Privacy notice

Secret Retreats. What we do with your personal information.

This notice explains what personal information we collect, why we collect it, how long we keep it and what rights you have. It applies to guests who book a holiday through us, to owners whose properties we market and manage, and to anyone who contacts us or uses our website.

We have written it in plain English. If anything is unclear, please ask us and we will explain it.

1. Who we are

We are BOOKING BRAIN LTD, a company registered in England and Wales with company number 16719255, trading as "Secret Retreats". Our registered office is Beechwood High Street, Milverton, Taunton, England, TA4 1LL.

We are the data controller for the personal information described in this notice. That means we decide what information is collected and what it is used for, and we are responsible for looking after it.

You can reach us about anything in this notice by email at team@bookingbrain.co.uk, by telephone on 0118 230 0750, or by post at the address above.

2. If you are a guest

What we collect

• Your name, address, email address and telephone number.
• The details of your booking, including the property, dates, the number and names of people in your party, and any pets.
• Anything you tell us about accessibility needs or other requirements for your stay. Health-related information is only ever collected where you choose to give it to us so that we can help.
• Payment information. Card details are entered directly with Stripe, our payment provider, and we never see or hold your full card number.
• Your correspondence with us, including emails, messages sent through the booking platform, and telephone calls, which may be recorded for training and quality purposes.
• Information about how you use our website, as described in our cookie policy.

What we use it for, and our lawful basis

• To take and manage your booking, take payment, and give you the information you need for your stay. Lawful basis: performance of a contract with you.
• To pass the details needed for your stay to the owner of the property you have booked, and to their housekeeper or key holder where relevant. Lawful basis: performance of a contract with you, and our legitimate interests in the property being ready for you.
• To handle enquiries, complaints, damage-deposit questions and refunds. Lawful basis: performance of a contract, and our legitimate interests in running the business properly.
• To meet our legal and accounting obligations, including keeping financial records and complying with tax law. Lawful basis: legal obligation.
• To send you information about future holidays with us. Where you have asked to hear from us, our lawful basis is your consent. Where you have booked with us before, we may send you information about similar holidays because you gave us your details when booking and were offered the chance to refuse at that point; our lawful basis is our legitimate interest in marketing to our own customers, relying on the "soft opt-in" in regulation 22 of the Privacy and Electronic Communications Regulations. Every message has an unsubscribe link and you can stop it at any time by emailing us.
• To keep our website secure and working properly, and to understand how it is used. Lawful basis: legitimate interests, and consent where cookies require it.

Providing your name, contact details, party details and payment information is necessary for us to enter into and carry out your booking. If you do not provide it we cannot take or hold your booking. Anything you tell us about accessibility or health is entirely optional, and there is no consequence if you prefer not to.

The owner of the property you book is responsible for your information in their own right once we pass it to them, for the purposes of your stay and their own legal and tax obligations. They are not acting on our instructions, and our owner agreement requires them to use it only for your stay, keep it secure, not market to you without your consent, and not keep it longer than they need it.

3. If you are a property owner

What we collect

• Your name, address, email address and telephone number, and those of anyone you nominate as a contact, housekeeper or key holder.
• Your property details, photographs, pricing and calendar.
• Your bank account details, so that we can pay you.
• Your booking, payment and commission records, statements and correspondence with us.
• Your login and activity in the owner area of the booking platform.

What we use it for, and our lawful basis

• To market and manage lettings of your property, take bookings, pay you and account to you. Lawful basis: performance of our agreement with you.
• To provide your name and address to a guest who has booked your property, where they ask for it, because the booking is between you and the guest. Lawful basis: legitimate interests, and legal obligation where consumer law requires it.
• To keep financial and tax records. Lawful basis: legal obligation.
• To contact you about your property, our services and matters affecting owners. Lawful basis: performance of our agreement and our legitimate interests in managing the relationship.

Providing your identity, property and bank details is a requirement of our owner agreement and of our tax and accounting obligations. We cannot market your property or pay you without it.

When we pass you a guest's details so that you can host their stay, you become responsible for that information in your own right, as a controller, and not as someone acting on our instructions. Our owner agreement requires you to use it only for the purposes of the stay and your own legal and accounting obligations, keep it secure, not use it for marketing without the guest's consent, not keep it for longer than you need it, and tell us promptly about any security incident or request from a guest about their information.

