What I hold, and why

01The short version

I collect the two contact details you type into a trip plan, and the plan itself. I use them to answer you. I do not put you on a mailing list.

The site sets no cookies at all. Visits are counted twice, by Vercel and by PostHog, in a way that writes nothing to your device and cannot follow you, which is why there is nothing here to agree to and no banner asking you.

There is one thing I do ask, and only on the enquiry form: whether I may tell Meta that an enquiry was sent, so I can see whether my adverts reach anyone. It is a box you tick, and nothing goes unless you do.

Nothing leaves until you say so in writing. Once you have, your details go to the villa and to the people delivering your week, and no further. The villa is contracted and invoiced by whoever manages it. Whichever of the four services are mine at that villa, I invoice you for those myself, so those billing details are held by me.

Whichever half of the week you are asking about, I am the person you write to. I do not hand you to a queue, and I do not stop being your contact once a villa has your booking.

02Who I am

Padel Hideaways is run by Lisa, who is the named contact on every page of this site and the person who reads your enquiry. For data protection purposes the controller is Emberpath LTD, trading as Padel Hideaways.

The registered company, its number and its registered address are on the terms page under Who you are dealing with, which is where the rest of what you are entitled to know before dealing with anyone online is written down.

Write to lisa@padelhideaways.com about anything on this page and it comes to me, not to a queue.

03Cookies, and why there are none

There are none. That is the whole section, and the rest of it is why.

I do count visits, because I want to know whether anybody is reading this. The first counter is Vercel Web Analytics, it is served from this domain by the company that hosts the site, and it writes nothing to your browser. It records the page, roughly which country the request came from, and which site you arrived from. There is no identifier, so two visits cannot be joined up as the same person, and nothing is tied to your name, your email or an enquiry you send.

This is the reason there is no banner. A banner exists because a site wants to put something on your device, and this one does not, so being asked would be theatre. The one question I do ask is on the enquiry form, it is about Meta rather than about cookies, and it is in section 05. If any of this changes you will be asked properly, and this page will change first.

There are no advertising tags and no embedded video. The typefaces are served from this domain rather than from Google, and so is the first counter, so opening a page does not tell any advertiser, any social network or any font service that you did.

The Journal has share buttons, and they are worth a sentence because they are not what they look like. Nothing is loaded from X, LinkedIn, WhatsApp or anyone else when the page opens, so those companies are not told you read it. Each button is a plain link that does nothing until you press it. Press one and it hands you to that app, which then knows what you shared, exactly as it would if you had copied the address and pasted it in yourself.

There is a second counter, and it does two jobs the first cannot: it records which villa an enquiry was about and which of the five routes you picked, and it replays how a page was used, so I can see where a villa page loses people. It is PostHog, its code is part of this site rather than fetched from them, it sets nothing on your device, and it holds no profile of you. The replay is the page as you moved through it, the scrolling and what you pressed. Anything you type is masked inside your own browser before it is sent, so what you write into an enquiry is never in it, and a recording ends when you reload or leave rather than following you. I have it set to discard the IP address a request came from.

One other thing is stored in your own browser, and only if you send an enquiry: the summary shown on the confirmation page is held for the single step between pressing send and that page loading, then deleted. It never leaves your device and it is not a cookie.

The site is hosted for me, and like any web host the server keeps short lived technical logs, including the IP address a request came from. That is a security and reliability measure, not a way of recognising you, and I do not use those logs to build any picture of a visitor.

04What I collect when you write to me

Only what you put in, which is:

• Your email address, your mobile number, or both. One of the two is needed or I cannot reply.
• The plan you built: the villa, the week you picked, which of the five you want, and the indicative figures shown alongside them.
• Anything else you choose to tell me when we start talking, by email, WhatsApp or on a call.

I do not ask for your address, your date of birth, your passport or any payment details, and nothing on this site takes a payment. Money is asked for later, and by whichever of us is invoicing that half of the week.

The stay is contracted with the villa, so the villa asks you for what it needs and tells you how it holds it. Whichever of the Concierge, the Driver, the Chef and the Coach are mine at that villa, I invoice you for myself, so that part is me asking: a name and address to bill, and whatever an invoice or a transfer needs in that country. Which half is which is in your booking confirmation before you commit to either. How long I hold my own invoices is in section 07.

I do not knowingly collect anything about children. The site is aimed at the person organising a trip.

