Privacy Policy
Last updated: 11 November 2026.
Who is responsible
Karen Horan, a sole trader trading as KMH Caravan Management, operates StayCoda and its sister site Caravan Management. This notice covers staycoda.com, staycoda.co.uk and caravanmanagement.co.uk. The business’s ICO registration is Mrs Karen Horan, reference ZB980193.
Privacy contact: Karen Horan at support@caravanmanagement.co.uk, or 32 McCulloch Street, Parr, St Helens, WA9 1AJ.
What we use and why
We use information to provide and support the owner-management software, administer accounts, organise records and protect the service. Account holders and authorised users provide accommodation and booking information; guests’ details may therefore be entered without the guest visiting this website.
- Account and access information: name, email, optional phone number, password hash, membership, sessions and permission records.
- Accommodation information: location, calendar entries, seasons, rules and prices supplied by the owner.
- Booking information: guest names and contact details, stay and party details, notes and recorded financial amounts, where entered.
- Support and technical information: enquiries, correspondence and relevant access, security and audit records.
For our own account administration, we use contract where processing is necessary to provide the service agreed with an individual. We use legitimate interests for business-account administration, support, service security and dealing with enquiries, subject to people’s rights. We use legal obligation where a law requires records or disclosure. Optional browser display preferences use consent, which can be withdrawn. Joining the service is not marketing consent.
Required account information is needed to create and operate your account; without it we cannot provide the account. Optional information is identified by the relevant form. We do not use this service to make solely automated decisions with legal or similarly significant effects about people.
Owners’ guest records
Owners normally decide why guest information is collected and how it is used for their stays, and are responsible for their own privacy information and lawful basis. We act as processor when handling those records on an owner’s instructions under our Data Protection and Processing Terms. Our own administration and security activities are separate controller activities.
Business administration is restricted to Karen and one other authorised business administrator. Owners and authorised users can access their permitted records. Service providers may also process information as necessary to supply their services; this is not a claim that only two people can ever process information.
Providers and international processing
GoDaddy hosts the website and main records. The hosting account identifies the North America data-centre region; we do not describe the service as UK-only hosting. Business backup copies are stored in Google Workspace Drive, whose processing locations can also be outside the UK.
GoDaddy’s Data Processing Addendum describes its processing and UK international-transfer terms. Google’s Cloud Data Processing Addendum describes its Workspace processing and applicable transfer provisions. Contact Karen for information about the relevant arrangements and copies of applicable safeguards. Publishing these links is not a certification or independent audit of either account.
Information may also be disclosed where required by law or necessary to address a legal claim. We do not sell guest or account information. The current free release does not send bookings to an advertising partner or process guest card payments.
How long information is kept
We keep information while needed to provide the service and meet applicable legal duties. Account records support the active account; booking and recorded financial details support the stay, associated enquiries or disputes and relevant record-keeping obligations. Support and security records are kept while needed for their issue or purpose, rather than indefinitely just because storage is available.
Our business-backup policy is a maximum of 180 days, managed by manual deletion. This is not an automatic purge and is separate from live-record retention. Hosting-provider recovery copies and provider deletion cycles are governed separately by the relevant provider arrangements; the business-copy policy is not a promise that every provider-held copy disappears within 180 days.
Requests, deletion and complaints
Email Karen to request access, correction, deletion, restriction, portability or to object, where those rights apply. Other valid request routes are not excluded. Consent may be withdrawn where it is our basis. Identity or authority checks and coordination with the relevant owner may be needed. Requests are handled within applicable legal timescales, normally one calendar month subject to permitted adjustments or extensions.
Deletion is not absolute where legal obligations or another applicable exception require information to remain. Account closure does not automatically erase every booking, audit or backup. Erasure handling must also address retained backups and avoid improper reinstatement after restoration. The backup policy is not a blanket 180-day delay for responding to a request.
Contact Karen if you are unhappy with our handling, or complain to the Information Commissioner’s Office. See our Cookies notice for browser storage and controls. No system can promise absolute security.