessary for our legitimate interests (to define types of customers for our properties and services, to keep our website updated and relevant, to develop our business and to inform our marketing strategy) To make suggestions and recommendations to you about stays and services that may be of interest to you (a) Identity

(b) Contact

(c) Technical

(d) Usage

(e) Profile

(f) Transaction Necessary for our legitimate interests (to develop our properties and services and grow our business)

Where you are a regular customer we may retain some personal information about your preferences and stay details so that we can use this when you next book with us. We only retain this information where we can establish that it is necessary for our legitimate interest to tailor and improve our services and deliver bespoke services to our regular customers.

Who we share your personal information with

In order to make sure that we run our business efficiently, and to make sure that you get the service that you expect, we will need to share your personal information as necessary, with the third parties set out below.

We routinely share personal information with:

• third parties we use to help deliver our properties and services to you and in order to assist with making arrangements for your stay, e.g.
• • payment service providers
  • cleaning and maintenance service providers
  • trusted third-party business partners, for example local taxi companies and local chefs and restaurants where you have requested that we make bookings with these third parties on your behalf
  • third party travel insurance providers where you have requested that we share your information with them in order to facilitate the purchase of travel insurance
• other third parties we use to help us run our business, e.g.
• • IT systems and email providers
  • Resort Suite, our bookings management software provider
  • Ongage, our email marketing platform provider
  • PipeDrive our CRM system provider

We only allow our service providers to handle your personal information if we are satisfied they take appropriate measures to protect your personal information. We also impose contractual obligations on service providers that we engage to process personal data on our behalf, to ensure they can only use your personal information to provide services to us and to you.

We may also share personal information with our accountants or solicitors.

We may disclose and exchange information with law enforcement agencies and regulatory bodies to comply with our legal and regulatory obligations.

We may also need to share some personal information with other parties, such as potential purchasers of some or all of our business or during a re-structuring. Usually, information will be anonymised but this may not always be possible. The recipient of the information will be bound by confidentiality obligations.

We will not share your personal information with any other third party.

Transfer of your information out of the UK and EEA

We do not envisage that we will need to transfer your personal information outside of the UK and EEA. However, if it does become necessary for us to share your personal information outside of the UK and European Economic Area (EEA) to provide our services to you, for example with third party service providers which may be located outside of the UK and EEA, we will ensure that you data is adequately protected. We would always ensure that any transfer complies with data protection law.

A cookie is a small text file which is placed onto your device (e.g. computer, smartphone or other electronic device) when you use our website. We use cookies on our website. These help us recognise you and your device and store some information about your preferences or past actions.

We will ask for your permission (Consent) to place cookies or other similar technologies on your device, except where they are essential for us to provide you with a service that you have requested.

If you do not want to accept any cookies, you may be able to change your browser settings so that cookies (including those which are essential to the services requested) are not accepted. If you do this, please be aware that you may lose some of the functionality of our website.

For further information on cookies, our use of cookies, please see our cookie policy.

We may use your personal information to send you updates (by email or text message) about our properties and services, including exclusive offers and promotions. We will only do so where we have your consent or it is in our legitimate interests, to promote and grow our business.

We will always treat your personal information with the utmost respect and never sell it to other organisations for marketing purposes.

If you have given your consent to receive marketing communications, or it is in our legitimate interests to send them because you are a consumer that has previously made a booking or purchased services from us, you always have the right to opt out of receiving further promotional communications by using the ‘unsubscribe’ link in emails.

We may ask you to confirm or update your marketing preferences if there are changes in the law, regulation, or the structure of our business.

Please note that we may also send you other communications in relation to your booking or in order to respond to queries you have raised, such communications are service communications and are not a form of marketing.

You have certain rights in respect of the personal information that we hold about you. Details of these rights are set out below.

Your rights:

(a) Access: We will confirm to you whether or not we are processing and using personal information about you, at your request and, if so, provide you with access to and a copy of such personal information and the other details to which you are entitled.

(b) Rectification: We will correct any inaccurate personal data and complete any incomplete personal data (including by providing a supplementary statement) that we hold about you.

(c) Erasure: We will erase your personal information at your request without undue delay where there is no good reason for us to continue to use it.

(d) Restriction: We will restrict the processing of your personal information in certain circumstances, if you ask us to do so.

(e) Data portability: We will provide you or third parties on your behalf with a copy of any personal information that we hold about you which you have provided to us in a structured, commonly used and machine-readable format.

(f) Objection (including objection to direct marketing): We will respect your general rights to object to the processing of your personal information in certain circumstances, including for direct marketing purposes.

(g) Automated decisions and profiling: We will respect your rights to require us not to carry out decisions based solely on automated processing, including profiling, which produce legal or similarly significant effects on you.

If you would like to exercise any of those rights, please:

• email, call or write to us — see contact details at the start of this policy
• let us have enough information to identify you e.g. your full name, address and booking reference number
• let us have proof of your identity (a copy of your driving licence or passport) if we cannot otherwise reasonably identify that you are who you say you are

AND

• let us know what right you want to exercise and the information to which your request relates

We will keep your personal information for limited and appropriate periods of time only and the applicable retention periods will always be linked to our purposes for processing your personal information. This means that the retention periods will vary according to the type of personal information.

When it is no longer necessary to retain your personal information, we will delete or anonymise it.

As an indication, if you make a booking with us, we will keep your personal information while we are providing our services to you and fulfilling your booking. Thereafter, we will keep your personal information for as long as is necessary:

• to respond to any questions, complaints or claims made by you or on your behalf
• to show that we treated you fairly
• to keep records required by law

If you need more information on this, please contact us using the details set out above.

We take the security of your information very seriously and have put physical, technical, operational and administrative strategies, controls and measures in place to help protect your personal information from unauthorised access, use or disclosure as required by law and in accordance with accepted good industry practice. We will always keep these under review to make sure that the measures we have implemented remain appropriate.

Additionally, those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

We are very keen to hear from you, including if you have any questions, concerns, comments, requests or complaints regarding this privacy policy, our website and/or our use of your personal information. Please contact us using the contact details listed above.

If you have any complaints regarding this privacy policy or the way that we use your personal information, you may also contact the UK Information Commissioner on 0303 123 1113 or at https://ico.org.uk/

We reserve the right to modify this privacy policy from time to time — for example, if we need to reflect changes to the way that we use your personal information. Any changes we make in the future will be posted on the following website: www.threemilebeach.co.uk and, where appropriate, notified to you by e-mail. You should check back frequently to see any updates or changes to our privacy policy.