Privacy Policy

Introduction

This is the Privacy Policy of Intelligent Index Marketing Limited, a company registered in the United Kingdom, registered number 12570813 and whose registered office is at The Limes, Bayshill Road, Cheltenham, GL50 3AW (“IIM”, “Company”, “we”, “us” and “ours”). These terms apply to both our company and website “heyholiday.com”.

Table of Contents

1. What information we collect

2. Special Category Data

3. How we process your information

4. What legal bases do we rely on to process your personal information?

5. Who we share your personal information with

6. Keeping your information safe

7. How long we need to keep your information

8. Our policy on minors

9. International transfers

10. Your privacy rights

11. Do not track

12. Updating this policy

1. What information we collect

1.1 We have set out the general categories of personal data that we collect. We collect personal data directly from you when you use our Services and automatically through your use of our website and/or App. We may also receive certain usage and technical data via service providers that act on our behalf, such as analytics and infrastructure providers. We do not purchase personal data from third parties.

1.2 We may process data enabling us to get in contact with you ("contact data"). This contact data may include your name, email address, telephone number and postal address, it will also include any data that you supply in your video and/or message. If you use our services, you may also be provided with log in details and passwords by us, which will also be collected and retained by us. The contact data is provided by you. If you use our services, it is necessary for us to carry out the services we provide.

1.3 Where we provide your personal data to travel agents by forwarding your enquiry, message or video, you explicitly consent to the use of that data for the purpose of providing travel-related services to you. We and the relevant travel agents will retain such data only for as long as necessary to provide those services and to comply with applicable legal and regulatory obligations.

1.4 We may process information contained in or relating to any communication that you send to us or that we send to you ("communication data”) in the form of any registration or the video and/or message you send. The communication data may include the communication content and metadata associated with the communication. We will generate the metadata associated with communications made using the services.

1.5 We may process data about your use of the Services (“usage data”). The usage data may include your IP address, approximate geographical location, browser type and version, operating system, referral source, device information, and information about the timing, frequency and pattern of your service use. This data may be collected through analytics tools and cookies provided by third-party service providers, such as Google Analytics.

1.6 Please do not supply any other person's personal data to us, the data you supply must only be your own.

1.7 We may not retain all of the information above depending on what services you use and your interaction with them.

1.8 Application Data - If you use our Services, we also may collect the following information if you choose to provide us with access or permission:

1.8.1 Geolocation Information - Track Location based information from your mobile device, either continuously or while you are using our mobile application(s), to provide certain location-based services.

1.8.2 Mobile Device Data - we automatically collect device information (such as your mobile device ID, model, and manufacturer), operating system, version information and system configuration information, device and application identification numbers, browser type and version, hardware model internet service provider and/or mobile carrier, and Internet Protocol (IP) address (or proxy server). If you are using our App/website we may also collect information about the phone network associated with your mobile device, your mobile device’s operating system or platform, the type of mobile device you use, your mobile device’s unique device ID, and information about the features of our App you accessed.

1.9 If you wish to change our access or permissions, you may do so in your device's settings

1.10 No data is knowingly collected from any person under the age of 18.

2. Special Category Data

2.1 Special Category Data - is information about race, religion, ethnic origin, political opinion, religious or philosophical beliefs, trade union membership, genetic data, biometric data or health data.

2.2 We do not intentionally collect Special Category Data. If you voluntarily include Special Category Data within a message, video or other content you submit through the Services, you explicitly consent to our processing of that information solely for the purpose of providing the Services requested by you.

3. How we process your information

3.1 We will take appropriate technical and organisational precautions to secure your personal data and to prevent the loss, misuse or alteration of your personal data.

3.2 We will store your personal data on secure servers, personal computers and mobile devices, and in secure manual record-keeping systems.

3.3 Any data relating to your enquiries that is sent from your mobile browser to our server, or from our server to your mobile browser, will be protected using encryption technology.

3.4 You acknowledge that the transmission of unencrypted or inadequately encrypted data over the internet is inherently insecure, and we cannot guarantee the security of data sent over the internet.

3.5 You should ensure that any password and any login details (if any) are not susceptible to being guessed, whether by a person or a computer program. You are responsible for keeping the password you use for accessing our services secure and we will not ask you for your password (if any).

3.6 We process your information to provide, improve, and administer the services we provide and supply to you;

3.6.1 for security and fraud prevention, to communicate with you and to comply with the law.

