Last updated: September 2026
Coast Properties ("we", "us" or "our") is a self-catering holiday let agency operating across East Lothian and Edinburgh. We are committed to protecting your privacy and handling your personal data in an open, honest and lawful way, in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are the data controller for the personal data we collect through our website, by phone, by email and in the course of managing your booking.
1. Information we collect
We only collect the personal data we need to answer your enquiry, manage your booking and provide our service. This may include:
- Your name and the names of others in your party
- Your email address, postal address and telephone number
- Your enquiry and booking details, including the property, dates of stay, number of guests and any special requirements or requests
- Correspondence between you and us, including emails, messages and call notes
- Limited information relating to your payment, such as confirmation that a payment has been made and the amount. Your full card details are collected and processed by our payment provider and are not stored on our servers.
2. Why we use your data and our lawful basis
Under UK GDPR we must have a lawful basis for processing your personal data. We rely on the following:
- To perform our contract with you (Article 6(1)(b)). To process your booking, take payment, arrange your arrival, keys and stay, and respond to your enquiries and requests.
- To meet our legal obligations (Article 6(1)(c)). To keep the financial, accounting and tax records that the law requires us to hold.
- For our legitimate interests (Article 6(1)(f)). To administer our business, keep our records accurate, prevent fraud, improve our service and, where appropriate, contact you about a stay you have booked. We balance these interests against your rights.
- With your consent (Article 6(1)(a)). For optional marketing communications and for any non-essential cookies. You can withdraw your consent at any time.
3. Who we share your data with
We do not sell your personal data. We only share it where it is necessary to provide our service, and always with appropriate safeguards in place. This may include:
- Payment processor. Our secure payment provider processes card payments on our behalf. We do not store your full card details.
- Property owners and property managers. Where needed to prepare for and manage your stay, we may share relevant booking details, such as your name, dates and party size, with the owner of the home you have booked and the local team caring for it.
- Channel and OTA partners. If your booking originated through a booking channel or online travel agent, we may exchange the booking details required to confirm and manage your reservation.
- Booking and hosting providers. The providers of our booking system and website hosting process data on our behalf under written agreements.
- Professional advisers and authorities. Our accountants, and public authorities or law enforcement, where we are legally required to disclose information.
All of our processors are contractually required to keep your data secure and to use it only for the purposes we specify. Where any provider processes data outside the UK, we ensure appropriate safeguards, such as UK adequacy decisions or standard contractual clauses, are in place.
4. Cookies
Our website uses cookies and similar technologies. Essential cookies are needed for the website and booking process to work, including session management and secure payment. With your consent, we may also use analytics cookies to understand how our site is used so we can improve it. You can accept or decline non-essential cookies when you first visit the site, and change your choice at any time through your browser settings.
5. How long we keep your data
We keep your personal data only for as long as we need it for the purposes described above:
- Booking and transaction records are retained for up to seven years after your stay, to meet our financial, accounting and tax obligations.
- Enquiries that do not lead to a booking are kept for a short period and then deleted.
- Marketing data is kept until you unsubscribe or withdraw your consent, or after a period of inactivity.
6. How we keep your data secure
We use appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, misuse or disclosure. Access is limited to those who need it to do their job, and payment card processing is handled by our secure payment provider.
7. Your rights
Under UK data protection law you have the following rights in relation to your personal data:
- The right to be informed about how we use your data, as set out in this policy.
- The right of access to a copy of the personal data we hold about you.
- The right to rectification of any inaccurate or incomplete data.
- The right to erasure of your data in certain circumstances.
- The right to restrict processing of your data in certain circumstances.
- The right to object to processing based on our legitimate interests, and to direct marketing at any time.
- The right to data portability, to receive your data in a structured, commonly used, machine-readable format.
- Rights in relation to automated decision-making and profiling. We do not make decisions about you based solely on automated processing.
You will not usually have to pay a charge to exercise your rights, and we will respond within one month. To make a request, please contact us using the details below.
8. How to complain
If you have any concerns about how we handle your personal data, please contact us first and we will do our best to put things right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection, at ico.org.uk or on 0303 123 1113.
9. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices or the law. Any changes will be posted on this page with a revised "last updated" date.
10. How to contact us