About this Privacy Notice

This privacy notice (this “Notice”) sets out how we collect and process the personal information that you give us (collectively “we,” “our,” or “us”). This Privacy Notice applies to current residents and park home owners, prospective purchasers, individuals making enquiries about Sandy Bay, visitors, and users of our services, websites and applications (individually, “you”).

About Sandy Bay

Sandy Bay is a residential park resort offering luxury park homes to residents over the age of 50.

Who we are

Sandy Bay is operated by Park Holidays UK Ltd (“Park Holidays”) on behalf of Thorney Bay Park Ltd. Your information may be accessible to both companies as independent data controllers, and to our parent company (SUN Communities). Together we are committed to protecting the privacy and security of your personal information. We take care to protect the privacy of our customers and anyone that communicates (online or offline) with us either in person, over the phone or through our mobile applications, websites, and social media platforms. We will handle your personal information fairly and legally and are dedicated to being transparent about the information we collect about you and how we use it.

The purpose of this Privacy Notice is to inform you of the information we collect, what we do with it, what we do to keep it secure as well as the rights and choices you have over your personal information.

Applicable data protection legislation includes the Data Protection Act 2018 (DPA2018), United Kingdom General Data Protection Regulation (UK GDPR), the Privacy and Electronic Communications (EC Directive) Regulations 2003 and any legislation implemented in connection with the aforementioned legislation. Where information is processed by a controller or processor established in the European Union or comprises the information of people in the European Union, it also includes the EU General Data Protection Regulation (EU GDPR) and any replacement legislation coming into effect from time to time.

We are the data controller for the personal information we process, unless otherwise stated.

How to contact us

Park Holidays UK Ltd. is registered in England under Company Number 02434151 and registered with the Information Commissioner’s Office (the ICO) – Registration Number Z7420595.

Park Holidays UK Ltd. can be contacted by post, phone or email, as follows:

Post: Park Holidays UK Ltd, Glovers House, Bexhill-On-Sea, TN39 5ES

Phone: 01424234234

Email: info@parkholidays.com

Website: www.parkholidays.com

Park Holidays has appointed a Data Protection Officer who is responsible for overseeing compliance with data protection laws at Sandy Bay and they can be contacted by emailing dpo@parkholidays.com

Sandy Bay contact details

Sandy Bay Residential Resort, Thorney Bay Road, Canvey Island, Essex ,SS8 0DB

The personal information we collect about you

We collect and process personal information relating to prospective purchasers, individuals making enquiries about Sandy Bay, visitors, residents and park home owners. The categories of personal information we process and the ways in which we use it are set out below.

Data type	Description	How we use it
Identity Data	This includes your first name, last name, any previous names, username or similar identifier, marital status, title, date of birth and gender.	We use this information to respond to enquiries about Sandy Bay, arrange viewings and sales appointments, assess suitability for our residential community, progress a purchase where you decide to proceed, manage our ongoing relationship with residents and park home owners, and to detect and prevent criminal activities.
Contact Data	This includes billing address, delivery address, email address and telephone numbers.	We use this information to respond to enquiries, provide information about park homes and services at Sandy Bay, arrange appointments and viewings, contact you in connection with your purchase, ownership or use of your park home or the facilities at Sandy Bay and, where permitted by law, to send you marketing communications.
Financial Data	This includes bank account details and in some limited circumstances payment card details, although these will generally be collected directly by the payment services provider(s) when you use our points of sale.	We use this information to collect payments from you for the purchase, reservation, upgrade or maintenance of a park home, for the provision of utilities and for goods and services purchased on our park. Where applicable, we may also use this information to assess affordability, progress a purchase transaction or liaise with finance providers at your request.
Transaction Data	This includes details about payments to and from you and details of the products and services you have purchased from us or our partners.	We use this information to manage our relationship with you and/or our partners, detect and prevent criminal activities, and to understand more about you to tailor marketing, loyalty services and offers to you.  For prospective purchasers, this may include records relating to reservations, deposits, purchase enquiries and associated communications.
Technical Data	This includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, device ID and other technology on the devices you use to access this website and any apps.	We use this information to manage and optimise our websites and applications, understand how prospective purchasers, residents and owners interact with them, provide personalised experiences, measure the effectiveness of our advertising and marketing activities, and better understand the interests of individuals who enquire about Sandy Bay. This type of data may also be used to help us detect and prevent criminal activities.
Profile Data	This includes your username and password, purchases, orders or bookings made by you, your interests, preferences, feedback, survey responses, and any other interactions or complaints you have made to us.	We use this information to manage our relationship with you and/or our partners, improve our products, services and parks, and to understand more about you to tailor marketing, loyalty services and offers to you. This may include records of enquiries, viewings, sales discussions, requests for information and communications with us prior to purchasing a park home.
Marketing and Communications Data	This includes your preferences in receiving marketing from us and our third parties and your communication choices.	We use this information to manage communications with prospective purchasers, residents and owners, including marketing via email, text message and other electronic channels where permitted by law.
Special Category Data	Information relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data (where used for identification purposes), health, sex life, and sexual orientation.	We collect health information in relation to accidents, injuries or illnesses that occur on park. We may also process special category information where you choose to provide it to us in connection with an enquiry, viewing, purchase, complaint, request for assistance or residency at Sandy Bay. We may process information in other special categories where you provide it to us in relation to a request from you or where you have made a complaint about something that causes you to provide us with this type of information.
Criminal Data	Information relating to criminal convictions and offences or related security measures.	We process this information only where necessary in relation to criminal activity, allegations, investigations or legal proceedings connected with Sandy Bay, its residents, visitors, prospective purchasers, employees or contractors.