3.7 We may also process your information for other purposes only with your specific consent:

3.7.1 To provide you with a personal account and the necessary authentication and otherwise manage user accounts;

3.7.2 We may process your information so you can create and log in to your account, (if any) as well as keep your account in working order and update your account when used;

3.7.3 To ensure proper delivery of services to you and to process your information to provide you with the requested service;

3.7.4 To respond to your enquiries and to support you whilst using our services;

3.7.5 We may process your information to respond to enquiries and solve any potential issues you might have with the requested service;

3.7.6 To send information to you in respect of the services;

3.7.7 We may process your information to send you details about changes or updates to our services, changes to our terms and policies, and other such information; and

3.7.8 To save or protect an individual's or company’s vital interest to prevent harm.

4. What legal bases do we rely on to process your personal information?

4.1 Operations - We may process your personal data for the purposes of operating our Services, the processing and fulfilment of our Services, and providing additional services. The legal basis for this processing is the performance of a contract between you and us and/or taking steps, at your request, to enter into such a contract.

4.2 Relationships and communications - We may process personal data for the purposes of managing our business relationships, communicating with you by email, providing support services and complaint handling. The legal basis for this processing is our legitimate interests, namely communications with our Service users and the maintenance of our relationships, enabling the use of our Services and the proper administration of our business.

4.3 Personalisation - We may process account data, service data and/or usage data for the purposes of personalising the Services to ensure that you only see material that is relevant to you. The legal basis for this processing is the performance of a contract between you and us and/or taking steps, at your request, to enter into such a contract.

4.4 We may process your personal data for the purposes of sending you marketing communications about our Services where you have provided your consent or where otherwise permitted by applicable law. This may include email, SMS or push notifications. You may withdraw your consent or opt out of marketing communications at any time by following the unsubscribe instructions provided in the communication or by contacting us at data.protection@heyholiday.com.

Where you have separately consented, we may share limited contact data with selected third parties so that they may send you marketing communications about products or services that may be relevant to you. You may withdraw this consent at any time.

4.5 We may process usage data, service data and/or transaction data for the purposes of researching and analysing the use of our Services, as well as researching and analysing other interactions with our business. The legal basis for this processing is our legitimate interests, namely monitoring, supporting, improving and securing our Services and business generally. Where possible, this data is aggregated and/or pseudonymised and used for statistical and analytical purposes only.

4.6 Record keeping - We may process your personal data for the purposes of creating and maintaining our databases, back-up copies of our databases and our business records generally. The legal basis for this processing is our legitimate interests, namely ensuring that we have access to all the information we need to properly and efficiently run our business in accordance with this policy and any legal requirements we are obligated to.

4.7 Security - We may process your personal data for the purposes of security and the prevention of fraud and other criminal activity. The legal basis of this processing is our legitimate interests, namely the protection of our App/website, services and business, and the protection of others.

4.8 Insurance and risk management - We may process your personal data where necessary for the purposes of obtaining or maintaining insurance coverage, managing risks and/or obtaining professional advice. The legal basis for this processing is our legitimate interests, namely the proper protection of our business against risks.

4.9 Legal claims - We may process Your personal data where necessary for the establishment, exercise or defense of legal claims, whether in court proceedings or in an administrative or out-of-court procedure. The legal basis for this process is our legitimate interests, namely the protection and assertion of our legal rights, Your legal rights and the legal rights of others.

4.10 Legal compliance and vital interests - We may also process your personal data where such processing is necessary for compliance with a legal obligation to which we are subject or in order to protect your vital interests or the vital interests of another natural person.

4.10.1 if we are unable to obtain permission but believe it is in the interest of the individual that we collect and retain certain information, we will do so in the following circumstances:

4.10.1.1 If collection is clearly in the interests of an individual and consent cannot be obtained in a timely way;

4.10.1.2 For investigations and fraud detection and prevention

4.10.1.3 For business transactions provided certain conditions are met;

4.10.1.4 If it is contained in a witness statement and the collection is necessary to assess, process, or settle an insurance claim;

4.10.1.5 For identifying injured, ill, or deceased persons and communicating with next of kin;

4.10.1.6 If we have reasonable grounds to believe an individual has been, is, or may be victim of financial abuse;

4.10.1.7 If disclosure is required to comply with a subpoena, warrant, court order, or rules of the court relating to the services;

4.11 All processing of Information is done in line with the UK GDPR and the Data Protection Act 2018, and where applicable, COPPA (Children’s Online Privacy Protection Act) and the California Consumer Privacy Act (CCPA).

