Privacy Notice — Booking Sites on the Stayant Platform
Version 1.1 · Effective 15 May 2026
Privacy Notice — Booking Sites on the Stayant Platform
At a glance
- This site is operated by Tamill - Holiday Cottages & Lodges on the Stayant platform.
- Tamill - Holiday Cottages & Lodges is the data controller for your booking and the personal data you give them through this site.
- Stayant provides the platform technology and acts as Tamill - Holiday Cottages & Lodges's data processor for that booking data.
- For questions about your booking, refunds, or how Tamill - Holiday Cottages & Lodges uses your data, contact Tamill - Holiday Cottages & Lodges at [email protected].
- This notice covers a narrow slice of platform-level data that Stayant controls — security logs, anti-forgery cookies, and the technical interaction with payment redirects.
- Stayant does not sell your personal data and does not use it for targeted advertising.
1. Who is who
The site you are using is operated by Tamill - Holiday Cottages & Lodges on the Stayant platform. Two organisations are involved when you interact with it, and they have different roles.
Tamill - Holiday Cottages & Lodges is the data controller for your booking. That means they decide what booking data to collect from you, why they collect it, and how long they keep it. They run the property you are booking with or enquiring about, and they handle your stay end-to-end. If you want to access, correct, or delete the personal data they hold about your booking, contact Tamill - Holiday Cottages & Lodges directly at [email protected].
Tech Work Solutions Ltd ("Stayant", "we", "us"), a company registered in England and Wales under company number 15904060 and registered with the UK Information Commissioner's Office under data-protection registration number ZB906233, provides the Stayant platform. For your booking data, Stayant acts as Tamill - Holiday Cottages & Lodges's data processor — we store and move that data on the operator's instructions, but we do not decide what is done with it. For a narrow, well-defined slice of platform-level data (described in §3 below), Stayant is itself a data controller. Our platform privacy contact is [email protected].
This notice describes both halves. Section 2 summarises the data Stayant handles on the operator's behalf so you know what passes through the platform. Section 3 onwards focuses on the platform-level processing that Stayant is responsible for as a controller.
2. What Stayant processes on the operator's behalf
When you use this site, Stayant stores and moves the following categories of data on Tamill - Holiday Cottages & Lodges's behalf and on their instructions. Tamill - Holiday Cottages & Lodges is the controller; the entity names in brackets refer to internal records in the Stayant platform for technical context only.
- Booking form (
Booking) — the name, email address, telephone number, arrival and departure dates, adult and child counts, and any free-text notes you enter when you request or confirm a booking. The operator uses this to manage your stay. - Guest portal check-in form (
GuestCheckIn) — estimated arrival time, identity-document type and number where the operator requires one, vehicle registration, dietary requirements, emergency contact details, and any special requests you provide before arrival. The operator uses this to prepare for your stay and to comply with their own legal obligations (for example, guest registers). - Reviews (
Review) — your rating, the title and body of your review, the display name you choose, and optionally your country. Reviews appear publicly on the operator's site once the operator approves them (see §11). - Messages — emails, SMS and WhatsApp messages, and OTA messages relating to your booking (for example, replies you send to confirmation emails or messages from an Airbnb or Booking.com thread). These are threaded into your booking record so the operator has a single conversation history. Email send and inbound replies are handled through Postmark; SMS and WhatsApp through Twilio where the operator has enabled that integration; OTA messages through Channex where the operator has enabled that integration.
- Payments — to allow the operator to charge balances automatically, Stayant stores the Stripe customer identifier and the payment-method identifier returned by Stripe after you complete a payment on Stripe's hosted checkout page. Full card numbers, expiry dates, and CVV codes never reach Stayant; they are entered on Stripe's own pages and held by Stripe.
This processing is on the operator's instructions. To exercise your rights over this data — access, correction, deletion, objection, or any other right described in §8.1 — contact Tamill - Holiday Cottages & Lodges directly at [email protected].
3. What Stayant processes as its own controller
A small amount of data is generated by the act of visiting this site rather than by the operator's booking workflow. For that data, Stayant is the controller.
- Server logs. Every request to this site is recorded with a timestamp, the requested URL, the response status, your IP address, and your browser's user-agent string. We use these logs to keep the platform secure, to investigate abuse and incidents, and to enforce rate limits against credential-stuffing, scraping, and similar attacks. Server logs are retained for 90 days and then deleted.
- Anti-forgery (CSRF) cookies. When you submit any form on this site, the platform sets a short-lived cookie that proves the request came from a page we served you and not from a malicious third-party site. The cookie holds no personal information about you beyond a random token tied to your current session.