We also collect and process aggregated information which is not regulated by this Notice because it does not identify you. For example, we may aggregate the Technical Data of park home owners to calculate the number of people accessing a website feature so that we can understand how it is used or improve it.

Legal bases for processing

We will collect and use your personal information where we have a legitimate business interest to do so which doesn’t significantly impact your privacy rights. Our use of your information primarily relates to our legitimate interests in operating our business.

We also collect and use your personal information to fulfil our contractual obligations to you or to others, or, where we have a legal obligation or right to do so.

In some limited circumstances we may collect and process information about you where it is in your vital interests, for example your health and wellbeing is at serious risk and we aren’t able to ask for your consent.

Sometimes, either because we’re obliged to or because we consider the processing to be intrusive, we’ll ask for your consent. In these circumstances, you’re entitled to withdraw your consent at any time, and we’ll be pleased to support you in doing this. This does not impact the lawfulness of any processing we undertook while we had your consent.

If you choose not to provide your personal information to us, we may not be able to fulfil our legal or contractual obligations which could mean that we are unable to accommodate you on our park or provide you with the goods or services you have requested.

If you have any concerns about how we collect and use your personal information you have a number of information rights which are explained in the sections below.

Who we share your information with

We will share your personal information within our group structure and with our partners and suppliers. Wherever we share your data with these types of third parties, we will make sure we have a contract with them that sets out how they should protect and use your information safely and securely, and how they should dispose or return it when the processing is finished.

We may also share personal information with third parties where it is necessary to comply with a law, regulation, legal process or enforceable governmental request.

If we are involved in a merger, acquisition or sale of assets, we will continue to ensure the confidentiality of your personal information and give you notice before your information is transferred.

Purpose limitation

We will only use your personal information for the purpose it was collected, unless we consider that we need to use it for another reason and that reason is compatible with the original purpose. If you would like an explanation with regard to the ways in which any new processing is compatible with the original purpose, please contact us.

We rely on the Legitimate Interest lawful basis for the following types of processing:

• Selling and supplying goods and services to our customers
• Sending promotional marketing communications which are tailored and relevant to our customers
• Understanding our customers’ preferences and behaviours
• Handling customer queries, complaints and disputes
• Fulfilling our duties to our employees, customers and other stakeholders
• Protecting our customers, employees and other individuals to maintain their safety, health and welfare
• Protecting Park Holidays UK Ltd., its employees and customers by taking legal action against third parties against third parties who have committed criminal acts or are in breach of their legal obligations to Park Holidays UK Ltd.
• Improving our products and services and developing new products and services
• Complying with legal and regulatory requirements
• Managing legal and insurance claims
• Handling legal or regulatory enforcement actions
• Managing corporate matters, including selling or transferring part or all of our business to third parties, acquisitions and mergers, or any other corporate restructuring activity
• Prevention, investigation and detection of crime, fraud and antisocial behaviour and the prosecution of offenders, in conjunction with law enforcement agencies

Marketing

We use your personal information to provide you with promotional messages via email, text, and other electronic means, based on your consent. We strive to provide you with choices regarding certain personal information uses, particularly around marketing and advertising. We may also use your personal information to send you and others promotional material in the post.

Opting out

You can ask us to stop sending you marketing messages at any time, by following the opt-out link we provide in all our marketing messages or contacting us at dpo@parkholidays.com

Online advertising

You may be presented with personalised advertisements for our products and services whilst using ours or other websites and social media platforms. The advertisements may relate to products you have previously viewed on our websites on your computer or other devices that we believe will be of interest to you. The advertisements are presented to you by us via specialist providers using cookies and other similar technologies placed on your device. You can disable or remove cookies at any time – see below for details. For more information on how Google uses information from sites or apps that use our services, please visit Google’s Business Data Responsibility site.

Cookies

Click on this link to understand how we use cookies and similar technologies. 

Social Media Platforms and Search Engines

When you accept cookies on our websites and you also use search engines like Google or have accounts on a Meta platform (e.g., Facebook or Instagram) or TikTok, your purchasing and browsing data will be shared with them. ‘Meta’ means Meta Platforms Inc. (a US company) and other Meta Group companies. ‘TikTok’ means TikTok Information Technologies UK Ltd. in the UK and TikTok Technology Ltd. in Ireland. ‘Google’ means Google LLC (a US company) and Google Ireland Ltd. This enables social media companies and search engines to present you with personalised advertisements relating to our products and services when you use them.

