Last updated: 15 December 2022
Who are we?
At Forest Holidays we are committed to protecting and respecting your privacy and keeping your personal information safe and confidential, both online and offline, whilst striving to provide the very best holiday experience. We ensure every measure is taken to keep your information safe because we want our services to be safe and enjoyable for everyone. We follow strict procedures on how personal information is stored and used and we control who sees it to help stop any unauthorised person getting hold of it.
Forest Holidays Limited, a company registered in England, with company number: 8159308 of Bath Yard, Bath Lane, Moira, DE12 6BA, (referred to as “Forest Holidays” "we", "us" or "our" in this privacy notice) is the primary data controller in relation to your personal data. This means that we are responsible for your personal data.
- Personal Information that we collect from you
- How Personal Information is collected
- How do we use Personal Information?
- Sensitive Personal Information
- Your rights
- Security and how long we retain your Personal Information
- Third Parties
- Transfers of your Personal Information outside the EEA
- Contact Us
Schedule: The Legal Bits
Personal Information that we collect from you
We may also obtain some limited children's data (when a child is a guest at one of our locations). If you are a child staying with us, we may acquire your Personal Information from your parent or guardian during the course of booking a holiday or checking-in with us. We will only use this information in order to ensure that your stay with us is safe and comfortable and to help you to enjoy age-appropriate activities at our locations.
We will ensure that your Personal Information is handled in accordance with all data protection laws that apply to us from time to time.
How Personal Information is collected
There are a number of different ways in which we may collect Personal Information from you directly, for example if you are a customer, if you are a potential customer (e.g. if you’re making an enquiry or browsing our website to consider booking with us) or maybe you are applying for a role with us. We may also collect Personal Information about you indirectly via third parties.
Examples of when we may collect Personal Information about you (directly or indirectly) include:
- Booking with us. If you book a holiday with us, we will collect the data that we need to process your booking about you and your party (for example: your name, address, payment card information) and we will contact you afterwards to let you know about our offers and promotions, unless you ask us not to.
- Talking to us. When you interact with us (e.g. registering with us, sending us emails, contacting us via telephone or simply visiting the website, and/or our apps, or if you talk to us via social media or our online chat system, LiveChat), we will collect the data that we need in order to have that interaction with you. In respect of any online interactions, we may also collect technical information about you (“Technical Personal Information”) (for examples of this, please see the Schedule below).
- Signing up and managing your account. You may wish to sign up for email marketing or you may set up a full account via our online data capture forms on our website (or by filling in a form while you are at one of our Locations) and accordingly we may collect Personal Information when you register for email, manage your online account and update your account preferences or fill in a form. You may unsubscribe from receiving our email marketing at any time by managing your account settings, contacting our Sales and Service team or via the unsubscribe link in your emails.
- Making enquiries about a holiday. If you are considering booking holidays or activities with us we may collect your Personal Information as part of the enquiry process (whether or not you decide to go ahead with your booking), and we will contact you afterwards to let you know about our offers and promotions, unless you ask us not to.
- Offers and promotions. We may collect your contact details when you enter competitions or promotions, complete surveys, or sign up to hear more about our great offers.
- We have CCTV at some of our locations and at our Support Centre in Moira for the purpose of crime prevention. Where this is used, we will display appropriate notices.
- Sharing your experiences. If you leave a review with us on our website, through a survey or via social media, we may choose to share your experiences with third parties or in marketing material. You can choose to opt-out of us sharing that information.by ticking the relevant box on the form.
- Job references. Where you apply for a job with us, we may collect from you and third parties (where relevant) additional Personal Information such as your CV and any references.
- Holidays booked on your behalf. We may receive information from third parties who collect Personal Information from you and pass it on to us for the purpose of processing a booking on your behalf.
How do we use your Personal Information?
We will only ever use your Personal Information when the law allows us to, as described in the Schedule. Examples of why we may process your Personal Information are:
- Improving our services. By analysing your purchasing preferences, we can ensure that the content, services and advertising that we offer are tailored to your needs and interests. We can also ensure that content from our website is presented in the most effective manner for you and for your device by monitoring customer traffic patterns and website usage to help us improve the design and layout of our website and provide content that is of interest to you, and to improve the services which we offer to customers.
- Marketing Communications and Newsletters. When you complete a booking with us or make an enquiry for a holiday or any other service, and do not opt-out at the point of submitting your Personal Information, we may also use your Personal Information to send you our newsletters, special offers and other marketing communications by electronic means (e-mail or SMS). We may also send you these communications where you have chosen to sign up to hear about our news or our great offers. You may change your mind about receiving such marketing communications at any time, as detailed in the "Your Rights" section below.