Purpose/Activity: To register You as a new service user

Type of data: (a) Identity (b) Contact

Lawful basis for processing including basis of legitimate interest: Performance of a contract

Purpose/Activity: To process your account details including: (a) manage any payments, fees and charges; (b) Collect and recover money owed to us

Type of data: (a) Identity (b) Contact (c) Transaction (d) Marketing and Communications

Lawful basis for processing including basis of legitimate interest: Performance of a contract with you and necessary for our legitimate interest (to recover debts due to us)

Purpose/Activity: To manage Our relationship with You which will include: (a) Notifying You about changes to Our terms or Privacy policy (b) Asking you to leave a review or take a survey (c) agree to our modes of communication with You (d) To send users marketing information and offers from third parties where the user has explicitly consented

Type of data: (a) Identity (b) Contact (c) Profile (d) Marketing and Communications

Lawful basis for processing including basis of legitimate interest: (a) Performance of a contract with You (b) Necessary to comply with a legal obligation (c) Necessary for Our legitimate interests (to keep Our records updated and to study how customers use Our Products/Services)

Purpose/Activity: To enable You to partake in a prize draw, competition or complete a survey

Type of data: (a) Identity (b) Contact (c) Profile (d) Usage (e) Marketing and Communications

Lawful basis for processing including basis of legitimate interest: (a) Performance of a contract with You (b) Necessary for Our legitimate interests (to study how customers use Our Products/Services, to develop them and grow Our business)

Purpose/Activity: To administer and protect Our business and this Website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)

Type of data: (a) Identity (b) Contact (c) Technical

Lawful basis for processing including basis of legitimate interest: (a) Necessary for Our legitimate interests (for running Our business, provision of administration and IT Services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise) (b) Necessary to comply with a legal obligation

Purpose/Activity: To deliver relevant App/website content to You and measure or understand the effectiveness of the content We serve to You

Type of data: (a) Identity (b) Contact (c) Profile (d) Usage (e) Marketing and Communications (f) Technical

Lawful basis for processing including basis of legitimate interest: Necessary for Our legitimate interests (to study how customer, buyers and/or vendors use Our products/services, to develop them, to grow Our business and to inform Our marketing strategy)

Purpose/Activity: To use data analytics to improve Our Website, Services, marketing, customer relationships and experiences

Type of data: (a) Technical (b) Usage

Lawful basis for processing including basis of legitimate interest: Necessary for Our legitimate interests (to define types of customers for Our products and services, to keep our App/Website updated and relevant, to develop Our business and to inform You of Our marketing strategy)

Purpose/Activity: To make suggestions and recommendations to You about services that may be of interest to You

Type of data: (a) Identity (b) Contact (c) Technical (d) Usage (e) Profile (f) Marketing and Communications

Lawful basis for processing including basis of legitimate interest: Necessary for Our legitimate interests (to develop our Products/Services and grow Our business)

5. Who we share your personal information with

5.1 Third-party service providers that we may need to share such information with to enable them to perform the services we require of them. We ensure that these third parties cannot use or supply your personal information unless we have given them permissions to do so. They will also not share your personal information with any other organisation apart from us. They also commit to protect the data they hold on our behalf and to retain it for the period we instruct. The categories of third parties we may share personal information with are as follows:

5.1.1 Travel agents and travel service providers to whom we forward your enquiry, message or video in order to obtain holiday options, quotes or related travel services on your behalf. These third parties will act as independent data controllers in respect of the personal data they receive and will process your data in accordance with their own privacy policies.

5.1.2 Data Analytics Services;

5.1.3 Sales & Marketing Tools;

5.2 We also may need to share your personal information in the following situations:

5.2.1 Business Transfers - We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company;

5.2.2 Affiliates - We may share your information with our affiliates, in which case they are legally required to abide by this privacy notice. Affiliates include any parent company and any subsidiaries, joint venture partners, or other companies that we control or that are under common control with us;

5.2.3 Selected third-party suppliers of products and/or services, where you have explicitly consented to your personal data being shared for the purpose of them contacting you with relevant offers or marketing communications. Each such third party will act as a data controller in relation to the personal data we supply to it and will provide you with its own privacy policy upon contact. You may withdraw your consent at any time by contacting us at data.protection@heyholiday.com.

5.2.4 Insurers and/or professional advisers insofar as reasonably necessary for the purposes of obtaining or maintaining insurance coverage, managing risks, obtaining professional advice.