As required under data protection legislation, Park Holidays UK Ltd. has agreements in place with social media platforms which detail each party’s responsibilities and obligations. We are responsible for providing you with the information above and relevant social media platforms are responsible for enabling your rights under the UK GDPR, for the data they process.

Our relationships with social media platforms may not be limited to those explicitly referenced in this Notice and may change from time to time.

Third Party Links

This website may include links to trusted third-party websites, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their processing of your personal information. When you leave our website, we encourage you to read the Privacy Notice of every website you visit.

Mergers and Acquisitions

In the event that our business is acquired, either wholly or partly, by another business (e.g. a merger or sale) we may need to disclose your personal information to that company in order for them to continue providing services to you. Should this occur, your data will only be used by that company for the purposes set out in this Privacy Notice.

Your personal information may also be shared with another company, during preliminary discussions around a merger or acquisition of our business, prior to entering a contract. In this event, the data will be shared securely and kept confidential and deleted if the merger or acquisition does not complete.

International transfers

Sometimes we need to transfer your personal information to countries where data protection rules offer a lower level of protection than the UK. If we need to do this, we will always put in place a contract which holds third parties accountable for looking after your information to a standard which aligns with the data protection laws of the UK. If you would like to know more about the safeguards we apply when transferring personal data internationally, you can find further information here.

We have a contract with our parent company, Sun Communities, Inc, which allows us to transfer personal information to them on the condition that they look after and use it in a manner that complies with UK data protection laws.

How we protect your information

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed. In addition, we limit access to your personal information to only those employees, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions, and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal information breach and will notify you and any applicable regulator of a breach, where we are legally required to do so. Examples of the measures we take to protect your data include:

• Encryption of data
• Security measures that protect and monitor our IT systems to protect from external attack and unauthorised access
• Regular penetration testing of our systems
• Information security assessments of third parties we share your data with
• Internal policies and regular staff training relating to data protection

Measures you can take to protect your data

We will never ask you to confirm your bank or credit card details via email or text. If you receive such a request, please ignore it, and do not respond.

When accessing your account in a public location, we recommend you log out and close your browser when you have finished.

We recommend that you keep your account and password details private and do not share them. It is also recommended that when setting passwords, you use at least 8 characters and a mixture of letters and numbers. You should make your password hard to guess, not use the same password for different online accounts and consider changing it regularly.

Data retention

Except in the case of legal proceedings or a dispute, all of the personal information we collect is subject to the rules contained in our retention policy. We have a retention schedule which sets out the minimum timeframe personal information should be held for to meet our legitimate business interests, contractual and/or legal rights or obligations. When those minimum timeframes have expired your personal data is securely disposed of.

Your information rights

1. Access – you are entitled to ask us what personal information we hold about you and ask us for a copy of it which we will provide to you free of charge.
2. Rectification – if you believe any of the personal information we hold about you is inaccurate you can ask us to update it.
3. Erasure – you can ask us to dispose of the personal information we hold about you and we will always consider your request, although in some circumstances we may not be able to dispose of your information if we have conflicting interests or obligations.
4. Restriction – you can ask us to restrict the processing of the personal information we hold about you and we will always consider your request, however we may not always be able to do this where we have conflicting interests or obligations.
5. Withdrawing consent – if we have previously asked you to consent to us processing your personal information you may withdraw that consent at any time and we will stop processing your information.
6. Portability – if we are processing your personal information using automated means, you may be able to ask us to transfer it to another organisation on your behalf.
7. General objections – you may be able to object to us processing your personal information where we do not have a contractual or legal obligation or right to do so and we will always consider your request.
8. Objections to marketing – we will always stop sending you marketing which is addressed to you personally if you ask us to.
9. Automated decision making – we do not make legal or otherwise significant decisions about you using solely automated means but some of our partners may do. For example, finance partners may make automated decisions in respect of a finance application you have submitted to them. You should consult the privacy notice(s) of those third-parties if you have concerns or questions about how they process your personal information.

We endeavour to respond to all legitimate requests within the required one calendar month timeframe. If your request is particularly complex or you have made a number of requests, we may need to extend the response window by up to a further two calendar months. In this case, we will notify you and keep you updated.

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information (or to exercise any of your other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

How to contact us or make a complaint

Our Data Protection Officer helps ensure we protect the personal information we process and that we comply with data protection legislation. If you have any questions about this Privacy Notice or our privacy practices, please contact our Data Protection Officer at dpo@parkholidays.com. You also have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the opportunity to deal with your concerns before you approach the ICO, so please contact us in the first instance.

Changes to this Privacy Policy

We reserve the right to amend or modify this Privacy Policy at any time and any changes will be published on our website. The date of the most recent revision will appear on this web page. If we make significant changes to this policy, we may also notify you by other means such as sending an email. Where required by law we will obtain your consent to make these changes. If you do not agree with any changes, please do not continue to use our website and let us know that you wish to have your personal data deleted.