Data Protection

Last updated: 11 November 2026.

Contact and responsibilities

Karen Horan is the sole trader trading as KMH Caravan Management, operating StayCoda and its sister site Caravan Management. Privacy contact: support@caravanmanagement.co.uk, 32 McCulloch Street, Parr, St Helens, WA9 1AJ. ICO registration: Mrs Karen Horan, ZB980193.

Our Privacy Policy explains our own account, support and security processing. Owners remain responsible for their accommodation business and guests’ information. A software account or ICO registration is not certification of compliance.

Data processing terms for owner records

These processing terms form part of our Terms and Conditions when we handle personal information on an owner’s instructions. In that relationship the owner is the controller and Karen Horan, trading as KMH Caravan Management, is the processor. If an owner acts for another controller, they must have authority for these instructions and arrangements.

Scope and instructions

The subject is storing and organising accommodation, availability and booking records to provide the software. Processing includes recording, storing, displaying, retrieving, correcting and deleting information, plus necessary support, security and backups. It lasts for the service relationship and the necessary return/deletion period.

Records may concern owners, authorised account users, guests and members of their party: names and contact details, accommodation and stay details, party information, notes and recorded financial amounts supplied by the owner. The service is not intended for payment-card numbers, identity-document storage or unnecessary special-category information.

The owner’s authorised use of the software and written support requests are documented instructions. We will process these records only on those instructions, including instructions about transfers, unless the law requires otherwise. Where legally permitted, we will tell the owner about such a requirement. We will tell the owner if an instruction appears to breach applicable data-protection law.

Confidentiality, security and assistance

People authorised to handle records must be bound by confidentiality. We will apply technical and organisational measures appropriate to the processing risks. Owners must protect their own credentials and use the available access controls; this is not an absolute-security guarantee.

Taking account of the processing and information available to us, we will assist the owner with individuals’ rights, security, breach reporting, impact assessments and relevant regulator consultations. We will notify the owner without undue delay after becoming aware of a personal-data breach affecting their records. We will forward relevant requests rather than decide the owner’s response without authority, unless law requires otherwise.

Service providers and transfers

The owner authorises GoDaddy for hosting and Google Workspace Drive for business backups, with the processing locations described in our Privacy Policy. We must impose applicable equivalent processing obligations on subprocessors and remain responsible for their performance of the obligations we subcontract. We will notify the owner of an intended additional or replacement subprocessor in advance and give a reasonable opportunity to object before its use for their records.

International processing must use an applicable lawful transfer mechanism and relevant contractual safeguards. A website notice alone does not create a transfer mechanism. Information about the provider terms and relevant safeguards is available through the Privacy Policy or by contacting Karen.

Records, review and the end of the service

We will make available information needed to demonstrate compliance with these processing obligations and allow and contribute to required audits, including inspections. Practical access must be coordinated to protect other owners’ information and the security of the service; it does not grant unrestricted server access.

At the end of the service, we will return or delete the owner’s personal information as instructed, unless law requires retention. Backup handling follows the retention and erasure arrangements in the Privacy Policy, including preventing erased information being improperly reinstated. Contact support to arrange a request; this is not a claim of an automated one-click full export or erasure feature.

Owner responsibilities and requests

Enter only necessary, accurate information, provide appropriate privacy information to guests, maintain a lawful basis and report access problems promptly. For account closure, a privacy request or help with these terms, contact Karen. We may need to verify identity or authority. Individuals can also raise concerns with the ICO.