Privacy policy
Secret of Eden is a small, family-run business letting three self-catering holiday homes at The Bay, Filey. We only collect what we need to look after your booking and stay, we never sell your data, and you can ask us about it at any time.
Last updated: 10 October 2026
Who we are
The data controller is Tom Watson trading as Secret of Eden, 79 Jubilee Way, Leicester, LE8 5UB. Registered with the Information Commissioner's Office (ICO): registration number ZB918614.
Contact us about anything in this policy at hello@secretofeden.co.uk or 07595 035100. We are not required to appoint a Data Protection Officer.
What we collect
- Booking details: your name, email address, the home, dates, number of guests and dogs, any notes or early check-in / late checkout requests, and the payment plan you chose.
- Payment details: handled by Stripe. We never see or store your full card number; we see the card type, last four digits, expiry and payment status.
- Messages: emails, phone calls and WhatsApp messages you send us.
- Newsletter: your email address, if you sign up.
- Technical data: like any website, our hosting provider receives your IP address and browser details when you visit, for security and to deliver the pages. We don't use advertising or analytics cookies.
How we use it, and why (lawful basis)
- To take and manage your booking — confirming it, taking payment (in full, or a deposit and the balance 28 days before arrival), the refundable damage-deposit card hold, sending arrival details and answering your questions. Lawful basis: contract.
- Keeping financial records for tax and accounting. Lawful basis: legal obligation.
- Protecting our homes and preventing fraud or double bookings, including deciding on damage-deposit claims, and a short thank-you email after your stay with a link to leave a review and a discount code for a future stay. Lawful basis: legitimate interests — you can ask us to stop these emails at any time.
- Our newsletter (local events, offers, free dates). Lawful basis: consent — withdraw it any time with the unsubscribe link.
Who we share it with
We use a few trusted service providers who process data on our behalf and only as we instruct:
- Stripe (payments, saved card for the balance and the damage-deposit hold). Stripe is also an independent controller for fraud prevention and its legal duties — see stripe.com/gb/privacy.
- Resend sends our booking emails (confirmations, payment reminders, arrival details) — see Resend's privacy policy.
- Netlify hosts this website and runs the small programs behind booking and payments — see Netlify's privacy policy.
- Google Fonts supplies the fonts on this site, so your browser connects to Google, which receives your IP address — see Google's privacy policy.
- Airbnb and Booking.com — calendar sharing (iCal). To prevent double bookings, our booking calendar is shared with Airbnb and Booking.com through private calendar links. For website bookings we share only the dates a home is booked — never your name, email or any other details. We also import their calendars and use only the booked dates from them.
- WhatsApp, if you choose to message us there (see below).
- Our housekeeping team, only the dates and arrival details they need to prepare the home.
- Our accountant, HMRC or other authorities where the law requires it.
If you message us on WhatsApp (the green chat button, which opens WhatsApp with our number 07595 035100), WhatsApp (WhatsApp Ireland Ltd / Meta) processes your number and messages under its own privacy policy, and the chat is stored on Tom's phone. Please don't send card details or other sensitive information on WhatsApp.
Some of these providers (for example Stripe, Netlify, Resend, Google and Meta) are based in, or use servers in, the USA or elsewhere outside the UK. Where that happens, the transfer is protected by the UK's adequacy regulations (including the UK–US data bridge) or the UK International Data Transfer Agreement / Addendum.
How long we keep it
- Booking and payment records: 6 years after the end of the tax year of your stay (HMRC requirements), then deleted.
- Emails and WhatsApp messages: up to 2 years after your stay, unless needed for an open issue such as a damage-deposit claim or complaint.
- Newsletter: until you unsubscribe; we then keep only what's needed to make sure you aren't emailed again.
- Calendar entries shared with Airbnb / Booking.com: dates only, and they drop off after your stay.
- Website logs: kept by Netlify for a short period under its own retention rules.
Your rights
Under UK data protection law you can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable format; where we rely on consent you can withdraw it at any time. Email hello@secretofeden.co.uk — we'll reply within one month. There's normally no charge.
If you're unhappy with how we've handled your data, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.
Cookies
This website doesn't set advertising or analytics cookies. When you pay, Stripe's secure checkout page may use strictly necessary cookies for security and fraud prevention.
Changes
We'll update this page if anything changes; the date at the top shows the latest version.