Privacy Policy

Home 9 Privacy Policy

Devon Holidays Privacy Policy

Last updated: 22 October 2026

Your privacy matters to us. This policy explains what personal information we collect, why we use it, who we share it with and the choices and rights you have.

It covers enquiries, accommodation bookings, booking extras, guest registration, hot-tub safety forms, communications and use of our website.

1. Who we are

Reliance Retreats Limited, trading as Devon Holidays, is responsible for the personal information we use for the purposes described in this policy. In data-protection law, this means we are the “data controller”.

Company number: 13517188
Registered office: Layfield House, Lay Field, Hook, England, RG27 9TD

For privacy enquiries, requests or complaints, please contact:

Email: bookings@devonholidays.co.uk
Telephone: 01626 817333
WhatsApp: https://wa.me/441626817333
Post: Privacy Enquiries, Reliance Retreats Limited, at our registered office above.

Please mark your message “Privacy enquiry”.

You may receive communications using the Devon Holidays, Reliance Retreats or Reliance Managed Services name. Where those communications concern the processing described here, Reliance Retreats Limited remains the responsible company unless we clearly explain otherwise.

2. Information we collect

Depending on your enquiry, booking and interaction with us, we may collect:

Your name, address, email address and telephone number.
Booking references, lodge details, stay dates, prices, extras and payment or refund records.
The names of people staying, including children, and any age information reasonably needed for occupancy, eligibility or safety arrangements.
Hot-tub safety acknowledgements, the name or signature of the adult completing them, and details of children covered by an adult’s acknowledgement.
Messages you send through email, telephone enquiries, WhatsApp, booking platforms, website forms or the Guesty guest app.
Requests, preferences and information needed to arrange your stay.
Complaints, incident reports and supporting photographs, videos or correspondence.
Marketing preferences and records of consent or opt-out requests.
Technical information associated with website use, such as IP addresses, device and browser information, security logs and cookie preferences.

Our housekeeping team digitally records lodge condition before arrivals. If a condition record or damage investigation contains identifiable people, belongings or information linked to a booking, we treat that material as personal information.

Payment providers and booking platforms may collect payment-card information directly under their own arrangements. Please do not send full card details or security codes by email, WhatsApp or ordinary guest messages.

3. Where information comes from

We receive information:

Directly from you when you enquire, book, complete a form or communicate with us.
From the lead guest or another authorised person arranging your stay.
Through booking platforms, including Airbnb, Booking.com and Sykes Cottages.
Through Guesty, Google Forms and other providers supporting our booking and guest services.
From the resort, lodge owners, housekeeping or maintenance teams where relevant to your stay, safety or an incident.
From payment providers concerning transactions, refunds or payment disputes.
Through your use of our website.

If you provide information about other guests, please give them access to this policy and ensure you are entitled to provide their details. We will also make privacy information available through our guest-registration and booking arrangements.

4. Why we use information and our lawful grounds

We use personal information only where we have an appropriate lawful basis.

Purpose	Lawful basis
Responding to enquiries and arranging a booking you request	Taking steps at your request before entering a contract; legitimate interests in responding to other enquiries
Managing your accommodation contract, extras, payments, refunds and essential booking communications	Performance of our contract with you
Managing accompanying guests’ information and practical stay arrangements	Legitimate interests in administering the booking and providing accommodation to the registered party
Resort registration, occupancy management and safety acknowledgements	Legitimate interests in knowing who is staying, supporting emergency arrangements and managing safe use of facilities
Meeting specific statutory duties, including applicable accounting or safety obligations	Compliance with the relevant legal obligation
Investigating complaints, damage, incidents, fraud or payment disputes	Legitimate interests in resolving problems, protecting guests and property, preventing fraud and establishing or defending legal claims; legal obligations where applicable
Operating and securing our website and business systems	Legitimate interests in providing reliable services and protecting information
Sending promotional messages	Consent, or legitimate interests where the applicable electronic-marketing rules permit an existing-customer exception
Recording and respecting your privacy or marketing choices	Legal obligations and legitimate interests in honouring those choices

Where we rely on legitimate interests, we consider whether the use is necessary and balance those interests against your rights and reasonable expectations, with particular care for children’s information.

A resort requirement or booking condition is not automatically a legal obligation. Where we rely on a statutory duty, that duty must apply to the particular use of information.

5. Guest registration and children’s information

The resort requires the names of everyone staying for health, safety and emergency arrangements. These details must be recorded through Guesty or, if you need assistance, supplied to our team so we can help complete registration.

We use these details to administer your stay, maintain accurate occupancy records and provide relevant registration information to the resort.