- Social Media. We also like to work with Facebook and other social media platforms (“Platforms”) to reach out to you with adverts, where we have a lawful basis to do this. We share very limited data with the Platforms and the data is hashed and pseudonymised (meaning that any data that could identify you is replaced with an artificial identifier, making it more secure). Platforms then use this pseudonymised data to create "lookalike" audiences of people who are likely to be interested in the same sort of content.
- From time to time we (or a third party on our behalf) may contact you to ask you about your experience with Forest Holidays. We use this information to improve our services so we can provide you and others with the best standard of service. You may opt-out of receiving these emails at any time.
- Job Openings. If you have consented to such communications, we may also send you information about our job openings that may be of interest to you and/or inform you about important changes or developments to our services.
- Our service providers and business partners and their staff. Where you or your employer provide services to us or our customers as one of our partners, you and/or they may provide us with some of your Personal Information in connection with the provision of the services.
Sensitive Personal Information
You may provide us with some special categories of Personal Information “Sensitive Personal Information” in order for us to provide you with a better standard of service, e.g. providing us with information about your dietary or medical requirements and any restricted mobility or access requirements when you book a holiday with us, which may reveal details about your mental or physical health or condition.
You may choose to restrict the collection or use of your Personal Information in a number of ways that are more particularly described in the Schedule.
If you'd like to do so, please contact us by emailing us at [email protected] or by using the contact details in the Contact Us section below.
Security and how long we retain your personal information
We implement security measures to protect your Personal Information from access by unauthorised persons and against unlawful processing, accidental loss, destruction and damage.
Unless otherwise instructed by you, we will retain your Personal Information for only as long as we require for the purposes for which it was collected. Once the relevant purpose has been satisfied, we will securely delete or anonymise your Personal Information unless we are required to retain a copy of such information under applicable law.
Please note, that the transmission of information via the internet is not completely secure and, although we will take steps to protect your Personal Information, we cannot guarantee the security of your Personal Information transmitted via the website and/or our apps – any transmission is therefore at your own risk.
Security and how long we retain your financial information
When you make your booking we may retain your payment card information (in a secure and tokenised format) in order to collect any payments that you owe us, as part of your booking. Tokenisation is a security method used to protect your payment card details, it works by masking the card details and replacing these with an algorithmic generated number – this is called a token. These are securely stored in the payment gateway so no actual card details can be accessed by Forest Holidays. For the avoidance of doubt, the tokenised payment card information is not stored on our systems for anything other than your booking and costs incurred by you whilst on your holiday. You may request the deletion of your payment card information by emailing us at [email protected] or by using the contact details in the Contact Us section below.
Transfers of your Personal Information outside the EEA
The Personal Information you provide to us will be stored on servers in the UK and we take steps to protect your Personal Information from unauthorised access and against unlawful processing, accidental loss, destruction and damage.
In processing your Personal Information, it may be necessary for us to transfer your Personal Information outside the European Economic Area ("EEA"). It may also be accessed by people based outside the EEA who work for us or for one of our suppliers or group companies.
We will only transfer your Personal Information to third parties outside the EEA if that third party:
- is situated in a country that has been confirmed by the European Commission to provide adequate protection to Personal Information,
- has signed a European Commission approved written contract to provide all the necessary protections to your Personal Information as required by data protection laws or has signed up to an approved safeguarding scheme; or
- we have your consent to do so.
Should you have any queries or complaints in relation to how we use your Personal Information, please contact us using the details below. Should you wish to take any complaints or queries further, you have the right to contact the Information Commissioner's Office regarding such issues.
If you have any questions, please feel free to contact us by email at [email protected]. Alternatively, you may call our team on 03330 110 495, Monday to Friday: 8:30am to 5.30pm.
Schedule – The Legal bits
Part I: Types of Personal Information we collect
Examples of the types of Personal Information we may collect include:
- Identity data: name, username, address, email address, social media account name, medical data.
- Contact data: billing address, delivery address, email address, telephone numbers.
- Financial details and transaction data: payment card information, billing information, details of the products and services you have purchased from us.
- Profile data: demographic data, interests, experiences with our breaks, products or other services and contact preferences.
- Technical Personal Information:
- Device data. Information about the type of device, operating system and platform you use (such as a computer or mobile device) to access our website and/or our apps, your choice of browser and plug-in types and versions.
