Sure Stay Privacy Notice
Who is responsible for your information
Sure Stay is operated by Harbourlight Holdings Ltd, registered in the Republic of the Marshall Islands under number 141026, of Ajeltake Road, Ajeltake Island, Majuro, Marshall Islands MH96960. We decide how and why your personal information is used, which makes us the controller of it.
Our representative in the European Union is info@sure-stay.com. Our representative in the United Kingdom is info@sure-stay.com. You can contact either of them, or us, about anything in this notice.
For anything privacy-related, write to privacy@sure-stay.com.
What we collect, why, and on what basis
If you book a stay: your name, email address, telephone number, the dates and details of your booking, messages you send through the site, and payment details processed by our payment provider. We use this to take and confirm your booking, to give the host the information they need, to contact you about your stay, and to deal with any complaint. Our basis is that we need it to perform our contract with you.
If you list a property: your name or company name, address, contact details, date of birth, tax identification number, bank details, and details of each property including its address and its registration or licence number. We use this to operate your listing, to pay you, and to meet the legal obligations described below. Our basis is performance of our contract with you and compliance with our legal obligations.
If you only browse: information about your device and how you use the site. What we set and how you control it is in our cookie notice. Where it is not strictly necessary, our basis is your consent.
If you contact us through our website: your name, your email address, your message, which part of the site you contacted us from, and whether you asked for news. Formspree, which runs the form for us, may also record technical details such as your IP address. We use this to respond to your enquiry, and, if you tick the box to hear from us, to send you news about Sure Stay, which you can stop at any time. We do not sell it. Formspree processes the form on our behalf and delivers each enquiry to our email inbox, and both act on our instructions. Our basis for replying is our legitimate interest in answering people who get in touch; for news, it is your consent.
Identity documents. Where the law requires us to verify a host or to register guests — we collect identity document details. In some countries this counts as sensitive information and we will ask for your separate consent before collecting it.
Fraud prevention and safety. We check bookings, accounts and listings for signs of fraud, and we keep records of accounts we have suspended. Our basis is our legitimate interest in keeping guests, hosts and Sure Stay safe from fraud, which we have balanced against your interests.
Marketing. If you have agreed, or you are an existing customer and have not objected, we send you information about Sure Stay. You can stop this at any time using the link in any message.
Who we share it with
The host you book with, who becomes a separate controller of that information and is responsible to you for it. Our service providers — hosting, payment processing, customer support, analytics, fraud prevention agencies — who act on our instructions and may not use it for anything else. Formspree, which processes contact form submissions on our behalf; you can review Formspree's privacy policy at formspree.io/legal/privacy-policy. Tax authorities, where the law requires it, as explained below. Regulators, licensing bodies and police, where the law of the country in which a property is located requires it — several of the countries we operate in require guest or property data to be supplied. We do not sell your personal information.
Where your information goes
Harbourlight Holdings Ltd is established in the Republic of the Marshall Islands. Your personal information is transferred to and stored in the Marshall Islands. The Marshall Islands has not been the subject of an adequacy decision by the European Commission or the UK Secretary of State, which means its laws do not automatically give the same level of protection as the law of your own country.
We rely on the Standard Contractual Clauses approved by the European Commission, and for the United Kingdom the ICO's International Data Transfer Addendum, as the safeguard for these transfers — together with a transfer impact assessment and the additional technical measures set out in it. You can obtain a copy of the clauses and a summary of that assessment by writing to privacy@sure-stay.com.
When you book, we also pass your name, contact details and stay dates to the host, who may be in a different country again.
If you use our contact form, your submission is also processed in the United States by Formspree, which relies on the Standard Contractual Clauses as the safeguard for that transfer.
How long we keep it
Booking records: 6 months years after the stay. Host records: 6 months after the account closes, and some discretionary information at least five years for tax-reporting records. Messages: 3 months. Contact form enquiries: 12 months. Reviews: 6 months, or until the listing is removed. Fraud and suspension records: 6 months. Marketing preferences: until you change them. When a period ends we delete the information or anonymise it so it can no longer identify you.
Your rights
You can ask us for a copy of the information we hold about you; ask us to correct it; ask us to delete it; ask us to restrict how we use it; ask us to send it to another provider; and object to us using it where we rely on our legitimate interests. Where we rely on your consent, you can withdraw it at any time, which does not affect anything we did before you withdrew it.
Write to privacy@sure-stay.com and we will reply within one month. There is no charge.
If you are unhappy with how we have handled your information you can complain to the data protection authority in your country. In the United Kingdom that is the Information Commissioner's Office at ico.org.uk. In the European Union it is the authority in the Member State where you live. We would rather you came to us first, but you do not have to.
Keeping it safe
If something goes wrong and it is likely to put your rights at risk, we will tell you.
Children
Sure Stay is not for people under 18 and we do not knowingly collect their information. If you believe a child has given us information, tell us at privacy@sure-stay.com and we will delete it.
Country-specific information
Japan. Our name and address, the purposes for which we use your information, how to make a disclosure request and our complaint contact point are set out above. Requests go to privacy@sure-stay.com.
Mainland China. Where we process the information of people in China, we collect the categories of information listed above, for the purposes listed above, by the means described, and keep them for the periods stated. We will ask for your separate consent before collecting sensitive information such as passport details, and before transferring your information outside China where that consent is required.
United Arab Emirates. An Arabic version of this notice is available at privacy@sure-stay.com
Changes to this notice
We last updated this notice on 17/9/26. If we change it significantly we will tell you before the change takes effect.