Our commitment to privacy and data protection. See how we manage information under GDPR best practice.
Last updated: 2 October 2026
HolidaymakerXP is the trading name of Holidaymaker App Ltd (12699003). Registered office address: Wadebridge House 16 Wadebridge Square, Poundbury, Dorchester, Dorset, United Kingdom, DT1 3AQ.
In this policy, “we”, “us” and “our” mean Holidaymaker App Ltd, trading as HolidaymakerXP. We build guest experience technology for holiday parks, glamping sites, resorts, attractions and other hospitality operators in the UK, and we run the HolidaymakerXP community.
For the personal data described in this policy, we are the data controller. That means we decide why and how it is used. Where we handle guest data on behalf of a park or other client through their branded guest app, we act as a data processor and that client is the controller. Section 2 explains the difference.
We are registered with the Information Commissioner’s Office (ICO) as a data controller. Our VAT number is 354643686.
Contact us about privacy: info@holidaymakerapp.co.uk, or write to us at the registered office above. We do not have a statutory Data Protection Officer. Privacy questions are handled by our core team, who can escalate to our legal advisers.
This policy covers personal data we collect as the controller through our websites, the HolidaymakerXP community and community app, our events, our marketing and our direct dealings with prospects, clients, partners and suppliers.
It applies to: holidaymakerapp.co.uk, holidaymakerxp.co.uk, community.holidaymakerxp.co.uk and any other HolidaymakerXP page or form; the HolidaymakerXP community app; event registration and attendance; our email newsletters and updates; our social media channels; and any conversation by phone, email, video call or chat.
Our products work differently, because in some of them a park or other client decides what happens to the data and we act on their instructions.
| Product or service | Our role | Whose privacy notice applies |
|---|---|---|
| Websites, community, community app, events, newsletters | Controller | This policy |
| Sales, onboarding and account management (our clients and prospects) | Controller | This policy |
| Holidaymaker-powered guest apps (a park’s branded app) | Processor for the park, controller for limited anonymous usage analytics | The park’s own privacy notice, plus section 3 of this policy for analytics |
| HeyGuest AI chat and guest intelligence features | Processor for the client | The client’s own privacy notice |
| seeView digital signage | We do not collect personal or technical data from viewers | Not applicable |
Partner and integration systems. ParkSync, RMS, GemaPark, CampManager and other connected systems are separate companies. They are not part of HolidaymakerXP. Where a client switches one on, such as ParkSync for AI messaging and CRM, data flows to it at the client’s request, and that company’s own privacy notice covers what it does with the data.
If you are a guest using a park’s app and want to see, correct or delete your data, please contact the park first. They decide how it is used. We will help them respond to you. You can also contact us at info@holidaymakerapp.co.uk and we will point you to the right place.
Our sites link to partner, client and other third-party sites. We do not control them and are not responsible for their privacy practices, so please read their notices.
We collect only what we need. The table shows what, and where it comes from.
| Type of data | Examples | Where it comes from |
|---|---|---|
| Identity and contact | Name, email, phone, job title, organisation, sector, location | You, when you fill in a form, join the community, book an event or contact us |
| Client and account | Venue details, contract and billing details, purchase history, support requests | You, your business, and our partners where you have agreed |
| Community and app | Your name, email, organisation, role and sector, what you post, comment or ask, and how you use the community app | You, when you use the community |
| Event | Registration, attendance, dietary and access needs, photos and video taken at events | You, and our event photographers |
| Communications | Emails, call notes, chat messages, survey answers | You, and us |
| Marketing and engagement | Subscriptions, preferences, which emails you open or click, pages you visit, ad clicks, forms and lead forms you submit | You, Mailchimp, HubSpot and, for ads, Meta, LinkedIn and Google (see sections 5 and 6) |
| Technical | IP address, device and browser type, operating system, time zone, pages and screens viewed, app version | Your device, automatically |
| Anonymous guest app usage | Screen views, routes, button clicks, group size, pets, accommodation type and length of stay, with no name or contact details | Holidaymaker-powered guest apps |
| Professional contact data | Business name, role and work contact details of people at hospitality businesses | Public sources such as company websites and professional networks, and partners |
Sensitive data. We do not ask for health, race, religion or similar special category data. The one likely exception is dietary or access needs you give us when booking an event, which can reveal health information. We ask for these only to look after you at the event, and only with your explicit consent. You can withdraw it at any time.