05Why I am allowed to hold it

Under the UK and EU General Data Protection Regulation there has to be a lawful basis for holding anything about you. Two cover what you send me, and a third covers one thing only.

• Steps taken at your request before a contract: you asked me to price and arrange a week, and I cannot do that without a way to reach you.
• Legitimate interests: keeping a record of enquiries so that I can pick a conversation back up, and so that I know what has been quoted to whom. I have weighed this against your privacy and kept what I hold to the minimum that makes it work.

Consent, for one thing only. If you tick the box on the enquiry form, I tell Meta that an enquiry was sent, so that I can see whether the adverts I pay for reach anyone. What goes across is a one-way scramble of your email address, made in your own browser before it is sent, and the click identifier Meta itself added to the link if you arrived from one of my adverts. Your address is never sent, and Meta cannot read it back out of the scramble. Untick the box and nothing goes.

Nothing else on this site asks for consent, because nothing else needs it. The counting described above writes nothing to your device and holds nothing about you. There is no marketing to opt out of, because there is none.

If you are in South Africa, the equivalent grounds under the Protection of Personal Information Act are performance of a contract and legitimate interest, and everything below applies to you in the same way.

06Who else sees it

Answering an enquiry properly means talking to the people who would look after you. Sending a trip plan is your permission for me to make those introductions, and I make them once you have told me in writing that you want to go ahead, not before. Then, and only as far as the arrangement needs:

• The owner or manager of the villa you have chosen, to hold and confirm the week. I am the one who talks to them, and I stay in it.
• The independent businesses and individuals I bring in to deliver the parts you asked for: the driver, the chef, the coach, the concierge. They differ from villa to villa, and each is told only what they need in order to do their part, which is usually names, dates and numbers, not the whole conversation.
• The companies that run my email and this website, who hold the message in the ordinary course of carrying it.
• Meta, and only if you ticked the box: that an enquiry was sent, the villa it was about, and the scrambled email described above. This happens in the United States, and I rely on the safeguards the law provides for transfers of that kind. Meta is not told your name, your number, or anything you wrote to me.

Where a booking goes ahead, your details also go to the portfolio partner or the owner I book that villa through, who holds the contract for the stay and takes payment for it. They ask you directly for whatever they need and tell you how they hold it. That is the villa, and only the villa: where one of the four services is mine, nobody else invoices you for it, and the billing details that needs stay with me.

Everyone on that list is given your details to arrange your week and for nothing else. Not for their own marketing, and I ask for nothing that would let anyone build a picture of you from it.

That is the whole list. I do not sell anything to anyone, I do not pass your name to another villa or another agency, and there is no mailing list here for you to be put on or to get off.

Some of the villas are in South Africa, so answering an enquiry about one of them means sending your details outside the UK and the European Economic Area. Where that happens I rely on the safeguards the law provides for transfers of this kind, and I send only what the people at that end need.

07How long I keep it

An enquiry that does not turn into a trip is kept for 24 months and then deleted. Weeks are often planned a long way ahead and people come back the following year, so anything shorter would mean asking you for everything twice.

Where a trip does go ahead, I keep the record for as long as I have to for tax and accounting, which is usually longer, and then delete it. Where I invoiced you for a service of mine, the invoice and the billing details on it are part of what I have to keep, under the accounting rules that apply to me rather than by choice.

You can ask me to delete your details sooner and I will, unless I am required to keep something.

08What you can ask me to do

You have the right to:

• See what I hold about you, and get a copy of it.
• Have anything wrong corrected.
• Have it deleted.
• Object to my holding it, or ask me to restrict what I do with it.
• Receive it in a portable form, or have it sent on to someone else.

Ask at lisa@padelhideaways.com. It is me at the other end, it costs nothing, and I will come back inside a month. I may ask a question to check you are who you say you are, which is a protection for you rather than an obstacle.

If you think I have got this wrong you can complain to a supervisory authority: the Commissioner for Personal Data Protection in Cyprus, which is where the company is, your own national authority anywhere else in the EU, the Information Commissioner in the UK, or the Information Regulator in South Africa. I would rather you told me first so I can put it right.

09Keeping it safe

The site is served over an encrypted connection and enquiries travel the same way. Access to my inbox is protected by a strong password and two factor authentication.

No one can promise that anything sent over the internet is perfectly secure. What I can promise is that I hold very little, for a stated reason, for a stated time.

10Changes

If what I do changes, this page changes with it and the date at the top moves. If a change matters to someone whose enquiry I am already holding, I will tell them rather than expect them to check.