5.3 Our database will be stored on the servers of our hosting services.

5.4 In addition to the specific disclosures of personal data, we may disclose your personal data where such disclosure is necessary for compliance with a legal obligation to which we are subject, or in order to protect your vital interests or the vital interests of another natural person. We may also disclose Your personal data where such disclosure is necessary for the establishment, exercise, or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure.

6. Keeping your information safe

6.1 We will take appropriate technical and organisational precautions to secure your personal data and to prevent the loss, misuse or alteration of your personal data.

6.2 We will store your personal data on secure servers, personal computers and mobile devices, and in secure manual record-keeping systems.

6.3 Data relating to your enquiries and financial transactions (not including your stored receipts) that is sent from your browser to our server, or from our server to your web browser, will be protected using encryption technology.

6.4 You acknowledge that the transmission of unencrypted or inadequately encrypted data over the internet is inherently insecure, and we cannot guarantee the security of data sent over the internet.

6.5 You should ensure that any authentication details, password and any login details are not susceptible to being guessed, whether by a person or a computer program. You are responsible for keeping the password you use for accessing our App confidential and we will never ask you for your password (if any) (except when you log in to our App/website).

7. How long we need to keep your information

7.1 We will retain your personal data only for as long as is necessary for the purposes for which it was collected, including the provision of Services, compliance with legal obligations, resolution of disputes, and enforcement of our agreements.

7.2 Account and enquiry data will generally be retained for the duration of your account or active relationship with us and for a reasonable period thereafter.

7.3 Marketing data will be retained until you withdraw your consent or opt out of receiving marketing communications.

7.4 Transaction and financial records will be retained for as long as required to comply with our accounting and tax obligations.

7.5 Where we are required to retain personal data for longer periods due to legal or regulatory requirements, we will do so in accordance with applicable law.

7.6 Where feasible, we will anonymise or pseudonymise personal data when retained for statistical or analytical purposes.

8. Our policy on minors

8.0 We do not knowingly collect or process personal data from children.

8.1 Our Services are intended for individuals aged eighteen (18) or over.

8.2 We do not knowingly collect or process personal data from anyone under the age of 18.

8.3 If we become aware that personal data from a person under the age of 18 has been collected without appropriate authorisation, we will take reasonable steps to delete such data as soon as possible.

9. International transfers of your personal data

9.1 Your personal data is primarily stored and processed in the United Kingdom.

9.2 Some of our service providers may process personal data outside the UK, including in the European Economic Area (EEA) and the United States.

9.3 Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, including the use of UK-approved international data transfer agreements, standard contractual clauses, or adequacy decisions where applicable.

10. Your rights

10.1 We have summarised the rights that you have under UK Data Protection Law (Data Protection Act 2018) and other laws in other jurisdictions where relevant.

10.2 Further information can be found at https://ico.org.uk, if you are in Europe contact https://EC.europa.eu/info/law/law-topic/data-protection/data-protection-eu_en and for the US contact The Federal Trade Commission at https://ftc.gov

10.3 Your principal rights under data protection law are:

(a) the right to access - You can ask for copies of Your personal data;
(b) the right to rectification - You can ask Us to rectify inaccurate personal data and to complete or incomplete personal data;
(c) the right to erasure - You can ask Us to erase Your personal data;
(d) the right to restrict processing - You can ask Us to restrict the processing of Your personal data;
(e) the right to object to processing - You can object to the processing of Your personal data;
(f) the right to data portability - You can ask that We transfer Your personal data to another organisation or to You;
(g) the right to complain to a supervisory authority - You can complain about Our processing of Your personal data; and
(h) the right to withdraw consent - to the extent that the legal basis of Our processing of Your personal data is consent, You can withdraw that consent.

10.4 You have the right to confirm as to whether or not we process your personal data and, where we do, access to the personal data, together with certain additional information. That additional information includes details of the purposes of the processing, the categories of personal data concerned and the recipients of the personal data. Providing the rights and freedoms of others are not affected, we will supply you with a copy of our personal data. The first copy will be provided free of charge, but additional copies may be subject to a reasonable fee.

10.5 You have the right to have any inaccurate personal data about you rectified and, taking into account the purposes of the processing, to have any incomplete personal data about you completed.

10.6 In some circumstances you have the right to the erasure of your personal data without undue delay. Those circumstances include: the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; you withdraw consent to consent-based processing; you object to the processing under certain rules of applicable data protection law; the processing is for direct marketing purposes; and the personal data have been unlawfully processed. However, there are exclusions of the right to erasure. The general exclusions include where processing is necessary: for exercising the right of freedom of expression and information; for compliance with a legal obligation; or for the establishment, exercise or defence of legal claims.