Failure to provide necessary registration details may delay check-in or mean an unregistered person cannot be admitted until registration is completed and their stay approved.

We collect children’s information through the adult arranging the stay or responsible for them. We use it only as reasonably necessary for the booking, supervision, safety and related legal responsibilities. We do not use children’s registration details to send them marketing.

6. Hot-tub forms, health information and accessibility requests

We use hot-tub acknowledgements to record who has acknowledged the safety rules, manage permitted use and investigate relevant concerns or incidents.

Agreeing to safety rules is not consent to marketing and does not waive your privacy rights.

You do not need to provide your medical history simply to acknowledge the hot-tub rules. Please avoid including unnecessary medical details in general booking messages or forms.

If we need to use health information—for example, to consider a specific accessibility request or deal with an injury report—we must have both an ordinary lawful basis and an additional legal condition for sensitive information.

Depending on the circumstances, that additional condition may be:

Your explicit consent for a specified purpose, where consent is appropriate and freely given.
Necessity for establishing, exercising or defending legal claims.
Protection of someone’s vital interests in an emergency where they are physically or legally incapable of giving consent.

We will explain any other applicable condition before relying on it where required.

Sharing medical information does not, by itself, amount to explicit consent. Where we rely on consent, we will request it separately and explain how you can withdraw it.

Access to sensitive information is limited to those who reasonably need it for the relevant purpose.

7. Who we share information with

We share information only where reasonably necessary for a stated purpose and supported by an appropriate lawful basis.

Recipients may include:

Guesty, for booking administration, guest registration and communications.
Google, where we use Google Forms and associated services for safety acknowledgements and records.
Booking platforms, including Airbnb, Booking.com and Sykes Cottages, for bookings, enquiries, amendments and disputes handled through them.
The resort operator, for guest registration, occupancy, access, safety and relevant incident management.
Lodge owners, where necessary to manage their property, authorise work or address a relevant complaint or claim.
Housekeeping and maintenance providers, who receive the information necessary to carry out their work.
Payment providers, banks and accounting providers, for transactions, refunds, accounts and disputes.
Website, hosting, communications and IT providers, including WhatsApp where you communicate with us through it.
Marketing-service providers, where used to deliver permitted communications on our behalf.
Insurers, professional advisers, emergency services, regulators or public authorities, where necessary and lawful.

We do not routinely provide complete guest records to everyone involved in a stay. Information shared should be proportionate to the recipient’s role.

Some providers process information on our behalf under our instructions. Others, including booking platforms and resort operators for their own purposes, may act as separate data controllers and have their own privacy notices.

Use of a provider does not remove our responsibility for processing carried out on our behalf.

We do not sell guest personal information.

8. Processing outside the UK

Some technology providers operate internationally. Information may be stored or accessed outside the UK, including through hosting, support services or subprocessors.

Where we make a restricted international transfer, an appropriate legal transfer arrangement must apply. Depending on the destination and provider, this may involve UK adequacy regulations or approved contractual safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, together with any required assessment and supplementary protections.

You can contact us for details of the destinations and safeguards relevant to your information and how to obtain a copy of applicable safeguards, subject to lawful redactions.

Providers acting as independent controllers explain their own international processing in their privacy notices.

9. How long we keep information

We keep identifiable information only for as long as it is needed for the purpose for which it was collected, including applicable legal, accounting, safety and dispute requirements.

We use the following criteria:

Record type	How retention is determined
Enquiries that do not lead to a booking	Until the enquiry and reasonable follow-up are complete, unless an unresolved issue justifies longer retention
Booking, payment and accounting records	For the booking and subsequent accounting, tax, refund and relevant legal-claim periods
Guest registration and accompanying guests’ details	For registration, the stay and any necessary follow-up; details no longer needed are removed rather than retained solely because a financial record must be kept
Hot-tub acknowledgements and relevant safety records	According to the stay, applicable safety-record requirements, insurance requirements and relevant claim periods
Complaints, incidents and damage evidence	Until the matter is resolved and any justified insurance, regulatory or legal-claim retention period has ended
Routine messages and lodge-condition recordings	According to their operational purpose; relevant material may be retained with a complaint or incident record
Health or accessibility information	Only for the specific arrangement or matter requiring it, unless a separate lawful reason requires longer retention
Marketing records	While the relevant permission or lawful basis remains valid and the information remains useful for that purpose
Opt-out records	We may retain limited details to ensure we do not contact you again against your wishes
Website logs and cookie information	According to their security or technical purpose and the durations explained in our cookie information

When setting periods, we consider the sensitivity of the information, whether the purpose has ended, applicable legal deadlines and whether less information would be sufficient.

