What we hold, and how to make us stop

sunbedly is a trade name of INVULLEN_STATUTAIRE_NAAM, registered in the Netherlands under chamber of commerce number INVULLEN_KVK_NUMMER. The full address and registration details are on our terms page.

If you want anything on this page acted on, write to hello@sunbedly.com. A person reads it, and we aim to answer within a few days rather than the month the law allows.

Your listing holds business information: the name of the club, where it is, what it publishes as a price, its facilities, and the phone number, email or website the business puts on its own site. For most clubs this is company data rather than personal data, but for a sole trader the two overlap, so we treat it all with the same care.

Where it came from. Three places, and nowhere else. What your business publishes on its own website. The official Google Places API, for your rating, review count and photos, which is why those always carry Google's name. And our own research, written up by us rather than copied from anyone. We have never bought a list, and we do not scrape Instagram, TripAdvisor or Google Maps.

Why we hold it. To run a directory that helps travellers find you, which is our legitimate interest under Article 6(1)(f) and, we think, yours too: the listing is free, carries no advertising, and sends people to your own phone rather than through us. If you disagree, the next paragraph is the one that matters.

How to make it stop. One email and your listing comes down, usually the same day. No notice period and no contract, because there is nothing to cancel. If you would rather keep the page but never hear from us, the unsubscribe link in any of our emails does exactly that, permanently, and it survives us re-importing your club later.

When you send a club a request, the name and contact you type go to that club so they can answer you. We keep a copy so the club can see the request in their dashboard, and so we can tell whether the site works.

We do not sell it, we do not market to it, and we never take payment for a bed, so there are no card details anywhere in this system. You pay the club, at the club.

Want your request deleted? Email us with the club and the date and it goes, along with anything attached to it.

Your name and your review are published. The email address you gave is not stored: we keep only a one-way fingerprint of it, which is enough to stop the same person reviewing the same club twice and useless to anyone who reads the table. It cannot be turned back into your address, by us or by anyone else.

Photographs you upload have to be your own, and should not show recognisable people who have not agreed to appear on a public website. Ask us and your review or your photo comes down.

Nothing loads until you say yes. We would like to use Google Analytics to see which coasts people look at. It sets a cookie, so we ask first: the Google script is not in this page at all until you accept, which is why you saw a bar at the bottom of the screen on your first visit. Refusing is one click, sits next to accepting and looks exactly the same, and changes nothing about how the site works for you.

Changed your mind? Cookie choice at the bottom of any page brings the bar back and deletes the Google cookies straight away. We do not use analytics to build a profile of you and we do not advertise anywhere.

What is stored without asking, because the site cannot work otherwise and none of it identifies you: your language choice, which lives in your own browser and is never sent to us; a session cookie holding the language your country suggests, which disappears when you close the browser; and, if you are us, a flag that keeps our own visits out of the statistics.

Photos on club pages are served through us but come from Google, which means Google sees a request for the image. Their terms are why every one of those photos carries its photographer's name.

Listings stay while the club exists or until someone asks us to remove one. Requests and reservations are kept for two seasons so a club can look back at last year, and a job runs on the first of every month that deletes everything older than that. It is not a promise we keep by hand. Analytics is kept for 14 months. An address that has unsubscribed is kept forever, on purpose: it is the only way to be certain we never write to it again.

You can ask what we hold, ask for it to be corrected, ask for it to be deleted, and object to us holding it at all. There is no form and no account: email us and say which. If we get it wrong you can complain to the Dutch DPA, the Autoriteit Persoonsgegevens, or to the regulator in your own country.

On Cloudflare, which stores and serves it from inside the EU where it can. Google Analytics and the Google Places API are US companies operating under the EU-US Data Privacy Framework. Nothing else has a copy.