10.7 In some circumstances You have the right to restrict the processing of your personal data. Those circumstances are: you contest the accuracy of the personal data; processing is unlawful but you oppose erasure; We no longer need the personal data for the purposes of our processing, but you require personal data for the establishment, exercise or defence of legal claims; and You have objected to processing, pending the verification of your objection. Where processing has been restricted on this basis, We may continue to store your personal data. However, we will only otherwise process it: with your consent; for the establishment, exercise or defence of legal claims; for the protection of the rights of another natural or legal person; or for reasons of important public interest.

10.8 You have the right to object to our processing of your personal data on grounds relating to your particular situation, but only to the extent that the legal basis for the processing is that the processing is necessary for: the performance of a task carried out in the public interest or in the exercise of any official authority vested in Us; or the purposes of the legitimate interests pursued by us or by a third party. If you make such an objection, we will cease to process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is for the establishment, exercise or defence of legal claims.

10.9 You have the right to object to our processing of Your personal data for direct marketing purposes (including profiling for direct marketing purposes). If you make such an objection, we will cease to process your personal data for this purpose.

10.10 You have the right to object to our processing of your personal data for scientific or historical research purposes or statistical purposes on grounds relating to your particular situation, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

10.11 To the extent that the legal basis for our processing of your personal data is:

(a) consent; or
(b) that the processing is necessary for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract, and such processing is carried out by automated means, you have the right to receive your personal data from us in a structured, commonly used and machine-readable format. However, this right does not apply where it would adversely affect the rights and freedoms of others.

10.12 If you consider that our processing of your personal data infringes data protection laws, you have a legal right to lodge a complaint with a supervisory authority responsible for data protection. In relation to complaints under EU data protection law, you may do so in the EU member state of your habitual residence, your place of work or the place of the alleged infringement; in relation to complaints under UK data protection law, you should do so in the UK. In the US you should make a complaint to your state regulator.

10.13 To the extent that the legal basis for our processing of your personal data is consent, you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing before the withdrawal.

10.14 California Civil Code Section 1798.83, also known as the 'Shine The Light' law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us using the contact information provided.

10.15 You may exercise any of your rights in relation to your personal data by emailing the company information email address here and making a Data Subject Request. Such a request must only be in respect of your own data.

11. Do not track

11.1 Intelligent Index Marketing Limited does not support “Do Not Track” requests. Whether or not any of the third-party services uses “Do Not Track” requests you must read their privacy policies.

11.2 You can check on your browser and set your options to Do Not Track independently of our App/website should you wish to do so.

12. About our cookies

12.1 A cookie is a file containing an identifier (a string of letters and numbers) that is sent by a web server to a web browser and is stored by the browser. The identifier is then sent back to the server each time the browser requests a page from the server.

12.2 Cookies may be either "persistent" cookies or "session" cookies: a persistent cookie will be stored by a web browser and will remain valid until its set expiry date, unless deleted by the user before the expiry date; a session cookie, on the other hand, will expire at the end of the user session, when the web browser is closed.

12.3 Cookies may not contain any information that personally identifies a user, but personal data that We store about You may be linked to the information stored in and obtained from cookies.

13. Cookies that we and our service providers use

13.1 We and Our service providers use cookies and those cookies may be stored on Your computer when You visit our website and/or App.

13.2 We use Google Analytics. Google Analytics gathers information about the use of Our Website and/or App by means of cookies. The information gathered is used to create reports about the use of Our website and/or App. You can find out more about Google's use of information by visiting https://www.google.com/policies/privacy/partners/ and you can review Google's privacy policy at https://policies.google.com/privacy.

14. Managing Cookies

14.1 Most browsers allow You to refuse to accept cookies and to delete cookies. The methods for doing so vary from browser to browser, and from version to version. You can however obtain up-to-date information about blocking and deleting cookies via these links:

14.2 Blocking all cookies will have a negative impact upon the usability of many websites.

14.3 If You block cookies, You will not be able to use all the features or some services on Our website and/or App.

15. Updating this Policy

15.1 We may update this policy from time to time to ensure we continue to be in compliance with the appropriate laws and regulation or if we offer additional services on our app/website which would require this policy to be updated.

15.2 Please see at the bottom of this document the “Last Updated Date”

15.3 We recommend that you read this policy from time to time to ensure you understand how we deal with your Personal Data.

You can contact Us:

(a) by telephone here
(b) by email here

last updated 4-Jan-2026