Privacy Policy

Holiday Puffin is the data controller for the personal data described here. For any privacy question or to exercise your rights, contact holidaypuffin@gmail.com.

Newsletter subscribers. If you sign up for Puffin Picks, our deals email, we store your email address, and optionally a name, your preferred departure airports, destinations, deal types and a maximum budget. We record which page you signed up from, and whether you have confirmed your subscription.

Fare Watch. If you watch a school break we also store the departure airport, the break, the destination if you chose one, and how many adults and children to price for (numbers only, no names or ages). We keep a record of the Fare Watch emails we send you, so we never send the same alert twice.

Trip requests. If you ask us to match you with a travel agent we store your name, email, phone number, county, how and when you prefer to be contacted, and the trip you describe (destination, dates and how flexible they are, party size and children's ages, budget, preferences, the kind of holiday you like, what matters most to you, how soon you want to book, holidays you've enjoyed, and any notes). We also store the consent you gave, when you confirmed your email, and a keyed hash of your IP address so we can limit abuse.

Travel agents. If you apply to receive trip requests we store your agency, contact details, CAR licence number, the areas you cover, your credit balance and payments, and the requests you claim.

Account holders. If you create an account we store the details needed to sign you in, and the deals you save.

Advertisers. If you buy a listing we store the listing details you provide, including any contact email or phone number you choose to show on it, and the photo you upload. If you take out a membership we also store your Stripe customer and subscription references and your remaining listings. Card payments are handled entirely by Stripe — we never see or store your card number.

Deal statistics. We count how many times each deal is viewed and clicked. This is a counter on the deal, not on you: no identifier, cookie or IP address is stored against it, and it cannot be traced back to a person.

Server logs. Our hosting provider processes standard request data, including IP address, for security and reliability.

Visitor statistics. We use Vercel Web Analytics to count visits. For each page view it records the page address, the site you came from, your approximate location, and your browser, operating system and device type. It sets no cookies and stores nothing in your browser. Visitors are counted with a hash of the request that resets every 24 hours, so you cannot be followed from one day to the next or across other websites, and the statistics are not tied to your IP address. We see only totals.

There is no Google Analytics, no Meta pixel and no session recording on this site.

• Sending deal emails — your consent, given when you subscribe and confirm. You can withdraw it at any time via the unsubscribe link in any email.
• Passing a trip request to a travel agent — your consent, given when you tick the box and confirm your email. You can withdraw it at any time from the link in our emails.
• Running the agent service (approving agents, credit, matching and refunds) — performance of our contract with the agent.
• Running your account and saved deals — performance of our agreement with you.
• Selling and displaying advertiser listings — performance of a contract.
• Affiliate tracking — your consent, given through the cookie banner. Nothing is set unless you accept.
• Visitor statistics — our legitimate interest in knowing which pages are used, so we can improve the site. Nothing is stored on your device and no profile of you is built.
• Security, fraud prevention and keeping the site working — our legitimate interests in operating a functioning service.

We do not sell personal data, with one exception that happens only when you ask for it: if you send a trip request, we pass it to one travel agent, who pays us a fee for the introduction. See Trip requests below. We use these processors and partners:

• Supabase — database and authentication.
• Vercel — hosting, content delivery and visitor statistics.
• Resend — sending our emails.
• Anthropic — writes the trip planner chat's replies from the messages you type there, with contact details removed first.
• Stripe — payment processing for advertiser listings and vendor memberships.
• Travelpayouts — affiliate tracking, loaded only if you accept it. See our cookie policy.
• Nuitée (LiteAPI) — hotel prices and hotel photos on flight + hotel pages. The photos load from Nuitée's image service, which receives your IP address in order to serve them. We send Nuitée no personal data to look up prices.
• Google Fonts, Fontshare and Unsplash — fonts and images are loaded from these services, which necessarily receive your IP address in order to serve the file.

Some of these providers are based outside the EEA or may transfer data there. Where that happens, transfers rely on the European Commission's standard contractual clauses or an adequacy decision.

If you use the trip planner chat, what you type is sent to Anthropic, whose Claude model writes the replies, and the facts about your trip are filled in as you go. We remove email addresses and phone numbers from your messages before they are sent, and the chat never asks for your name or contact details: you give those in the form at the end, with your consent.

We do not store the conversation. If you go on to send the request, we keep the trip details and a short summary of the chat written for the agent, which the agent sees only once they take your request. To limit misuse we count how many chat messages come from each keyed IP hash per day, and delete those counts within a week.

When you send a trip request, nobody sees it until you confirm your email. Once you do, we show the trip, but not your name, email, phone number or notes, to licensed Irish travel agents who cover your county or departure airport, and after a few hours to all of our agents. The first agent to claim it receives your full request and contact details. No other agent ever does. We email you that agent's name and contact details.

That agent is a separate business and becomes responsible for your data under its own privacy policy. Our agent terms require them to use your details only for your trip, to contact you within one working day, and to delete them if you withdraw. The agent pays Holiday Puffin a small fee for the introduction; you pay nothing.

You can withdraw your request from the link in any of our emails about it. If an agent has already claimed it, we tell them to stop and delete your details.

When you click through to book, you leave this site and the airline, hotel, ferry operator or travel agent handles your data under their own privacy policy. We never receive your booking or payment details from them. Some partners pay us a commission on bookings that begin here — that is disclosed on the site and does not change the price you pay.

On flight + hotel pages, the hotel is booked on a booking site run by Nuitée (LiteAPI). Nuitée sells the stay, takes the payment and handles your booking and payment details under its own privacy policy. We are paid a commission on those bookings.

• Newsletter data — until you unsubscribe, then removed within 30 days.
• Account data — while your account is open, then removed within 30 days of closure.
• Trip requests — contact details are deleted 14 days after submission if you never confirm, 30 days after the request closes if no agent takes it or you withdraw, and 12 months after an agent claims it. The trip itself, without anything that identifies you, is kept for statistics.
• Travel agent records — while the agent uses the service, and as long as tax and accounting law requires.
• Advertiser and transaction records — as long as tax and accounting law requires.
• Server logs — for the short retention period set by our hosting provider.
• Visitor statistics — the visitor hash is discarded after 24 hours; what remains are anonymous totals.

Under GDPR you have the right to:

• ask for a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to how we use it;
• receive your data in a portable format;
• withdraw consent at any time, without affecting what came before.

Email holidaypuffin@gmail.com and we will respond within one month. If you are unhappy with our response you can complain to the Irish Data Protection Commission at dataprotection.ie.

This site is intended for adults booking travel. We do not knowingly collect data from children under 16. If you believe we have, contact us and we will delete it.

If we change how we use personal data we will update this page and the date above. If the change affects something you consented to, we will ask again rather than assume.