Shaz Does Holidays
The short version
- Your trips, bookings and settings are kept on your own device. We can't see them unless you turn on sync.
- We only collect your email address if you give it to us: through the contact form, the launch list, or when we set you up with an access code for deal alerts.
- We only send news and offers if you've agreed, and every tips or offers email has a one-click unsubscribe link.
- We don't sell your information. We only use advertising cookies (the Meta and TikTok pixels, for our adverts on Facebook, Instagram and TikTok) if you click Accept in our cookie banner, and we never give Meta or TikTok your name or email address.
- You can ask us to show you, correct or delete your information at any time. Just email hello@shazdoesholidays.com.
1. Who we are
Shaz Does Holidays is the brand name of SDHOLIDAYS LTD, company number 17503279 ("we", "us"). We run this website and the holiday planner at shazdoesholidays.com. For data protection law we are the "controller" of the personal information described in this policy.
We are registered with the Information Commissioner's Office (ICO) as a data controller, registration number ZC270216.
You can contact us at hello@shazdoesholidays.com.
2. What we collect, why, and for how long
"Lawful basis" is the reason the law allows us to use your information.
| What | Where it is kept | Why, and our lawful basis | How long |
|---|---|---|---|
| Your planner information Trips, places, dates, budgets, bookings, activities, notes, spending and checklists you enter. | On your own device, in your browser. We don't receive it. | So the planner works for you. This stays on your device, so we don't hold it. | Until you delete it or clear your browser data. |
| My Account details Your first name, photo, email address (optional), home airport and travel preferences. | On your own device. If you turn on sync, also in our online storage (see next row). | To personalise the planner. Basis: providing the service you asked for. | Until you remove it or ask us to delete it. |
| Sync information If you turn on sync: your trips, places and My Account details, saved online under a private sync code. There is no username or password. | Our hosting provider's secure storage (Netlify). | So your trips appear on all your devices. Basis: providing the service you asked for. | Until you ask us to delete it. Stopping sync on a device doesn't delete the online copy, so email us your sync code and we will. |
| Contact messages Your name, email address, the topic and your message. | Netlify Forms, then emailed to our inbox. | To reply to you. Basis: our legitimate interest in answering questions. | Up to 12 months after we last wrote to you, unless the law requires us to keep it longer. |
| Tester feedback If you help us test the site: your scores and comments, which devices you used, and, only if you choose to give them, your first name and email address. | Netlify Forms, then our hosting provider's secure storage (Netlify) and emailed to our inbox. | To improve the site, and to follow up on your answers if you said we could. Basis: our legitimate interest in improving the service. We don't add you to any email list. | Up to 12 months after testing ends. Ask us to delete it at any time. |
| Launch list Your email address, which plan you are interested in, and a record that you agreed. | Netlify Forms, and your email contact record (below). | To tell you when paid plans open, with a short "you're on the list" email and one tip while you wait. Basis: your consent, which you can withdraw at any time. | Until you ask us to remove you. We review the list at least once a year. |
| Deal alerts and access codes Your email address, your alert settings (such as destinations, dates and price limit), your plan and when it ends. For each access code we also keep a few random device ids with a plain label such as "Chrome on Windows", so a code can only be used on a small number of devices. These ids don't identify you personally. | Our hosting provider's secure storage (Netlify). | To send the alerts you set up. Basis: providing the service you asked for. | While your alert or access code is active, and up to 12 months after. |
| Holiday Points If you are a Deal Club member: your referral code, your points and what you earned them for, and any gift cards you ask for. When someone joins with your link we record that they came from you; you see only a shortened version of their email address (for example "j***@g***"). If you join or sign up with a friend's link, we record which member's link you used, so they can be rewarded. | Our hosting provider's secure storage (Netlify). A friend's referral code is also remembered on your own device for 60 days (see our cookie policy). | To run the Holiday Points scheme you or your friend chose to take part in. Basis: providing the service you asked for (for members), and our legitimate interest in rewarding the member who recommended us (for the friend). We don't sell or share this information, and gift card codes are only sent to you. | While you are a member and up to 24 months after your last points activity. |