4. Where we get information from other people

We do not always receive information directly from the person it is about. If you book through Airbnb, Booking.com, VRBO or Expedia, we receive your name, contact details and booking details from that platform. If somebody else books a holiday that includes you, we receive your name, and for children their age, from the person who made the booking. If an owner nominates you as their housekeeper or key holder, we receive your name and contact details from them. We use that information for the purposes described above, and this notice is how we tell you about it.

5. Who we share information with

We do not sell personal information to anyone. We share it only with the following, and only as far as is necessary:

• Service providers who act on our instructions, under written contracts: Stripe, which processes card payments; SendGrid, which sends our booking emails; Freshdesk, which runs our customer-support inbox; and Mailchimp, which sends our newsletter if you sign up for it.
• Property owners and their nominated housekeepers or key holders, for the purposes of a stay.
• Booking channels such as Airbnb, Booking.com, VRBO and Expedia, where a booking is made through them. Those companies are controllers of your information in their own right and their own privacy notices apply.
• Our bank, to receive payments and pay owners.
• Google (Google Ireland Limited and Google LLC), which provides the maps on our website and the "I'm not a robot" check on our forms, as described in our cookie policy.
• Other service providers who help us operate, such as our telephone provider. Most act only on our instructions under a written contract. Some, including Google, also use information for their own purposes as controllers, and their own privacy notices apply.
• Our accountants and professional advisers, and HM Revenue & Customs and other authorities where the law requires it.

6. Where your information is held

Most personal information is held in the United Kingdom and the European Economic Area. Some of the people and companies who help us run the business work outside the UK, and some of our service providers, including Google, Stripe, SendGrid, Freshdesk and Mailchimp, may process information in the United States, so your information may be accessed from other countries. Where information leaves the UK we rely either on a UK adequacy regulation covering that country, or on the International Data Transfer Addendum to the standard contractual clauses approved for use in the UK, together with an assessment of the protection available there. You can obtain a copy of the safeguards we use by emailing team@bookingbrain.co.uk.

7. How long we keep it

• Booking and financial records: seven years from the end of the tax year they relate to, because tax law requires it.
• Guest contact details and correspondence: three years after your last stay or contact with us, unless we still need them for a complaint or claim.
• Owner records: for as long as you are an owner with us, and seven years afterwards for accounting purposes.
• Marketing preferences: until you ask us to stop, plus a permanent record of your objection so that we do not contact you again by mistake.
• Call recordings: twelve months, unless needed for a specific complaint.
• Information kept in your browser: as set out in our cookie policy.

8. How we look after it

Personal information is held in access-controlled systems protected by passwords and, where available, two-factor authentication. Access is limited to the people who need it to do their job, including our contractors outside the UK, who are bound by written confidentiality and data protection terms and given only the access their role requires. Card payments are handled by Stripe, a regulated payment provider, rather than by us. If a security incident affects the booking platform or the information held in it, Booking Brain Ltd is responsible for responding to it and, where the law requires, for telling the Information Commissioner's Office and the people affected.

9. Your rights

You have the right to ask us for a copy of the personal information we hold about you; to have inaccurate information corrected; to have information deleted where we no longer need it; to object to processing we carry out on the basis of legitimate interests; to ask us to restrict how we use your information while a question about it is resolved; to receive certain information in a portable form; and to withdraw consent at any time where we rely on it.

Withdrawing consent does not make anything we did before you withdrew it unlawful.

We do not make any decision about you by automated means alone, and we do not carry out profiling that produces legal or similarly significant effects.

To exercise any of these rights, email team@bookingbrain.co.uk. We may ask you to confirm your identity first. We will normally respond within one month, and will tell you if we need longer, which the law allows for complex requests. There is no charge, unless a request is clearly unfounded or excessive.

If you are unhappy with how we have handled your information, please tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner's Office, at ico.org.uk or on 0303 123 1113.

10. Children

Bookings must be made by an adult. We do not knowingly collect information directly from children, although a booking will usually include the names and ages of children in the party, given to us by the adult making the booking.

11. Changes to this notice

We may update this notice from time to time. The date below shows when it was last changed, and we will tell owners and guests directly about any change that materially affects them.

Last updated: 28 September 2026.