Privacy notice
Draft notice. Company details and the points marked “to be confirmed” are placeholders awaiting confirmation from South Stars Management.
Who we are
This platform is run by [South Stars Management Ltd — legal name to be confirmed], registered in [England and Wales — to be confirmed] (company number [Company number to be confirmed]), registered office [Registered office address to be confirmed]. We are the data controller for the information recorded here. Contact our data protection lead about your data at [Data protection contact email to be confirmed].
What we record, why, and our lawful basis
The lawful bases below are what we expect to rely on; they are to be confirmed.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Giving you an account and controlling what you can see | Name, work email, role, parks, helpdesk team, acknowledgement of this notice | Contract (your employment or engagement) and legitimate interests in keeping the platform secure |
| Recording service visits and repairs, and keeping each asset's history | Who completed each form, when, the device used, answers, photos and signatures | Legal obligation (health and safety) and legitimate interests in safe equipment |
| Park audits (including the Entertainment and Activity audits) | Answers, photos, signatures, the Park Star on duty and a live assessment of an activity they run | Legitimate interests in keeping standards consistent across parks |
| Team reviews | Ratings and comments about your work, objectives and next review date | Contract and legitimate interests in supporting and developing staff |
| Helpdesk | Tickets, replies, internal notes, photos and files, who handled them, ratings | Legitimate interests in fixing problems quickly |
| Training | Courses completed, completion and expiry dates, managers' follow-up notes | Legal obligation (e.g. fire safety, first aid, safeguarding) and legitimate interests |
| Vacancies and temporary contracts | Vacant, offered and covered weeks per park, roles, short notes and contract dates | Legitimate interests in staffing each park |
| Stock orders | Who ordered or approved what, and when | Legitimate interests in ordering supplies |
| Security and accountability | A log of sign-ins, changes, exports and views of team reviews; email delivery logs | Legitimate interests in keeping data secure, and legal obligation (UK GDPR security duty) |
Where we rely on legitimate interests, those interests are running Entertainment & Activities services safely and to a consistent standard at Park Holidays UK parks, keeping equipment safe, and supporting our team. We have weighed these against your interests: the forms only ask about work, never about health, medical or other sensitive details, and reviews are restricted to your managers and Head Office. You can ask us for details of that assessment.
We don't ask for special category data (such as health, religion or ethnicity). Please don't add it to free-text answers, notes or photos, and photograph equipment and areas, not guests.
Where it comes from
Most of it comes from you, or from what you record as you use the platform. Some comes from other people: managers and regional managers write team reviews and park audits that name you; Head Office sets up your account; training completions can be imported from our e-learning system; and vacancy records come from park staffing plans.
Do you have to provide it?
Using the platform for your forms is part of your role, so we need your name, work email and the forms you complete. We don't make any decisions about you by automated means alone: reviews, audit scores and training reports are read and acted on by people.
Who can see it
Access is controlled by role and park. Team reviews can only be seen by managers for your parks and Head Office admins. Team members and engineers cannot see them, including ones about themselves. Park Holidays UK staff do not have access to this platform. Report emails go only to the inboxes South Stars sets for each form and park. Helpdesk tickets are seen by the person who raised them, the helpdesk team handling them and managers for that park; internal notes are not shown to the person who raised the ticket. Training records are seen by you, managers for your parks and Head Office. Vacancy records are seen by managers for the park and Head Office.
Our service providers process data for us under contract: Supabase (database and file storage), Vercel (runs the app) and Resend (sends report and notification emails, including PDF reports). We may also share data where the law requires it, for example with the Health and Safety Executive or the police.
Where it is stored
Data and files are stored by Supabase in London, UK, and the app runs in Vercel's London region. Vercel and Resend are US companies, so some data (such as emails being sent, and support or security logs) may be processed in the United States. Where that happens it is protected by the UK–US data bridge or the UK International Data Transfer Addendum; which applies to each provider is to be confirmed. You can ask us for a copy of the safeguards.
How long we keep it
Head Office sets a retention period for each form type, and for helpdesk tickets, training records and notes, vacancy records, stock orders, the security log and email logs. The periods are to be confirmed; ask us for the current list. Downloads of personal data exports are deleted after a few days. If you leave, your account is switched off but the records you completed are kept for their retention period, because they form part of equipment and safety history.
On a shared iPad or iPhone, forms you are filling in and forms waiting to send are kept on the device until they send. When you sign out, the pages and lists the app keeps for offline use are cleared, and you can choose to delete anything still waiting.
Your rights
You can ask for a copy of your data, ask us to correct it, and in some cases ask us to delete or restrict it, object to how we use it (including where we rely on legitimate interests), or receive data you gave us in a portable format. Head Office can export everything held about you, or anonymise your name on request while keeping equipment records. Contact [Data protection contact email to be confirmed].
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).
Cookies
We only use cookies that are strictly necessary to keep you signed in. There is no analytics or tracking. See the cookie policy.
Version 2026-10-v4