- Location data. We may collect the location or time zone setting of a device or IP address.
- Usage data about your visit. Automatically generated information about your website session, e.g. full Uniform Resource Locators (URL) clickstream to, through and from our website (including date and time), products and events you viewed or searched for, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), data about your internet service provider, the number and timing of clicks to and from the content on our website and/or our apps and methods used to browse away from the page.
- Data about your interactions. Data generated through interacting with our content such as the contents of a post or comment on our website, or whether a link or image was shared using a particular social media network. Where you receive emails from us we may also collect email engagement rates and activities.
Part II: How we are able to process your Personal Information
In order to be able to process your Personal Information, data protection law requires us to have a lawful basis in which to do so, as set out below:
- Booking with us. If you book a holiday with us, we will collect the data that we need to process your booking (for example: your name, address, payment card information) and we will contact you afterwards for marketing purposes. We do this for the purpose of performing a contract with you and in reliance on our legitimate interests (which don't unduly prejudice your rights).
- Talking to us. When you interact with us (e.g. registering with us, sending us emails, contacting us via telephone or simply visiting the website, and/or our apps, or if you talk to us via social media or our online chat system, LiveChat), we will collect the data that we need in order to have that interaction with you. We use this data to communicate with you, in reliance on our legitimate interests (which don't unduly prejudice your rights).
- Signing up and managing your account. You may wish to sign up for email marketing or you may set up a full account via our online data capture forms on our website (or by filling in a form while you are at one of our Locations). We do this in reliance on your act of consent in giving us your details and asking to receive our news and updates.
- Making enquiries about a holiday. If you are considering booking holidays or activities with us we may collect your Personal Information as part of the enquiry process (whether or not you decide to go ahead with your booking), and we will contact you afterwards to let you know about our offers and promotions, unless you ask us not to. We use this data to communicate with you and deal with your enquiry – and then to send other news and marketing that we think you will be interested in - in reliance on our legitimate interests (which don't unduly prejudice your rights).
- Offers and promotions. We may collect your contact details when you enter competitions or promotions or complete surveys. We do this in order to perform a contract with you (for example if you enter one of our competitions, governed by our terms) and in reliance on our legitimate interests (which don't unduly prejudice your rights).
- We have CCTV at some of our locations and at our Support Centre in Moira for the purpose of crime prevention. Where this is used, we will display appropriate notices. We process image data for this purpose in reliance on our legitimate interests (which don't unduly prejudice your rights).
- Sharing your experiences. If you leave a review with us on our website, through a survey or via social media. We use your data as customer testimonials if you are kind enough to share or leave a review and we do this in reliance on our legitimate interests (which don't unduly prejudice your rights).
- Job references. Where you apply for a job with us, we may collect from you and third parties (where relevant) additional Personal Information such as your CV and any references. We do this in order to perform a contract with you (if you go on to accept a role with us) and in reliance on our legitimate interests (which don't unduly prejudice your rights).
- Holidays booked on your behalf. We may receive information from third parties who collect Personal Information from you and pass it on to us for the purpose of processing a booking on your behalf. We do this in reliance on our legitimate interests (which don't unduly prejudice your rights).
Please note that we also process some personal data in order to comply with certain legal obligations (for example, health and safety regulations), to prevent and detect criminal activity and in order to protect, defend and establish our legal rights.
Part III: Third parties we may share information with
For example, we may share your Personal Information with card issuers when processing your transaction or with a third party activity provider when you have booked activities with us. We may also run promotions with third party service providers and share your Personal Information if you have chosen to hear about great offers from us and our affiliates. As mentioned above, we may also share some limited Personal Information with social media platforms.
If we (or any part of us) enter are sold, transferred to or merged with another business entity or if our business structure changes, your Personal Information may be disclosed to the new business partners or owners, so that they and we can continue to provide the services you have requested.
Part IV: Your rights
Your legal rights in relation to the Personal Information we hold about you are set out below.
- You can object to our processing of your data for legitimate purposes (see the Schedule for more information) if you feel it impacts on your rights. You can also change your mind about receiving communications from us and third parties in relation to marketing or market research communications.
- You are entitled to access a copy of the Personal Information we hold about you (subject to a few exemptions) and ask for details as to how and why that information is processed.
- You can request that we correct any Personal Information that we are holding about you that is incorrect or incomplete.
- You can ask us to erase or stop processing any Personal Information we have about you where there is no longer a legal ground for us to hold it.
- Transferring data. In some circumstances, you may want us to transfer any information we hold about you to a third party.