Privacy Policy

To provide you with the products and services booked with us, to fulfil a contract

Personal & contact details (name, age, address, email, telephone number)	Once you have a booking we need to know the booking is yours and send you relevant information about your booking, like an email or postal confirmation. We need to share some of your details with our suppliers, like a name and email address for your hotel stay.
Payment information	To take payment for any bookings made and to issue any refunds.
Booking information	We may be contractually obliged to share some of your booking information with our partners. Your personal information is not included for this purpose.
Contact history (what you have said to us)	To provide you with customer service and any support and information you may need.

Legitimate interests: we may use and process some of your personal information where we have sensible and legitimate business grounds for doing so.

Personal & contact details (name, age, address, email, telephone number)	To detect and prevent fraud against you or us. Customer research. We use online tools to help us learn more about you so we can tailor our ads. One example is Facebook audience, which helps us learn about our customers' interests and online behaviours. We ask for your reviews on our customer experience and our products so we can improve them. We may use a third party tool to do this. If you are a customer who has booked with us before we will share similar products with you unless you have told us not to. If you leave our payment page we may email you to help you to pick up where you left off. To help you manage your personal information, bookings and make paying easier we may create an online account for you. We may disclose your name, email address and telephone number to Merlin Entertainments if you are enquiring about visiting for the day & Theme Park only enquiries which Holiday Extras Limited are unable to deal with.
Online information (IP address and device)	To detect and prevent fraud against you or us. To improve our website. To support with customer enquiries. To protect our sites.
Payment information	To take payment for any bookings made and to issue any refunds. We will keep your payment details in a tokenised form. This is secure and means we do not store your card details in a way that can be reused.
Booking information	To detect and prevent fraud against you or us. We often analyse our historical booking data to learn what products our customers like best.
Contact history (what you have said to us)	We record our communications with our customers and use them to allow us and our partners to improve our customer experience. One example is listening back to telephone recordings for training purposes. We may share these recordings with our partners to help improve guest experience.

When we have your consent

Personal & contact details (name, address, email, telephone number, age)

To contact you with information by telephone, email, SMS or post about our products, services and special offers. To sign you up to any of our competitions or surveys. To keep you updated about our products, services and special offers on social media. We use Facebook, Twitter and other social media channels. To invite you along to customer research days where we learn about how you interact with our products. We may share your details with Merlin Entertainments PLC for the purposes of postal, email and display advertising of products similar to your original booking.

Contact history (what you have said to us)

To sign you up to any of our competitions or surveys. To keep you updated on social media, we use Facebook, and Twitter and other social media channels.

We need to comply with a legal requirement or regulation

Personal & contact details (name, address, email, telephone number, age)	To detect and prevent fraud against you or us. To defend any legal claims.
Payment information	To detect and prevent fraud against you or us.
Booking information	To defend any legal claims.

We do not knowingly collect any personal information from children under the age of 16. If you are aged under 16 please ask your parent or guardian's permission before you provide any personal information to us.

As part of processing of your personal data, the following decision(s) may be made automatically:

For fraud detection and prevention our systems might automatically decide that you pose a fraud or money laundering risk or if our processing reveals your behaviour to be consistent with that of known fraudsters or money launderers; or is inconsistent with your previous submissions; or you appear to have, on purpose, hidden your true identity. You have rights in relation to automated decision making: if you want to know more please contact us.

First things first; we do not nor plan to ever sell your personal information. We only use and share personal information for the reasons it was originally collected, and for reasons which are directly related to one of our products or services.

We will share your personal data with our partners in order to provide you with the products you have booked with us. For example, we will share your name and booking details with a hotel. We only share what is necessary.

We may share your information with third party service providers who provide services or functions on our behalf. For example, credit card processing, customer service, business analytics, fraud prevention, advertising and to serve you with advertising that is tailored to your interests. But don't worry, these third party service providers are required to protect your personal information in the same way as we do and are not allowed to share or use information for their own purposes.

We may also share your information in the following situations:

• Where you have specifically asked or agreed for us to do so
• Where we have your permission to share your email address with partners we work with for marketing
• If it is required in order to respond to your request
• If it is required by law or regulation

We work with selected partners who use our websites to service bookings. You may find you were directed to our websites from one of these partners, for example a theme park. In these situations we may share booking information with that partner. Often with these partnerships where you are directed from one website to another there are two privacy policies. We make ours visible throughout your booking journey so it is easy to know when we are collecting any of your personal data.

