1. Who this policy covers
This policy explains how TWH Holdings Limited handles personal information when you use this public website, make or manage a People Villa reservation, communicate about a stay, exercise a data right, visit the property or otherwise interact with the company.
TWH Holdings Limited is normally the controller where it decides why and how personal information is used for booking administration, guest support, property security and company enquiries. The People Villa app is published through the mobile stores by People Group Services Limited; the current store declarations and platform notices also apply to the app distribution.
App-store declaration
The current Apple and Google listings state that the app does not collect data through the app. Booking administration may still involve information you actively provide outside device analytics, for example to reserve, pay, confirm driver eligibility or request support. The live implementation and store declarations must remain aligned.
2. Information we may handle
Depending on the interaction, this may include:
- identity and contact details, including names, addresses, email addresses and telephone numbers;
- reservation details, dates, party size, guest names, preferences and correspondence;
- payment status, invoices, refunds and transaction references, but not full card details where a regulated payment provider handles them;
- driver eligibility information where the villa vehicle is requested, such as age confirmation, licence status and insurer-required evidence;
- support, complaint, accident, damage, maintenance, safeguarding or insurance information;
- accessibility or health-related information you choose to provide so a reasonable request can be considered;
- technical and security information such as IP address, device/browser details, fault logs and security events where the live service records them;
- external CCTV images from security cameras at the property; and
- company enquiry and statutory record information.
We aim to collect only information that is adequate, relevant and reasonably necessary for the purpose.
3. Why we use information
Purposes may include responding to enquiries; showing or administering a reservation; taking and reconciling payment; issuing confirmations and guest information; checking vehicle eligibility; managing access, safety, cleaning, maintenance and damage; handling complaints, incidents and insurance; preventing fraud or misuse; keeping financial and company records; complying with law; and improving service reliability.
We do not use guest information for behavioural advertising and do not sell personal information.
4. Lawful bases
Depending on the purpose, the lawful basis may be:
- Contract: to take steps at your request before a reservation or perform the booking agreement.
- Legal obligation: for tax, accounting, regulatory, safety or lawful authority requirements.
- Legitimate interests: to operate and secure the property and services, prevent misuse, maintain records, defend claims and respond to reasonable enquiries, balanced against your rights.
- Consent: where a genuine choice is required, such as optional direct marketing or certain information you volunteer.
- Vital interests or legal claims: in a genuine emergency or where information is necessary to establish, exercise or defend legal claims.
Special-category information is not routinely requested. Where you choose to provide health or accessibility information, it is minimised and handled under an appropriate UK GDPR condition, such as explicit consent or another condition permitted by law.
6. UK, Spain and international transfers
People Villa is in Spain and TWH Holdings Limited is established in the United Kingdom, so information may be used in both the UK and European Economic Area. Some technology suppliers may process information elsewhere.
Where UK data protection law requires a transfer safeguard, we use an adequacy regulation, approved contractual clauses, the UK International Data Transfer Agreement/Addendum or another lawful mechanism, together with proportionate risk assessment and security measures.
7. How long information is kept
Information is not kept indefinitely. Retention depends on the purpose, legal requirements, limitation periods, financial-record obligations, insurer requirements and whether a dispute or incident is active.
Typical default periods are described in the Data Retention & Deletion Policy. CCTV is normally kept for a short period unless an incident requires preservation.
8. Your rights
Subject to the conditions and exemptions in data protection law, you may have rights to be informed, access your information, correct inaccurate information, request erasure or restriction, object to certain processing, receive portable information, withdraw consent and challenge certain automated decisions.
Send requests to the contact address below. We may need proportionate evidence of identity and enough detail to locate the information. You also have the right to complain to the UK Information Commissioner’s Office. Where Spanish data protection law is directly engaged, you may also contact the Agencia Española de Protección de Datos.
9. Security and breaches
We use proportionate technical and organisational measures intended to protect information against accidental or unlawful loss, alteration, disclosure or access. No internet service is completely risk-free. Security controls and incident handling are described further in the Information Security Policy.
Where a personal data breach creates a reportable risk, the relevant regulator and affected people will be informed in accordance with applicable law.
10. Children and group reservations
The booking organiser should provide information about other guests only where authorised and should share relevant privacy information with them. Information about children should be supplied by a parent, guardian or authorised adult and limited to what is necessary for the stay.
Contact and version control
Meadway, Mill Road, Writhlington, Radstock, England, BA3 5TY
This policy is reviewed when the service, law, technology or suppliers materially change. The date above identifies the current public edition.
