Holiday Let Privacy Policy, Cookies and GDPR Basics

You’ve built or rebuilt your website, and now someone has asked whether it has a privacy policy. It should, and so should any holiday let site that takes enquiries or bookings. A holiday let privacy policy is a plain page that says what guest details you collect, why, who sees them and how long you keep them.

Alongside it you need a cookie notice if your site uses non-essential cookies, your business details, and booking terms. None of it is hard, but it does need to match what your site really does. This guide covers each piece in the order you’d tackle it.

Which legal pages a holiday let website needs

A holiday let website needs a privacy policy, a cookie notice where cookies are used, your business details and booking terms. The last of those isn’t a strict legal page, but it protects you and your guests.

Put links to the first two in your footer so they show on every page. Your terms should appear before a guest pays, ideally with a tick box at the booking step.

What a holiday let privacy policy must cover

Your privacy policy has to say who you are, what data you collect, why, who it’s shared with, how long you keep it and what rights guests have. It should be written in language a guest can follow, not legal padding.

Most small owners can write this in under a page. If you ever send guest data outside the UK, for example through a US-based email tool, say so and say what protects it.

GDPR basics for guest data

UK GDPR is the main law on personal data in the UK, and it applies in the same way whether you run one shepherd’s hut or a park of forty pitches. The rules are less scary than the name, and a handful of ideas cover most of it.

• Have a reason for each use. Handling a booking is covered by the contract with your guest. Sending marketing emails needs their consent, so no pre-ticked boxes.
• Keep it to what you need. If you don’t use a guest’s home address, don’t ask for it.
• Delete when you’re done. Set a period, such as a set number of years after the stay, and stick to it. Your accountant can tell you how long tax records must be kept.
• Respect guests’ rights. They can ask what you hold, ask you to correct it, and in many cases ask you to delete it. You generally have one month to reply.
• Know what to do if something goes wrong. A lost phone or a wrong email sent to the wrong guest can be a breach. Serious ones must be reported to the ICO within 72 hours.

Special requests need extra care. A note about a guest’s mobility, allergy or medical need is health information, which gets stronger protection. Only ask when it helps the stay, and don’t keep it longer than you need to.

Many businesses that handle personal data also pay a data protection fee to the ICO. It has a short self-assessment on its website, so check there rather than guess. If you have cameras at the site, such as a doorbell camera, the ICO has separate guidance and you’ll need to say so in your policy.

Where booking data actually goes

Guest data usually sits in several tools at once, and your privacy policy has to name each type. The easiest way to write it is to map them first.

A calendar that syncs with your listing sites is a separate question from guest details, so ask each supplier what personal data it holds. If you’re adding an availability calendar on your site, check the same thing before you go live.

Cookie banners done properly

If your website uses non-essential cookies, you must get consent before they load, and refusing must be as easy as accepting. Strictly necessary cookies, like the ones that keep a booking basket working, don’t need consent.

Analytics, advertising pixels and some embedded videos and maps usually set non-essential cookies. So the cookie policy for a booking website really depends on what you’ve added.

A fair banner has these features.

• No non-essential cookies are set until the guest says yes.
• “Reject all” sits next to “Accept all” and looks just as easy to click.
• No pre-ticked boxes.
• A link to your cookie notice listing each cookie and what it does.
• A way to change the choice later, such as a footer link.

The rules on some low-risk analytics cookies have been changing, so check the ICO’s current guidance, or ask your solicitor, before leaving a banner off. A simpler option is to use few cookies in the first place. Fewer cookies means a simpler banner, and a faster page on a phone.

Collect less, worry less

The simplest way to cut your GDPR workload is to ask for less. Every field on a form is data you have to protect, explain and eventually delete.

A short form with dates, guest numbers, a name, an email and a message is usually enough to start a conversation. You can collect more once the booking is confirmed. For example, Millie the Hut’s booking page puts an availability calendar, a short enquiry form and a seasonal rate card on one page, so guests get answers without a long form. We built that site, and you can see how a lean enquiry flow looks in our work for holiday lets across the UK.

Do it yourself, or hire a solicitor

You can draft a basic privacy policy yourself from a good template, as long as it describes what you really do. A solicitor is worth paying for when you hold more sensitive data, run several sites, or aren’t sure what your tools do with guest details.

Whichever you choose, keep three habits. Review the policy when you add a new tool, such as a new booking system or newsletter. Put a “last updated” date on the page. And have your solicitor check the final wording, since the details of the law and your own circumstances matter.

FAQs

Do I need a privacy policy for a one-cottage holiday let website?

Yes, if your website collects any personal data, and an enquiry form, booking widget or newsletter sign-up all do. Size doesn’t matter. UK GDPR applies to a single shepherd’s hut the same as a large park, so you need to tell people what you collect, why, and who sees it. The policy can be short and plain.

Does a holiday let website need a cookie banner?

Only if your site sets cookies that aren’t strictly necessary, such as analytics, advertising pixels or some embedded videos and maps. Cookies that make a booking basket or security work are exempt. If you use the others, you need to ask for consent before they load, and make saying no as easy as saying yes.

Can I copy another holiday let’s privacy policy?

Copying is a bad idea. Another owner’s policy describes their tools, their suppliers and their retention periods, which won’t match yours, and it may be protected by copyright. Use a good template or a solicitor’s draft as a starting point, then edit it to say what you really do with guest data.

How long can I keep guest booking details?

UK GDPR doesn’t set a fixed number of years. You should keep personal data only as long as you need it, and be able to explain why. Accounting and tax records usually have to be kept for several years, so ask your accountant, then write the period into your policy and delete the rest.

Do I need to register with the ICO?

Many businesses that handle personal data have to pay a data protection fee to the ICO, and there are some exemptions. The ICO has a short self-assessment on its website that tells you whether you need to pay. It takes a few minutes, and a penalty can follow if you should have paid and didn’t.

Send us your website and we’ll tell you, for free, what’s stopping it getting bookings. Ask for your free website audit.