We will share your information for limited reasons; for example we may use a service provider to send you a text message or email about your booking, we will share your contact details, but only to facilitate communications to which you have consented.

We work closely with Merlin Entertainments and process personal information on their behalf. When you make a booking with us you will be a customer of Merlin and Holiday Extras. We both have our own Privacy Policy, ours you are reading right now and Merlins privacy policies are available below.

Merlin Entertainments	https://www.merlinentertainments.biz/privacy-policy
Alton Towers	https://www.altontowers.com/privacy-policy/
Chessington World of Adventures	https://www.chessington.com/misc/privacy.aspx
LEGOLAND Windsor	https://www.legoland.co.uk/about-us/privacy-policy/
THORPE PARK	https://www.thorpepark.com/privacy-policy
Warwick Castle	https://www.warwick-castle.com/misc/privacy.aspx

We will take the necessary measures to protect your personal information against unauthorised or unlawful processing and against accidental loss, destruction or damage. When you provide your personal information through our website, it is transmitted across the internet securely using high-grade encryption.

We have high security standards in order to protect your payment card details and are a "PCI DSS" (The Payment Card Industry Data Security Standard) approved organisation.

If we need to disclose your personal information to other businesses, we require that business to have appropriate measures in place to protect your personal information.

Your personal information will be held in our systems, located on our premises or those of an appointed third party. We may also allow access to your information by other third parties who act for us for the purposes described in this Policy or for other purposes approved by you.

We'll hold on to your information for as long as you have your account if you have one. We will need to store your information if you have an upcoming booking as we need be able to provide the services to you and support you with any enquiries if you contact our customer team.

In most cases, we will keep your personal information for seven (7) years following your last trip unless we are required to keep it for longer due to business, legal or regulatory requirements.

If, having registered for any of our services, you do not use them for a time we may contact you to check you're still happy to receive communications from us or remove your personal information.

Even if we delete your personal information it may persist on backup or archival media for legal, tax or regulatory purposes.

Our website uses cookies to distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our website and also allows us to improve our site. For more information on how Holiday Extras use cookies please read our Cookie Policy.

Your personal data rights

You are entitled to see the personal information we hold about you. We will provide this information free of charge but we may charge a fee to cover our costs if the request is extensive.

Please email customercare@holidayextras.com with the subject 'My data request' including the following required information:

• Your full name; a description of the information that you are requesting (such as parking booking), including a date range; all of your email addresses (past and present) used to book with Holiday Extras; and
• Attach to the email a copy of a current photo ID (e.g. passport photo page).

From the date that we receive all of the required information, we aim to complete your request within one month. We will try to do it quicker but we cannot guarantee that this will be the case.

Correction rights

You are entitled to correct personal information we hold about you that is inaccurate. Please contact us if you would like to update your details.

Deletion rights/right to be forgotten

In certain circumstances you are entitled to ask us to delete the personal information we hold about you.

If you want us to delete your data, please read our FAQs or contact us.

Portability rights

In certain circumstances you are entitled to request that we move, copy or transfer your personal information.

Objection and restriction rights

In certain circumstances you are entitled to object to or restrict Holiday Extras processing your personal information.

You can update your communication preference when you make a booking and can unsubscribe at any time via the unsubscribe links at the bottom of all marketing emails.

To make enquiries or exercise any of your rights please contact our Customer team, details found in the contact section below.

You can also contact Information Commissioner's Office (ICO) which is responsible for making sure that organisations comply with the law on handling personal information.

We process personal data in connection with this Privacy Policy on behalf of Merlin Entertainments. For the purpose of the the UK Data Protection Legislation and (for so long as and to the extent that the law of the European Union has legal effect in the UK) General Data Protection Regulation ((EU) 2016/679), Holiday Extras is considered to be the data processor and Merlin Entertainments is considered to be the data controller.

If you have any questions or comments about our Privacy Policy, or wish to contact us to exercise any of your rights please contact:

Customer Experience
Holiday Extras
Ashford Road
Newingreen
Hythe
Kent
CT21 4JF

or customercare@holidayextras.com

This Privacy Policy shall be governed and construed in all respects in accordance with the laws of England and Wales.

We may change this page from time to time, to reflect how we are processing your information. We only use your personal information for the purposes listed. If we need to use it for something else, we'll let you know.

Any changes we may make to our Privacy Policy in the future will be posted on this page.

v2.0 Last updated November 2021.