Privacy Policy

Last updated: 7 October 2026

This notice explains what personal information Blue Puffin Stays collects when you book a stay with us, contact us or use our website, why we collect it, who we share it with and the choices you have. We have written it to be read, so please get in touch if anything is unclear.

1. Who we are
2. What we collect
3. How we use it and why
4. ID checks before your stay
5. Doorbell cameras
6. Who we share it with
7. Transfers outside the UK
8. How long we keep it
9. Marketing emails
10. Cookies
11. Your rights
12. Keeping it safe
13. Changes and complaints

1. Who we are

Blue Puffin Stays Ltd is the controller of your personal information. That means we decide how and why it is used, and we are responsible for looking after it.

We are not required to appoint a Data Protection Officer. For any privacy question or request, contact us using the details above.

2. What we collect

When you book or stay with us

• Your name, email address, phone number and, where needed for an invoice, your postal or company address.
• Details of your booking: the property, dates, number of adults, children and pets, the price, and any special requests.
• Messages between you and our team, by email, phone, text, WhatsApp or through a booking platform.
• Payment details. Card payments are taken by our payment providers; we do not see or store your full card number.
• Identity check details and a risk result (see section 4).
• Short video and sound clips from the doorbell camera at the entrance of most of our homes (see section 5).
• For business bookings, the company’s details and the names of the people staying.
• For longer stays, a signed copy of our booking terms, including your name, signature and the date you signed.
• Feedback and reviews you give us, and details of any damage, complaint or incident during a stay.

When someone else books for you

If your employer, a relocation or accommodation agent, an insurer or a booking platform such as Airbnb, Booking.com or Vrbo makes the booking, they pass us the details we need to host you, usually your name, dates, number of guests and sometimes your contact details. Those platforms and companies have their own privacy notices for the information they hold.

When you contact us or join our mailing list

• The name, email address, phone number and message you send through our contact form, by email or by phone.
• Your email address if you join our VIP mailing list.

When you use our website

• With your consent, information about how you use the site, collected by analytics cookies (see section 10).
• Technical information such as your IP address and browser, used to keep the site secure and to stop spam on our forms.

3. How we use it and why

Data protection law only lets us use personal information when we have a lawful reason. The table sets out what we do and the reason we rely on.

Where we rely on legitimate interests, we have weighed those interests against your rights and you can ask us for more detail. We do not sell your personal information.

4. ID checks before your stay

To keep our guests and homes safe, the lead guest verifies their identity before arrival. This applies however you booked. Our verification partner, SafeGuest, runs the check. It usually involves confirming your contact details and taking a photo of an identity document and of yourself, so the two can be matched. For direct bookings, the check also confirms the lead guest is 21 or over.

The photo match uses your facial features. SafeGuest carries out that part, explains how it handles the images, and asks for your consent before the check starts.

You don’t have to use the photo match. If you can’t use it or would rather not, contact us and we’ll arrange another secure check, such as a short video call where you show your photo ID to a member of our team. Please don’t send ID documents by email.

SafeGuest gives us the result and a risk rating. The rating is for our information only. It never cancels or changes your booking on its own, and no decision about you is made automatically. If something needs checking, a member of our team will contact you. We send the access details for the home once verification is complete.

5. Doorbell cameras

Most of our homes have a doorbell camera covering the front door or entrance. When it’s triggered, for example by movement or someone ringing the bell, it records a short clip with video and sound. There are no cameras inside any of our homes. No camera covers a hot tub, outdoor shower or other bathing area, or points into a neighbour’s home. The booking page for each home says which devices it has.

We use the clips only to keep the entrance secure, to check that the number of people arriving matches the booking, and as evidence if there’s a dispute about damage, extra guests or a serious breach of our booking terms.

The cameras are on our own accounts. Only our team can view the clips; property owners can’t. Clips delete automatically after 3 days. If we need to keep one for an incident, a claim or the police, we keep that clip only until the matter is resolved. We may share a clip with the police or our insurers where the law allows. To ask for a copy of a clip that shows you, email info@bluepuffinstays.co.uk.

