Privacy policy
Last updated: 15 October 2026
This is a translation. The Spanish version is legally binding; in case of any discrepancy, the Spanish version prevails.
1. Data controller
Francisco de Ascanio de la Vega, Tax ID (NIF) 50832694A, C/ Cornical 9, 38639 San Miguel de Abona, Santa Cruz de Tenerife, Spain. Email: oceanview@villadenava.es.
This policy explains how we process your data under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
2. What data we process, why, and on what legal basis
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Managing your booking and stay (confirmation, communication, arrival, issues) | Name, email, phone, country, dates, number of guests, messages | Performance of the contract (Art. 6(1)(b) GDPR) | For the duration of the relationship and then while claims may arise (generally up to 5 years) |
| Payments and refunds | Amount and transaction details. Full card details are processed by Stripe; we never see or store them | Performance of the contract (Art. 6(1)(b) GDPR) | As required by tax and accounting rules |
| Mandatory guest register and reporting to the authorities (SES.HOSPEDAJES) | Full name, sex, ID document, nationality, date of birth, address, contact details, relationship with accompanying minors, booking and payment details, as required by Royal Decree 933/2021 | Legal obligation (Art. 6(1)(c) GDPR; RD 933/2021 and Organic Law 4/2015) | 3 years after the end of the stay, as set by RD 933/2021 |
| Invoicing and tax obligations | Identification and billing data | Legal obligation (Art. 6(1)(c) GDPR) | Statutory periods (usually 4 to 6 years) |
| Answering email enquiries | The data you send us | Legitimate interest in answering you, or pre-contractual steps (Art. 6(1)(f) and 6(1)(b) GDPR) | As long as needed to reply; if you book, as in the first row |
| Website usage statistics (Google Analytics 4), only if you accept them | Cookie identifiers, pages visited, device, approximate location | Consent (Art. 6(1)(a) GDPR and Art. 22.2 LSSI-CE) | See the Cookie policy |
| Handling complaints and defending our rights | Booking and communication data | Legitimate interest (Art. 6(1)(f) GDPR) | Until legal claims are time-barred |
If you book through Airbnb, Booking.com or Expedia, those platforms process your data as independent controllers under their own policies; we receive the data needed to manage your stay.
We do not use automated decision-making or profiling with effects on you. We do not send marketing.
3. If you do not provide your data
Booking data and the data required by RD 933/2021 are mandatory: without them we cannot confirm the booking or accept the stay.
4. Recipients
- Spanish law enforcement (Ministry of the Interior, via SES.HOSPEDAJES), as required by law.
- Tax authorities and other authorities where required by law.
- Processors providing services to us under an Art. 28 GDPR contract: Smoobu GmbH (Germany; booking engine and booking management), our web hosting and email provider Hostinger International Ltd. (EU), CheckinScan (checkinscan.com; online guest registration for SES.HOSPEDAJES) and, only if you accept analytics cookies, Google Ireland Ltd. (Google Analytics).
- Stripe (Stripe Payments Europe, Ltd., Ireland) for payment processing; Stripe also acts as a controller for some processing (e.g. fraud prevention) under its own policy.
- Cleaning or maintenance staff, only with strictly necessary data (e.g. dates and number of guests).
5. International transfers
Some providers (Google, Stripe) may process data in the United States or other countries outside the European Economic Area. These transfers rely on the EU-US Data Privacy Framework (for certified companies) or on standard contractual clauses approved by the European Commission.
6. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, and withdraw your consent at any time (without affecting prior processing), by writing to oceanview@villadenava.es. We may ask you to prove your identity. We will reply within one month.
Please note that we cannot erase data we are legally required to keep (e.g. the guest register for 3 years).
If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the authority in your country of residence.
7. Minors
Bookings may only be made by persons aged 18 or over. Data of minors staying at the property is processed only to comply with RD 933/2021 and is provided by the responsible adult.
8. Security
We apply appropriate technical and organisational measures to protect your data against loss, misuse or unauthorised access.
9. Changes
We may update this policy. The version in force is always the one published on this page, with its update date.