Children. Our services are for businesses and people working in hospitality. They are not aimed at children, and we do not knowingly collect children’s data. If you think a child has given us data, tell us and we will delete it.
UK data protection law (the UK GDPR, the Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025) says we must have a lawful basis for every use of personal data. Here is ours.
| What we do | Legal basis |
|---|---|
| Answer enquiries and take steps you ask for before a contract | Legitimate interests, or steps at your request before a contract |
| Provide our services to clients, run accounts, take payment, support you | Contract |
| Keep records for tax, accounting and legal duties (for example, 7 years for booking and customer records) | Legal obligation |
| Run the community and community app: access, discussions, moderation, safety | Legitimate interests |
| Run events: registration, attendance, follow-up, improving future events | Legitimate interests |
| Dietary and access needs for events | Explicit consent |
| Photos and video at events | Legitimate interests, with notice at the event |
| Marketing emails to people at limited companies and other organisations | Legitimate interests, with an easy opt-out every time |
| Marketing emails to individuals, sole traders and partnerships | Consent, or the soft opt-in where you are an existing client or have asked us for a quote and we market similar products |
| Newsletters and community updates you sign up to | Consent |
| Advertising cookies and pixels (Meta, LinkedIn, Google) | Consent |
| Matching business contact details to ad audiences | Legitimate interests, with an easy opt-out |
| Website and app analytics, security, fraud prevention, improving our products | Legitimate interests, or consent where cookie rules require it |
| Establishing, exercising or defending legal claims; responding to regulators | Legal obligation, legitimate interests |
Where we rely on legitimate interests, we have weighed our interests against yours and documented it. You can object at any time (see section 12). We rely mainly on legitimate interests. We ask for consent only where the law requires it: cookies that are not exempt (including advertising pixels), marketing to individuals not covered by the soft opt-in, and dietary or access needs at events. Direct marketing is a recognised legitimate interest under the 2025 Act, but we still honour every opt-out and the separate rules for electronic marketing in PECR (the Privacy and Electronic Communications Regulations).
We also rely on legitimate interests to match the business details of our contacts to ad audiences on Meta, LinkedIn and Google, with an easy opt-out (section 5). We do not sell your personal data. We do not share it with third parties for their own marketing without your explicit consent.
We use cookies and similar technologies (such as pixels, local storage and tracking scripts) on our websites, community pages and community app. The rules sit in PECR, as updated by the Data (Use and Access) Act 2025 and the ICO’s guidance on storage and access technologies.
| Type | What it does | Do we ask first? |
|---|---|---|
| Strictly necessary | Keeps the site secure and working, remembers your cookie choice, supports log-in to the community | No |
| Appearance and preferences | Remembers settings such as language or display preferences | No, but you can switch it off |
| Statistical analytics | Counts visits, pages viewed, device and browser types and traffic sources so we can improve our services. It does not identify you or build a profile | No, but you can opt out, and we only use it for statistics |
| Advertising and tracking | HubSpot tracking, the Meta Pixel, the LinkedIn Insight Tag and Google Ads tags. They measure our ads, let us show ads to people who have already visited us, and link visits to your contact record once you give us your details | Yes. We only set these after you agree |
The ICO’s exceptions only apply where a cookie is used for that one purpose. If a tool does statistics and something else, we ask for consent for all of it.
We advertise on Meta (Facebook and Instagram), LinkedIn and Google. The Meta Pixel, LinkedIn Insight Tag and Google Ads tags are advertising cookies. We set them only if you accept them in the cookie banner. They let those companies recognise your browser across sites, so they use that data as independent controllers under their own policies. We do not use other third-party interest-based advertising cookies.
Ad audiences and lead forms. We use three advertising routes. First, retargeting: we show ads to people who visited our sites or engaged with us, but only where they accepted advertising cookies. Second, audience matching: we may upload hashed (scrambled) business email addresses of our contacts to Meta, LinkedIn and Google so we can reach them, or leave them out, on a legitimate interests basis. You can opt out at any time. Third, conversion measurement: where an ad leads to an enquiry, we may send the platform a hashed email or phone number, and whether the lead became a client, so it can tell us which ads worked. If you complete a Meta, LinkedIn or Google lead form, the details come to us and are held in HubSpot as in section 6.