| Your email contact record If you join the launch list, are given an access code or contact us: your email address, first name if you gave it, your plan, your email choices (tips, news and offers) and when you agreed, which emails we've sent you and whether they were delivered, opened or clicked, and a short history of what you've done that affects which emails you get (for example joining the launch list, saving a deal alert, starting a trip or adding a booking). Trip details are limited to the destination and start date. | Our hosting provider's secure storage (Netlify). | To send you the right emails and not the wrong ones, for example skipping a "plan your first trip" tip once you've done it. Basis: providing the service you asked for (account and how-to emails), and your consent for news and offers. | While you use the site or stay on our list, and up to 12 months after our last contact. Ask us to delete it at any time. |
| Emails we send you Deal alerts you set up; account emails (such as a welcome and a notice before an annual plan renews); a few tips in your first weeks; and, only if you agreed, news and offers. | Sent through Resend, our email provider, which tells us if an email bounces, is marked as spam, is opened or a link is clicked. | Account emails and deal alerts: providing the service you asked for. Tips: our legitimate interest in helping you use the planner. News and offers: your consent. Every tips or offers email has a link to change your choices or unsubscribe in one click, and every deal alert has a link to stop it. | Resend keeps delivery records for a short time. Our own record of what we sent is part of your email contact record. |
| Technical information Your IP address, device and browser type, and the pages and files requested. | Server logs kept by our hosting provider (Netlify). | To keep the site secure and working. Basis: our legitimate interest in running a safe service. | For the short period set by our hosting provider. |
| Your searches Places, dates and destinations you search for. | Sent to our servers to get results from the travel data services in section 3. We don't link them to you. On the UK weekend breaks page we also count how many times the page is opened, places are searched and links are tapped, with the place name only: no cookie, IP address or anything that identifies you is kept with the count. | To show you places, fares, hotels, tours and routes. To show "today's deals" from the right place, the site also uses the home airport you set in My Account (read from your own device) or, if you haven't set one, the country your connection comes from. Basis: providing the service you asked for. | We don't keep them. Some general results (for example popular fares) are stored briefly so the site is quicker. |
We don't ask for payment card details. When paid plans open, payments will be handled by a payment provider such as Stripe. We will not see or store your card number, and we will update this policy before then.
3. Who we share information with
We never sell your personal information. We use these providers to run the service:
- Netlify hosts the website, handles our forms and stores sync and alert information.
- Resend sends our emails.
- Stripe takes card payments for the Deal Club. When you pay, you are on Stripe's secure page: we never see or store your card details. Stripe tells us your email address and that the payment worked, so we can email you your access code, keep it working while you are a member and end it if you cancel. When the Deal Club opens, we also ask Stripe to make a personal launch-list code for each person on the launch list, labelled with our internal reference for you (not your name or email address). Stripe's own privacy policy applies to what it holds.
- Build my trip (Deal Club members): when you tap Build my trip, the place, dates, number of travellers and the names of the hotels, tours, sights and restaurants we found are sent to Anthropic (the company behind the Claude AI), which writes the day-by-day plan. Your name, email address and access code are never sent. Anthropic doesn't use this to train its AI.
- Travel data services answer your searches. When you search, they receive the place names, dates and similar details you typed, but not your name or email address. These include Travelpayouts and Aviasales (flights and airports), trivago (hotels), Civitatis (tours and activities), Wikipedia (places to see), Open-Meteo (weather and place names), OpenStreetMap-based services (place names, driving routes, and finding the hotels and places in your trip log on your map: we send them the place name and town only; and restaurants and theatres near your destination: we send the position of the town only), postcodes.io (UK postcodes) and Frankfurter (exchange rates).