- Payment-redirect interaction. When you click through to pay, you are taken to Stripe's hosted checkout page on a Stripe domain. Stripe sets its own cookies and processes your card and billing data under Stripe's own privacy notice and terms, as the controller for that payment step. Once you return to this site, Stayant only receives the Stripe customer and payment-method identifiers described in §2; we do not receive your card number, expiry, or CVV.
4. Lawful basis
Under UK GDPR Article 6 (and the equivalent provisions of EU GDPR), we rely on the following lawful bases for the platform-level processing described in §3.
- Server logs, anti-abuse and security enforcement — Article 6(1)(f), our legitimate interest in keeping the Stayant platform and the operator's site available, secure, and free from fraud and abuse. We have balanced that interest against your rights and consider this processing limited and proportionate.
- Incident response and breach notification — Article 6(1)(c), compliance with a legal obligation where applicable (for example, our obligation under UK GDPR Article 33 to notify supervisory authorities of a personal-data breach), supported by Article 6(1)(f) where it is not strictly required by law.
- Anti-forgery cookies and other strictly necessary cookies — relied on as "strictly necessary" cookies under the Privacy and Electronic Communications Regulations (PECR) and the EU ePrivacy Directive; no consent is required because they exist solely to provide the security feature you have implicitly requested by using the site.
5. Subprocessors
To deliver the platform, Stayant uses a small set of carefully selected third-party providers. A subprocessor processes personal data on Stayant's behalf and on our instructions, under a written contract that requires appropriate security and confidentiality safeguards. The same providers may also be used by Tamill - Holiday Cottages & Lodges in their capacity as controller.
| Subprocessor | Purpose | Region | Transfer mechanism |
|---|---|---|---|
| DigitalOcean (Droplets, Spaces, Managed Postgres) | Hosting, object storage, database | UK (LON1) | Same jurisdiction |
| Stripe (Stripe Payments Europe Ltd. + Stripe Inc.) | Payment processing on the operator's behalf (operator's own Stripe account) | UK / EU / US | EEA→US transfers covered by Stripe Inc.'s EU-US Data Privacy Framework certification; UK→US covered by the UK Extension to the DPF or UK IDTA / SCCs |
| Postmark (Wildbit LLC) | Transactional email send + inbound reply ingestion | United States | UK IDTA / SCCs |
| Twilio (per-tenant configured, optional) | SMS and WhatsApp delivery | United States / EU | UK IDTA / SCCs |
| Channex (per-tenant configured, optional) | OTA channel-manager integration (Airbnb, Booking.com, etc.) | EU | UK ICO adequacy (UK→EU) |
| DigitalOcean AI Platform | LLM inference for admin-side AI features (template / website-layout drafting) | United States | UK IDTA / SCCs |
| Google Fonts (Google LLC) | Web font delivery | Global | UK IDTA / SCCs; EU-US DPF certified |
The operator's choice of which optional integrations to enable — in particular Twilio for SMS and WhatsApp, and Channex for OTA messaging — determines which of these subprocessors actually touch your data on this site. Stripe is used only when you make a payment; the AI platform is used only when the operator drafts messages or website content using the admin-side assistant (see §12).
6. International transfers
Production data for the Stayant platform is hosted in the United Kingdom in DigitalOcean's LON1 region. Wherever possible, your data stays inside the UK.
Some subprocessors are based in, or process data from, the United States or other regions outside the UK and the EEA. Where personal data leaves the UK or the EEA, we rely on a transfer mechanism recognised under UK and EU data-protection law: most commonly the UK International Data Transfer Addendum (IDTA) to the EU Standard Contractual Clauses, or — where applicable — the UK Government's adequacy regulations, the EU-US Data Privacy Framework (for EEA-to-US transfers), or the UK Extension to the EU-US Data Privacy Framework (for UK-to-US transfers). The "Transfer mechanism" column in §5 indicates the basis for each transfer.
7. Retention
Retention of booking data, check-in data, messages, reviews, and payment-method tokens is controlled by Tamill - Holiday Cottages & Lodges as the data controller for that information. If you want to know how long the operator keeps your booking data, contact them at [email protected].
For the platform-level data Stayant controls, our default retention is as follows.
| Category | Retention |
|---|---|
| Server logs (IP, user agent) | 90 days |
Audit log of platform-side administrative actions (AuditLog) |
2 years |
We may retain data for longer than these defaults where we are required to do so by law, where we need to preserve it to defend or pursue legal claims, or where it has been irreversibly anonymised so that it can no longer be linked to you.
8. Your rights
8.1 For data the operator controls
For everything described in §2 — your booking record, check-in details, messages, reviews, and stored payment-method tokens — Tamill - Holiday Cottages & Lodges is the controller. Direct any request to access, correct, delete, restrict, port, or object to processing to them at [email protected].
If you contact Stayant in error about operator-controlled data, we will pass your request to the operator promptly and let you know we have done so. We cannot make changes to operator-controlled data on our own initiative.