Control your ads. Decline advertising cookies in our banner, change your ad settings on Meta, LinkedIn or Google, or ask us at info@holidaymakerapp.co.uk to remove you from our audiences.
Your choices. Use the cookie banner to change your choice at any time. You can also block cookies in your browser, though parts of the site may stop working.
Cookie list. Email info@holidaymakerapp.co.uk for a full list of the cookies we set, who sets them, what they do and how long they last.
How we send marketing. We email newsletters, community updates, event invitations and product news. Under PECR we send to individuals only with consent, or under the soft opt-in if you are an existing client or have asked about our services. We may email people at limited companies and other organisations on a legitimate interests basis. Every email has an unsubscribe link, and you can also ask us at info@holidaymakerapp.co.uk. We stop within days of your request and keep a minimal suppression record so we do not email you again by mistake.
Mailchimp. We use Mailchimp, a service of Intuit, to manage mailing lists and send emails. We upload your name, email address and subscription preferences to Mailchimp. Mailchimp acts as our processor for this data, under its agreement with us. It also collects email interaction data through automatic means, such as whether you open or click an email, which we use to see what is useful and to keep our lists accurate. You can avoid this by blocking images in your email app or by not subscribing. Mailchimp may transfer data outside the UK, relying on the UK Extension to the EU-U.S. Data Privacy Framework and Standard Contractual Clauses. See the Intuit Privacy Statement.
HubSpot. We use HubSpot as our customer relationship management (CRM) system, for forms, meeting booking, email and website analytics. HubSpot holds contact and company records, form submissions, emails and call notes, deal and support history, and website activity linked to your contact record once you identify yourself. HubSpot acts as our processor for this data under its Data Processing Agreement. Its tracking code collects IP addresses and online identifiers, and HubSpot uses some of that information to improve its own products. HubSpot transfers data internationally using Standard Contractual Clauses, the UK Addendum and the EU-U.S. Data Privacy Framework. See the HubSpot Privacy Policy.
Your rights apply here too. You can ask us to see, correct or delete what we hold in either tool, or to stop tracking your visits (use the cookie banner).
The HolidaymakerXP community is open to clients, partners, suppliers, people exploring HolidaymakerXP, and people in hospitality more widely. It lives in our community app and on our community website, and it is separate from Holidaymaker App, the guest app our clients’ guests use.
What we collect. Your name, email, job title, organisation and sector, what you post, comment or ask, your event attendance, and technical data such as device type, app version and how you use the app.
What other people can see. Discussions, questions and comments are visible to other community members. Please do not post anything you would not want other members to read, and do not post other people’s personal data without their permission.
What we use it for. To give you access, run discussions and events, keep the community safe, moderate content, tailor updates to your role or sector, understand what is useful, and improve the community. We never sell it and we never build a profile you have not agreed to.
Moderation and safety. We moderate the community day to day. If you see something that should not be there, tell us through our contact page or at info@holidaymakerapp.co.uk and we will deal with it. We may remove content or accounts that break our community rules, and keep a record of that for safety and legal reasons.
Joining and leaving. We set you up when you ask to join. To leave, or to have your account and personal data deleted, email info@holidaymakerapp.co.uk and we will do it. Content you posted may be removed or anonymised so conversations still make sense.
Who helps us run it. Our community app and hosting providers act as our processors, under contract (section 10).
Email and the community are separate. Unsubscribing from emails does not close your community account, and closing your account does not unsubscribe you from marketing unless you ask. Tell us which you want.
Our community app, and the guest apps we build for clients, are published on the Apple App Store and Google Play. Both stores require a privacy policy, and this is the policy linked from those listings and from inside the apps.
We use AI to help people, not to replace them. Our principle is that automation is a funnel to a human, never a substitute for one.