Relevant records may be retained longer where a particular complaint, investigation or legal claim requires it. We do not retain every record indefinitely because a future claim is theoretically possible.

Information no longer required is deleted or anonymised. Backup copies are removed through the applicable backup-retention cycle and are not used for routine business purposes after deletion from active systems.

10. Booking communications and marketing

We use your contact details for essential service messages, such as booking confirmations, payment reminders, arrival instructions, safety information and responses to your requests. These are separate from promotional marketing.

For promotional email, text or WhatsApp messages to individuals, we will obtain your consent unless a lawful exception applies.

The existing-customer exception may allow messages about our own similar services where we obtained your details directly during a sale or genuine sales enquiry, offered a clear opt-out when collecting them, and provide an easy opt-out in each message.

We do not assume that receiving your details from a booking platform gives us permission to send marketing.

You can stop promotional messages at any time by:

Using the unsubscribe option in an email.
Replying “STOP” to a promotional text or WhatsApp message.
Emailing bookings@devonholidays.co.uk.

You have the right to object to use of your information for direct marketing at any time. We will stop using it for that purpose.

Refusing marketing does not affect your booking or access to included facilities. Where necessary, we will still send essential messages about your stay.

11. Cookies and website information

Our website uses cookies and may use similar technologies to support its operation, remember choices and understand usage.

Where consent is required, it must be obtained before the relevant technology is used. Where a legal exception applies, the technology must meet that exception’s conditions, including any information or opt-out requirements.

Our Cookies Policy and available website preference controls explain the technologies used, their purposes and durations, and how to manage your choices.

Browser settings can provide additional controls, although blocking essential technologies may affect website functionality.

This privacy policy does not itself give consent to cookies or tracking.

12. Keeping information secure

We use appropriate technical and organisational safeguards, taking account of the nature of the information and the risks involved.

These include controlling access, protecting accounts and devices, managing provider access and handling information securely. No internet service can be guaranteed completely secure.

Please keep your booking links and account details private. Do not send unnecessary identity documents, payment-card information or medical details through ordinary messages.

If you believe your booking information has been accessed or disclosed improperly, please contact us promptly. We will assess suspected breaches and make notifications to affected people or the regulator where legally required.

13. Your data-protection rights

Depending on the circumstances and our lawful basis, you may have the right to:

Ask for access to your personal information and a copy of it.
Have inaccurate information corrected or incomplete information completed.
Ask for information to be deleted.
Ask us to restrict how we use information.
Object to processing based on legitimate interests.
Receive certain information in a portable format or have it transferred to another provider where the legal requirements apply.
Withdraw consent where processing is based on consent.
Exercise applicable rights concerning significant decisions made solely by automated means.

These rights are subject to legal conditions and exceptions. For example, we may need to retain information required for accounting or a legal claim even if you request deletion.

Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

To make a request, contact bookings@devonholidays.co.uk or use the other contact details above. You do not need to use legal terminology or a particular form.

We normally respond without undue delay and within one month, subject to any lawful extension or adjustment to the response period. We may request proportionate information to confirm your identity or clarify your request where necessary.

Requests are normally free. If a legal exception permits a fee or refusal, we will explain the reason and your options.

14. Automated processing

Booking systems may send automated confirmations, reminders and service messages. An automated message is not, by itself, a decision with legal or similarly significant effects.

If we introduce solely automated decision-making that has such effects, we will provide the required information about its purpose, operation, consequences and applicable safeguards before using it.

Booking platforms may operate their own automated systems, explained in their privacy notices.

15. Questions and complaints

Please contact us if you have a concern about your information. We will acknowledge your complaint, investigate it and explain the outcome without undue delay.

Email: bookings@devonholidays.co.uk
Telephone: 01626 817333
WhatsApp: https://wa.me/441626817333

You also have the right to complain to the Information Commissioner’s Office, the UK data-protection regulator:

Website: https://ico.org.uk/make-a-complaint/

You do not need our permission to contact the ICO.

16. Other organisations’ websites and services

Our website and communications may link to booking platforms, attractions, resort services and other organisations.

Their own privacy notices explain how they use information for their purposes. Please review those notices when using their services.

We remain responsible for our own processing and for providers processing information on our behalf.

17. Changes to this policy

We review this policy when our services, processing arrangements or legal requirements change. The date at the top identifies the latest version.

Where a change materially affects how we use your information, we will bring it to your attention as required. If a new use requires consent, we will request that consent before proceeding.

An update to this policy does not, by itself, give us permission to use information for an incompatible new purpose.