Privacy Policy

Privacy questions and rights requests may be sent to privavillas@gmail.com.

• Details you submit: name, email, telephone number, stay dates, guest count, selected villa and message.
• Booking and correspondence records, including offers, confirmations, cancellations and support requests.
• Payment records such as amount, currency, status and Stripe transaction reference; we do not receive or store full card details.
• Basic security and technical information processed when the site or Cloudflare Turnstile checks a request, such as IP address, browser and device signals.

We use information to respond to enquiries and take steps requested before a contract, manage confirmed bookings and payments, provide support, prevent fraud and abuse, secure the service, meet accounting or legal duties, and establish or defend legal claims.

The corresponding legal bases are pre-contractual steps and contract performance, compliance with legal obligations, and legitimate interests in operating a secure booking service. We do not currently use enquiry details for unrelated marketing.

Information may be processed by providers needed to run the service, including Vercel for hosting, Cloudflare for Turnstile security verification, our email service for enquiry delivery, Stripe for payments, and the relevant villa or service provider where necessary to fulfil a request.

Some providers may process data outside your country. Where required, transfers are protected by an adequacy decision, approved contractual safeguards or another lawful mechanism. Each provider also processes information under its own privacy terms where it acts independently.

Unconfirmed enquiry records are normally retained for up to 12 months so we can follow up and handle disputes. Confirmed booking, payment and accounting records are kept for the period required by applicable tax, contract and legal rules. Data is deleted or anonymised when it is no longer needed.

We use access controls, encrypted HTTPS connections, bot protection and reputable service providers. No internet service can promise absolute security, so guests should never send card details or identity documents unless specifically required through an approved secure channel.

The site does not currently use advertising or behavioural analytics cookies. It stores your light/dark theme preference locally on your device. Cloudflare Turnstile may process limited security data needed to distinguish legitimate visitors from automated abuse.

Depending on applicable law, you may request access, correction, deletion, restriction, objection or portability of your personal data. You may also complain to the relevant data protection authority. A request may require proportionate identity verification, and some records may need to be retained for legal reasons.