Privacy Policy
A plain account of how Holiday Harbor handles personal information: the details we collect when you browse or buy, the reason each one is needed, who else receives it, how long it stays, and how you can see it, correct it or have it deleted.
The information we collect
Browsing the site leaves technical traces: the kind of device and browser you used, an approximate location derived from your IP address, the pages you visited and the path you took between them. None of this identifies you by name, and it is used in aggregate to see which pages work and which do not.
Placing an order adds the details needed to fulfil it: your name, email address, delivery and billing addresses, a contact telephone number where the carrier requires one, the items you bought and the confirmation our payment provider sends back once the payment clears.
We never receive or store your full card number. Payment details are entered on the processor's own page, and what returns to us is a confirmation that the transaction succeeded, along with the last four digits for reconciliation.
If you write to us about an order, that correspondence is filed against the order so whoever replies next can see the history instead of asking you to explain it again.
We do not ask for information we have no use for. There is no field on the checkout for a date of birth, a gender or a marketing preference, because none of those changes whether an order can be packed and sent.
If you use a public or shared device, clearing your browser storage after ordering removes the cart and session details that would otherwise sit on that machine until they expire.
How we use each piece
Your name, addresses and email address are required to take payment, dispatch the order and tell you what is happening. Without them we cannot complete a sale, which is why they cannot be omitted at the checkout.
Technical data is used to keep the site working, to detect unusual traffic that may indicate fraud, and to understand in aggregate which pages customers read. It is not used to build a profile of you as an individual.
Order history is used for accounting, for handling returns and warranty questions, and for spotting patterns that suggest fraudulent activity. It is not used to decide what advertising you see elsewhere.
Every detail we hold is tied to one of those purposes. We do not collect information simply because it might be useful one day, and we do not ask for fields we have no use for.
Where we rely on your agreement rather than on the need to fulfil an order, you can withdraw it at any time and we will stop that particular use. Withdrawing consent does not affect anything we did before you withdrew it.
We keep a short written note of why each category of information is held, so that if you ask the question we can answer it specifically instead of describing the whole system.
Cookies and similar storage
The site sets a small number of cookies and browser storage keys. The essential ones hold the contents of your basket and keep the checkout session alive as you move between pages.
Without those essential keys the basket empties the moment you navigate elsewhere, which is why they cannot be switched off from our side. They contain no advertising identifiers and are not shared with anyone.
A separate analytics cookie counts visits in aggregate. It records which pages are viewed and roughly how long people stay, but it does not identify you and is not linked back to your order.
We do not run third-party advertising cookies on this site. You can block cookies in your browser settings; the site will still be readable, but the cart will not survive a page change.
The analytics cookie stores a random identifier rather than your name or email address. It cannot be joined back to an order in our systems, and we do not attempt to join it.
If you arrive from a marketing link, we may record that a visit came from a campaign in aggregate. We do not build a profile that follows you to other websites, and we do not sell that information to anyone.
Who we share your information with
Information goes only to the organisations required to complete a purchase: the payment processor that takes the card, the delivery carrier that transports the parcel, the hosting company that serves the site and the service that sends confirmation emails.
Each of them receives the minimum needed for its role. The carrier sees the delivery address and a contact number, not your payment details. The processor sees the payment information, not your order history beyond the amount.
We do not sell personal information, and we do not pass details to unrelated mailing lists or data brokers. Nobody pays us for your data.
If we change supplier, the replacement inherits exactly the same restriction and receives order data only for the purpose of fulfilling and delivering orders.
Before appointing any supplier that touches order data we check what it does with that data and how long it keeps it, and we record the answer. If a supplier cannot meet the standard we expect, we do not use it.
Where a request comes from a public authority we release only what the request legally compels, and we tell you unless we are prohibited from doing so.
How long we keep it
Order records, including the delivery address and the list of items bought, are kept for seven years because tax and accounting rules require it. That period is set by law rather than by preference.
Support correspondence is held for two years, which is long enough to resolve a repeat question without keeping a permanent record of every message.
Analytics data remains in aggregate form with no route back to an individual shopper, and a basket that was never ordered is cleared automatically after a short period.
If you ask us to close your account, we delete everything we are not legally obliged to keep, and we confirm in writing what was removed and what had to be retained.
When a retention period ends the record is deleted rather than simply hidden, and it is not left in a second system that nobody checks.
If you close your account, the order history that accounting rules require us to keep is separated from everything else, so the retained part contains only what the law demands.
How we keep your data secure
Traffic to the site is encrypted in transit, so what you type cannot be read on the wire between your browser and our servers. Card details are entered on the processor's own page and never reach our machines or appear in our log files.
Access to order data is limited to the small team that packs and answers queries. Each person uses an individual account rather than a shared login, and that access is reviewed when someone leaves.
Backups are encrypted, and the systems that hold them are not reachable from the public internet. We test the restore process periodically so a backup is worth more than the disk it sits on.
No system is perfect, and we will not pretend otherwise. If a breach ever affected your data, we would tell you directly, explain what had happened and say what we were doing about it.
Staff access is granted by role, so someone who only answers emails cannot download the order table. Access is removed the same day someone stops working with us.
We keep an eye on unusual patterns, such as a single address generating many failed payments, because that is usually the first sign of card testing rather than a real customer.
Your rights over your data
You may ask for a copy of the personal information we hold about you, ask us to correct anything inaccurate, ask us to delete it, or object to a particular use. None of these requests costs anything.
Marketing email can be stopped at any time using the unsubscribe link at the foot of every message. Order and dispatch emails are not marketing and continue to be sent, because they carry information you need about a purchase.
A request is answered within 30 days. If a request is complex we will tell you why it is taking longer rather than letting the deadline pass in silence.
We may ask you to confirm your identity before releasing or deleting data. That check exists to stop someone else obtaining your information by pretending to be you.
You do not have to give a reason for a request, and we will not treat a request as a complaint or reduce the service you receive because you made it.
If we cannot do what you have asked, we will explain which rule prevents it and what you can do next, rather than replying with a refusal and nothing else.
Children and younger shoppers
This shop is intended for adults. We do not knowingly collect personal information from a child under 13, and we do not direct advertising at children.
Where an item is bought for a child, the order is placed by an adult, and the contact details on file are that adult's rather than the child's.
A parent or guardian can ask on a child's behalf, and the request is handled in the same way as any other. If you believe a child has sent us personal information, tell us and it will be deleted.
Photographs sent in for a sizing or fit question are used only to answer that question. They are not published, not used in advertising and not passed to anyone else.
We do not run competitions, newsletters or accounts aimed at children, and we do not ask for anyone's age during checkout.
If a product is intended for a child, the age guidance on the product page is about safe use of the item, not about who is allowed to buy it from us.
Contacting us about privacy
Write to [email protected] with "privacy" in the subject line and tell us what you would like us to do. A short, specific request is easier to action than a general one.
We reply within one working day and will explain in plain language how a clause applies to your own situation, rather than pointing you back at this page.
If our handling of personal information changes in any material way, the revised text appears here with the date of the revision shown at the top.
You may also ask which categories of information we hold about you before deciding whether to make a formal request, and we will answer that question the same way.
A request does not have to use any particular wording. A short email saying what you want done is enough, and we will ask for anything else we need.
If you are unhappy with our answer you can ask us to look at it again, and we will tell you who reviewed the first decision.