Legal
Privacy Policy
Last updated: 27 April 2026
This Privacy Policy explains how Holiday Homes ("we", "us") collects, uses and protects your personal data when you use our platform. We comply with the EU General Data Protection Regulation (GDPR) and Swedish data protection law.
1. Data controller
Holiday Homes is the data controller for personal data collected through this platform. Contact: admin@holidayhomes.top.
2. What we collect
- Account data: name, email, password (hashed with bcrypt), account type, signup date.
- Company data: company name, VAT number, country (validated against the EU VIES service).
- Listing data: property descriptions, photos, videos, pricing, availability uploaded by hosts.
- Booking data: dates, guest count, total price, status; messages between hosts and guests.
- Identity verification data: ID document photo, selfie, document type and country (only if you submit a manual verification).
- Payment data: processed by Stripe — we receive only customer ID, subscription status and invoice metadata, never card numbers.
- Technical data: IP address, browser, device, and basic usage logs needed to deliver the service and prevent abuse.
3. Why we process it (legal basis)
| Purpose | Legal basis |
|---|---|
| Account creation, login, providing the platform | Contract (Art. 6(1)(b)) |
| Subscriptions, payments, invoices | Contract + legal obligation |
| VAT validation via EU VIES | Legal obligation (tax law) |
| Identity verification | Legitimate interest (fraud prevention) + consent (you submit voluntarily) |
| Booking notifications & transactional emails | Contract |
| Security, abuse prevention, fraud detection | Legitimate interest |
| Analytics & non-essential cookies | Consent (Art. 6(1)(a)) |
4. Who we share it with
We share personal data only with the processors needed to run the platform, all bound by data processing agreements compliant with GDPR:
- Stripe (Ireland / USA) — payments & subscriptions.
- SendGrid (Twilio) (USA) — transactional email delivery. Data is encrypted in transit; standard contractual clauses apply.
- EU VIES (European Commission) — public VAT validation only; no personal data is shared.
- Cloud infrastructure — for hosting the application and storing media (encrypted at rest).
We never sell or rent your personal data.
5. International transfers
Some of our processors operate outside the EU/EEA (e.g. Stripe, SendGrid). We rely on the European Commission's Standard Contractual Clauses (SCCs) and additional safeguards.
6. How long we keep it
- Account & profile data: as long as your account is active, plus 36 months for legal records.
- Booking & payment records: 7 years (Swedish bookkeeping law).
- Identity verification documents: while your account is active, plus 36 months.
- Logs: 12 months.
7. Your rights (GDPR)
You have the right to:
- Access the personal data we hold about you.
- Correct inaccurate data.
- Erasure (where law allows — booking and payment records have a 7-year retention).
- Restrict or object to processing.
- Data portability — receive your data in machine-readable format.
- Withdraw consent at any time (without affecting prior lawful processing).
- Lodge a complaint with the Swedish data protection authority (Integritetsskyddsmyndigheten — IMY).
To exercise any right, email support@holidayhomes.top. We will respond within 30 days.
8. Security
We take technical and organisational measures appropriate to the risk: encrypted transport (HTTPS), bcrypt password hashing, access controls on private files (your ID and selfie are accessible only to you and to verified admins), and event logging.
9. Children
The platform is not directed at children under 18. We do not knowingly collect personal data from minors. If you believe a minor has registered, please contact us so we can remove the account.
10. Changes to this notice
Material changes will be notified by email at least 14 days in advance. The "last updated" date at the top of this page reflects the most recent revision.