Privacy Policy

1. Who we are

Holders Retreat is operated by Jason O’Bryan & Tira Baillie. We are responsible for deciding how guest information is used for our enquiries and direct bookings.

For privacy questions or requests, contact bookings@holdersretreatbarbados.com or write to 3 John’s Plain, Holders, St. James, Barbados, our business correspondence address.

2. Information involved in enquiries and bookings

Our stay enquiry form asks for your name, email address, preferred apartment, arrival and departure dates, number of guests and message. Telephone number and country are optional. The number of nights is calculated from the dates you enter. Concierge enquiries also include the services you select and your arrangements or requests.

When you contact us by email, telephone or WhatsApp, we receive the information you choose to provide. Booking correspondence may include your agreed dates, party details, quotation, special requests, confirmation and subsequent changes. Please only supply details about other guests where you are authorised to do so and make this notice available to them.

We accept payment by bank transfer, not card. Payment records may include the payer’s name, transaction reference, amount, date and information needed for an agreed refund. Please do not send card details or banking passwords.

Please avoid sending sensitive personal information or identity documents unless we have explained why they are needed and how to provide them appropriately. If an accessibility request involves health information, we will agree how to handle that information before requesting it.

Online enquiries:when online delivery is enabled, submitted details pass through Cloudflare and Resend to our Google Workspace bookings mailbox. We do not store enquiry contents in the website’s content database. Private saved previews show an enquiry summary without sending it; the separate private delivery-test form is clearly labelled and does send a test email.

3. Why we use information

We use enquiry and booking information to provide quotations, arrange accommodation, communicate about your stay and process payments or refunds. We use this information to take steps at your request before a contract and to perform our booking contract.

Record-keeping required by law relies on legal obligations. Proportionate fraud prevention, complaint handling and protection of legal claims may rely on legitimate interests, balanced against your rights. Where we rely on consent, you can withdraw it without affecting earlier lawful use.

Without the details necessary to arrange a stay, we may be unable to provide a quotation or confirm a booking. Optional fields can be left blank.

4. Website, email and other service providers

We use Google Workspace for our business email, including bookings@holdersretreatbarbados.com. Enquiries and booking correspondence sent to that mailbox are processed through that service. Google’s Cloud Data Processing Addendum describes its role in processing customer personal data for Workspace customers. Resend delivers website enquiry emails to this mailbox and processes the message contents, email addresses and delivery records. On our current plan, Resend retains email and log data for 30 days; copies received in our mailbox follow the retention periods below. Cloudflare hosts the website, processes form submissions and provides security checks.

Information may also need to be provided to our bank to administer transfers and refunds, and to professional advisers or authorities where necessary for accounting, legal obligations or a dispute. We share only the information needed for those purposes. Where someone helps arrange your arrival or provide an agreed service, we will give them only the relevant guest details. Service providers handling data on our instructions must be subject to appropriate confidentiality and data-protection arrangements.

If you contact us through WhatsApp, or book through Airbnb, Vrbo or Booking.com, that provider also handles information under its own privacy terms. Our website’s Instagram and Google Maps links take you to separate services; their notices apply when you use them.

5. Processing outside Barbados

Cloudflare, Resend and Google provide services using infrastructure and subprocessors outside Barbados. Website connection information, security signals and enquiry correspondence may therefore be processed overseas. We do not promise that this information remains in Barbados.

We will assess overseas processing arrangements and use an applicable lawful transfer mechanism and appropriate safeguards where required. Google’s processing arrangements are described in its Cloud Data Processing Addendum. You can contact us for information about the safeguards applicable to your information, including how to obtain a copy where available. We will update this notice as additional providers are introduced.

6. How long information is kept

Enquiries that do not become bookings: we will delete the correspondence 12 months after the last contact, unless it is still needed for an unresolved complaint, dispute or legal obligation.

Essential booking and payment records: our standard retention review point is seven years after the end of the calendar year in which the stay ended or the booking was cancelled. We retain the necessary reservation, quotation, confirmation, invoice, payment and refund records for accounting, tax and potential claims. At that point we will delete or anonymise them unless a continuing legal requirement, authority instruction or unresolved matter requires longer retention. Any required permission to destroy tax records must first be obtained.

Routine stay arrangements and special requests: we will delete information that is no longer needed within 12 months after departure. Only information necessary to explain the agreed booking, a transaction or an unresolved matter is kept with the longer-lived booking record. We will not keep unnecessary health information or identity-document copies as part of a general booking archive.

Disputes and legal holds: relevant information may be kept until the matter and any applicable appeal or claim period have ended. We will then review it for deletion rather than restarting retention for unrelated records.

We will review records at least annually and apply deletion to copies under our control, including email, exported files and business WhatsApp conversations. Deleted information may remain temporarily in a provider’s restricted backup or recovery system until it is removed under that provider’s deletion process. We will not use recovery copies for routine business purposes.

7. Website technology and security

Cloudflare hosts our website and processes connection information, including IP addresses, requested pages and browser details, to deliver and protect it. Cloudflare Web Analytics measures page visits and website performance without analytics cookies or tracking individual visitors across websites. We do not use advertising trackers. Photographs, videos and fonts are served with the website.

Our enquiry forms use Cloudflare Turnstile to distinguish visitors from automated spam. It processes IP addresses and technical browser signals; Cloudflare also uses these signals to improve bot detection, as explained at https://www.cloudflare.com/turnstile-privacy-policy/. Our website stores submission counts and a hashed identifier derived from the IP address for abuse prevention, rather than enquiry contents. These counters are marked to expire within 35 days and are removed during subsequent successful-submission cleanup. Security and private-editor sign-in may use necessary cookies; the editor also stores its owner’s working draft in that browser. We do not store guest enquiry contents in browser storage. If a security check prevents you from submitting an enquiry, email bookings@holdersretreatbarbados.com directly.

Our security policy is to limit access to Jason and Tira and authorised people who need information to provide the agreed service. It requires individual secured accounts, two-step verification for the business mailbox, updated devices and protection against unauthorised access. We will investigate suspected data breaches and notify affected people and regulators where required. No method of storage or transmission is completely risk-free.

8. Your rights and complaints

Subject to applicable conditions, you may request access, correction, erasure, restriction or portability of your data, and object to certain uses, including direct marketing. Contact the email above; we may need to verify your identity. We will respond within applicable legal time limits and explain any lawful restriction.

You may also complain directly to the Barbados Data Protection Commission, whether or not you have first contacted us.

9. Marketing and automated decisions

Our policy is not to sell or rent guest information or provide it to others for their own marketing. Enquiring or booking will not automatically subscribe you to promotional messages. If we introduce a newsletter, we will invite you to opt in separately and provide an unsubscribe option. Booking-related messages are separate from marketing.

The current website does not use profiling or automated decisions to accept or reject bookings. Direct bookings are confirmed by us by email.

The enquiry service is intended for adults arranging a stay. A parent, guardian or authorised lead guest should supply only the child guest details needed for the booking; children should not submit enquiries independently.

10. Changes to this policy

We will update this notice when our arrangements change and show the revised date. Material changes affecting how we use existing guest information will be communicated where required.