In our products. HeyGuest, our AI chat tool, and our guest intelligence and personalisation features run for clients. They use approved knowledge sources, say when you are talking to AI, hand over to a person when they are unsure or you ask, and keep audit logs. We test outputs before release and monitor wrong or incomplete answers. For clients we act as processor, so the park’s privacy notice also applies. Some clients also connect third-party AI messaging tools such as ParkSync. These are separate companies, not part of HolidaymakerXP, and their own privacy notices apply to what they do.
In our own work. Our team uses AI assistants, including Claude from Anthropic, for drafting, research, analysis and automating routine tasks. We follow these rules:
Automated decisions. We use automated workflows, such as email engagement scoring and tagging in HubSpot, to decide which updates to send. They do not make decisions that have a legal or similarly significant effect on you, and a person takes over when a lead is ready. If we ever did, we would tell you, and you could ask for a person to review the decision and challenge it.
Profiling. We group contacts by role, sector, engagement and similar business details to send relevant content, on a legitimate interests basis. You can object at any time (section 12).
App stores and AI. We do not share personal data with a third-party AI service for its own purposes. Where an app or feature does send data to an AI provider, we say so and get any permission the app stores require.
We share personal data only where we need to, and we never sell it.
Advertising platforms: Meta, LinkedIn and Google receive data through ad tags (with your consent) and hashed business contact details for audience matching. They use it under their own privacy policies, as independent controllers. Everyone else on this list must protect your data to the same standard we do.
Transfers outside the UK. Some providers process data outside the UK, mostly in the USA and the EU. We only transfer where the data is protected to a standard that is not materially lower than UK law, using UK adequacy regulations (including the UK-US data bridge for certified companies), the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, plus checks on the provider. Ask us if you want details.
We keep personal data only as long as we need it for the reason we collected it.
| Data | How long |
|---|---|
| Booking, contract and customer records | 7 years, for tax and legal reasons |
| Community accounts and event sign-ups | Until you delete your account or ask us to remove you |
| Marketing contacts | Until you unsubscribe or ask us to delete, plus a minimal suppression record so we do not email you again |
| Enquiries, CRM contacts and event photos | Reviewed regularly and deleted or anonymised when we no longer need them |
| Guest app analytics | Anonymous, and aggregated after 12 months |
When the time is up, we delete or anonymise it. If you ask us to delete something we must keep by law, we will tell you why.
Security. We use access controls limited to the people who need the data, multi-factor authentication, encryption in transit and at rest where our providers support it, supplier checks, staff training, and logging. We test our ability to restore and recover from incidents.
If something goes wrong. We have a breach response process. If a breach is likely to put your rights at risk, we tell the ICO within 72 hours of becoming aware, and we tell you without undue delay if the risk to you is high.
You have the right to:
To use any of them, email info@holidaymakerapp.co.uk or write to our registered office. We reply within one month, and tell you if we need more time. We may ask you to prove who you are, and we may ask what you are looking for so we can search reasonably. It is free unless a request is clearly unfounded or excessive. If your data is in a park’s guest app, we may pass your request to the park. To stop ads, decline advertising cookies in our banner, change your ad settings on each platform, or ask us to remove you from our audiences.
Complaints. If you are unhappy with how we have used your data, tell us first at info@holidaymakerapp.co.uk. You can complain through any channel, including social media. We acknowledge it within 30 days, investigate without undue delay and tell you the outcome and what we did. You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113. You do not have to complain to us first.
Changes. We review this policy at least once a year and when our services or the law change. We will tell you about important changes through our sites, the community app or by email. The date at the top shows when it was last updated.
Who we are, again. HolidaymakerXP is the trading name of Holidaymaker App Ltd (12699003). Registered office address: Wadebridge House 16 Wadebridge Square, Poundbury, Dorchester, Dorset, United Kingdom, DT1 3AQ.
A first-timer's view of XP Hospitality Edinburgh 2026: what Scottish tourism leaders, HARPA, Zonal and others said on policy, websites and AI, and why independents do better sharing.
Read more
Ali Carmichael of Experience UX explains which reassurance to add before payment, how to fix forms and errors, and how a warmer confirmation page makes booking feel exciting.
Read more
Kimberley Ramsey of TigerTMS opens XP Hospitality Dorset with a straight view of which guest tech earns its place for independents.
Read more