6. Who we share it with

We share only what each organisation needs, and the companies that work on our behalf may only use your information to provide their service to us.

• Our booking and property management system (Guesty), which holds reservations and guest messages and connects our website and booking platforms.
• Payment providers (including Stripe), which process card payments, deposits and refunds.
• Our identity verification partner (SafeGuest).
• The provider of our doorbell cameras, which stores the clips for us until they’re deleted.
• Email, office and website services, including Google (email, documents and website analytics), our website host, and Mailchimp for marketing emails.
• Business tools we use to run our operations, including Airtable and our accounting software, Xero.
• Our team, including self-employed team members based in the Philippines who help with guest messages, bookings and administration. They can see only what they need to do that work.
• People who help deliver your stay, such as cleaning, maintenance and property partners. They receive only what they need: for example, property partners see the lead guest’s name and the dates of the stay, but not your contact or payment details.
• Booking platforms, agents and employers involved in your booking, for example to confirm or change a reservation.
• Our professional advisers and insurers, where needed to deal with a claim or dispute.
• The police, local authorities, courts or regulators, where the law requires it or where it is needed to prevent crime or protect someone’s safety.

7. Transfers outside the UK

Some of our service providers store or access information outside the UK, including in the European Economic Area, the United States and Israel. Some of our team members work from the Philippines. When information goes outside the UK, we make sure it’s protected. For example, the country may have been approved by the UK government as providing adequate protection, the provider may be certified under the UK Extension to the EU-US Data Privacy Framework, or we have the UK’s approved contract terms in place. Contact us if you’d like more information.

8. How long we keep it

• Booking, payment and invoice records: 6 years after the end of the financial year the stay falls in, as required for tax and accounting.
• ID check results: deleted within 3 months of your stay.
• Doorbell camera clips: 3 days, unless we need to keep a clip for an incident, a claim or the police.
• Enquiries that don’t lead to a booking: up to 2 years.
• Mailing list: until you unsubscribe. We then keep your email address on a suppression list so we don’t contact you again.
• Records of damage, complaints or claims: for as long as needed to resolve them and for the period in which a legal claim could be brought.

9. Marketing emails

We send offers and news only to people who have joined our mailing list, or to guests who have booked with us and did not opt out when they booked. Every marketing email has an unsubscribe link, and you can also email info@bluepuffinstays.co.uk at any time. Opting out of marketing does not affect messages about a booking you have made.

10. Cookies

We use cookies that are needed for the website to work, and, only if you agree, analytics cookies that help us understand how the site is used. You can change your choice at any time. Our Cookie Policy lists the cookies we use.

11. Your rights

You have the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct information that is wrong or incomplete;
• ask us to delete your information, where we no longer need it;
• ask us to restrict how we use it, or object to our use of it, including an absolute right to object to marketing;
• ask for information you gave us to be sent to you or another organisation in a portable format;
• withdraw your consent at any time, where we rely on consent.

To use any of these rights, contact us. We will reply within one month. There is usually no charge. Some rights have limits; for example, we must keep booking and payment records for tax purposes.

12. Keeping it safe

We limit access to personal information to the people who need it, use secure, access-controlled systems, and choose service providers that protect information to UK standards. If something goes wrong that puts your information at risk, we will tell you and the Information Commissioner’s Office where the law requires it.

Our bookings are made by adults. We do not knowingly collect information from children other than the names or ages of children included in a booking by the lead guest.

13. Changes and complaints

We may update this notice from time to time. The date at the top shows when it last changed.

If you’re unhappy with how we’ve handled your information, please tell us first so we can put it right. Email info@bluepuffinstays.co.uk, or use the form on our Contact page and choose “Data or privacy request”. We’ll acknowledge your complaint within 2 working days, look into it without undue delay, and tell you the outcome.

You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113.