8.2 For data Stayant controls
For the platform-level data described in §3 — server logs, anti-forgery cookies, and the technical interaction with the Stripe redirect — Stayant is the controller.
If you are in the United Kingdom or the European Economic Area, you have the rights set out in UK GDPR and EU GDPR over that data, including the right of access, rectification, erasure, restriction, portability, objection (in particular to processing based on legitimate interest), and the right not to be subject to a decision based solely on automated processing that produces a legal or similarly significant effect on you.
Depending on your state of residence, you may have additional or equivalent rights under United States state laws, including the CCPA/CPRA (California), VCDPA (Virginia), CPA (Colorado), CTDPA (Connecticut), and UCPA (Utah). These typically include the right to know, the right to delete, the right to correct, the right to opt out of the sale or sharing of personal information, the right to opt out of targeted advertising, and the right not to be discriminated against for exercising any of these rights.
Stayant does not sell personal data and does not use it for targeted advertising. We have no advertising programme.
To exercise any of these rights over data Stayant controls, email [email protected]. We will respond within the timeframe required by the law that applies to you — one month under UK and EU GDPR, and the equivalent state-law timeframe for US residents.
8.3 Complaints
If you are not satisfied with how your personal data has been handled, please raise it with us at [email protected] (for platform-level data) or with Tamill - Holiday Cottages & Lodges at [email protected] (for booking data) so we have a chance to put things right.
You also have the right to complain to a data-protection authority:
- In the United Kingdom, to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.
- In the EEA, to the supervisory authority of the country where you live, work, or where the issue arose. The European Data Protection Board maintains a directory at edpb.europa.eu.
- In the United States, to your state Attorney General or — where applicable — to a state privacy regulator established under the relevant state law (for example, the California Privacy Protection Agency).
9. Cookies
This site uses only strictly necessary cookies:
- An anti-forgery (CSRF) cookie that protects form submissions against cross-site request forgery.
- A short-lived session cookie where one is required to keep a multi-step form (such as the guest portal check-in) working correctly.
We do not set analytics cookies, marketing cookies, advertising identifiers, fingerprinting tags, or any third-party trackers on this site today.
When you proceed to payment, you are redirected to Stripe's hosted checkout page. Stripe sets its own cookies on Stripe's domain to operate the payment flow; those cookies are governed by Stripe's privacy notice and are not under Stayant's control.
If Stayant ever introduces analytics or other non-essential cookies on this site, we will update this notice and ask for your consent before they are activated, as required by UK and EU cookie law (PECR / ePrivacy).
10. Children
The Stayant platform and the booking sites it renders are intended for users aged 16 or over. Bookings by people under the age of 16 are not accepted.
We do not knowingly collect personal data from children under 16. If you believe a child has provided personal data through this site, please contact Tamill - Holiday Cottages & Lodges at [email protected] and Stayant at [email protected], and we will work with the operator to remove the data without undue delay.
11. Reviews
Reviews you submit through this site are intended to be publicly visible on the operator's site once Tamill - Holiday Cottages & Lodges has approved them through the platform's moderation flow. The display name you choose, your rating, your review title and body, and the country you optionally provide are part of that public display. Your email address and phone number are not shown publicly.
If you want a review you submitted to be edited or removed, contact Tamill - Holiday Cottages & Lodges at [email protected]; they control the moderation queue and can take it down.
Stayant may use aggregated, anonymised review metrics (for example, the total number of reviews per property or average ratings across the platform) for product analytics and reporting. Aggregated metrics of this kind do not identify you.
12. AI processing
When Tamill - Holiday Cottages & Lodges uses the admin-side AI assistant built into the Stayant management app to draft message templates or website content, the prompt may contain placeholders (for example, a guest first name) that are resolved at send time. The resolved content is transmitted to the DigitalOcean AI Platform for inference. That service acts as a subprocessor, is based in the United States, and is covered by the UK IDTA / SCCs noted in §5.
The data we send to the AI platform is limited to what is necessary for the operator's stated purpose, and is not used to train the AI provider's models. We do not run any automated decision-making that produces a legal or similarly significant effect on you.
13. Changes to this notice
We may update this notice from time to time. The current version and effective date are shown at the top of this page, and again at the foot of it.
Where a change is material — for example, a new platform-level purpose, a new subprocessor introducing a new transfer, or a significant change to your rights — we will flag the change on the operator's site for at least 30 days before it takes effect. Older versions are available on request.
14. Contact
For questions about your booking — including refunds, changes, your stay, or how the operator handles your data — contact Tamill - Holiday Cottages & Lodges at [email protected].
For questions about platform-level matters — the data Stayant controls, this notice, security incidents on the platform, or transfer mechanisms — email Stayant at [email protected].
Version 1.1. Effective 15 May 2026.