- Professional advisers and authorities, if we need their help or the law requires us to share information.
Some things happen directly between your browser and other companies:
- Google Fonts supplies our typefaces. Google can see your IP address and browser details when a page loads.
- Aviasales supplies airline logos, and Cloudflare supplies the code for QR codes when you use sync. They can see your IP address when you load them.
- OpenFreeMap supplies the map tiles, and Cloudflare the map code, when you open "See your trip on a map" in your trip log. Nothing is loaded from them until you open the map. They can see your IP address and which part of the map you are looking at, but not your name or bookings. The map uses OpenStreetMap data.
- Hotel and tour photos in your results are loaded straight from the services that supplied them, which can see your IP address when they do.
- Booking and travel websites such as Booking.com, Expedia, LateRooms, Lovetovisit, Skyscanner, airlines, GetYourGuide and Viator. When you click a link you leave our site and their own privacy policies apply. Some links are affiliate links. We may earn a small commission, and we usually receive details of bookings made through them (such as date and value) but not your name or contact details.
- Our social media pages on Facebook, Instagram and TikTok. The icons on our site are plain links: they load no scripts, buttons or trackers from those companies. If you click one you leave our site, and the company's own privacy policy and cookies apply.
- Meta Platforms Ireland Ltd (Facebook and Instagram), only if you choose Accept in our cookie banner. The Meta pixel tells Meta which pages of our website you visit and when you join the Deal Club launch list, together with technical details such as your IP address, browser and the Meta cookies on your device. We use this to see whether our adverts work and to show them to people likely to be interested. We never send Meta your name or email address. Basis: your consent, which you can withdraw at any time from Cookie settings at the bottom of every page. Meta and we are joint controllers for collecting this information; Meta then uses it under its own privacy policy. See our cookie policy.
- TikTok, only if you choose Accept in our cookie banner. The TikTok pixel tells TikTok which pages of our website you visit and when you join the Deal Club launch list, together with technical details such as your IP address, browser and the TikTok cookies on your device. We use this to see whether our TikTok adverts work and to show them to people likely to be interested. We never send TikTok your name or email address. Basis: your consent, which you can withdraw at any time from Cookie settings at the bottom of every page. TikTok then uses it under its own privacy policy. See our cookie policy.
4. Sending information outside the UK
Some of the providers above are based in, or use servers in, the United States or other countries. Where your information leaves the UK, we use providers that protect it with the safeguards UK law requires, such as the UK–US data bridge or the UK International Data Transfer Addendum.
5. Your rights
Under UK data protection law you have the right to:
- ask for a copy of the information we hold about you;
- ask us to correct anything that is wrong;
- ask us to delete your information;
- ask us to limit how we use it, or object to how we use it;
- ask for your information in a form you can move elsewhere;
- withdraw your consent at any time, where we rely on it (for example the launch list and the optional tracking script).
To use any of these rights, email hello@shazdoesholidays.com. We aim to reply within one month. We may need to check who you are first. It's free, unless a request is clearly unfounded or excessive.
You can also do some of this yourself in My Account: Back up everything gives you a copy of your trips, places and settings, and Delete everything on this device removes them from your device.
If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.
6. Keeping your information safe
Our site uses an encrypted (HTTPS) connection, and access to the information we hold online is limited to the people who need it. Your sync code is like a key: anyone who has it can see and change your saved trips, so keep it private. No online service can be completely secure, but we take reasonable steps to protect your information.
7. Children
Shaz Does Holidays is for adults planning holidays. It isn't aimed at children, and we don't knowingly collect information from anyone under 18.
8. Changes to this policy
We may update this policy from time to time. The date at the top shows when it last changed. If we make a big change, such as using your information in a new way, we will tell you before it takes effect.
9. Contact us
Questions about this policy or your information? Email hello@shazdoesholidays.com. You may also like to read our cookie policy and terms and conditions.