Privacy Policy for Villa Esquina

1. Who we are

Villa Esquina is responsible for deciding how the personal information described in this policy is used. You can contact us at info@villaesquina.com.

2. Information we collect

Depending on how you use the website, we may collect:

• your name, email address, optional telephone number, requested dates, number of adults and children, and the message you send with a booking enquiry;
• your email address, guide-delivery status and separate optional marketing choice when you request the free guide;
• information needed to administer an agreed stay and meet applicable tax, accounting and Spanish guest-registration duties;
• where you accept analytics or advertising cookies, which advertisement, search or link brought you to the website, recorded against any enquiry you make. This contains no personal information beyond the enquiry itself;
• owner authentication, role and audit information for the private administration area; and
• technical information needed to deliver and protect the website. The application uses short-lived irreversible digests for rate limiting and does not store raw IP addresses in its enquiry or guide-request records.

The website does not take payments or store payment-card details. Payments and final agreements are handled personally outside the website.

3. Booking enquiries and availability

A website enquiry asks us to check dates and discuss a possible stay. It does not hold dates, confirm a booking, agree a price or create a payment obligation. Andrew and Sarah reply personally and record an enquiry in Sympl manually when needed.

Public availability contains anonymous occupied date ranges only and does not display guest identity. Depending on the purpose, we use personal information to take steps you request before a contract, perform an agreed contract, meet legal obligations and pursue our legitimate interests in responding to enquiries and operating a secure, proportionate holiday-rental service.

4. Free guide and marketing

We use the email address entered on the free-guide form to provide the requested guide and diagnose delivery or abuse problems. Marketing is optional, unticked by default and the guide is available whether or not you choose it.

We send promotional email only where we have recorded consent or another applicable permission under the UK electronic-marketing rules. Every promotional email provides a way to unsubscribe. A booking enquiry or guide request is never conditional on agreeing to marketing, and Villa Esquina contacts are kept separate from other mailing audiences.

5. Who receives information

We do not sell personal information. We use carefully selected services to run the site:

• Lovable and Lovable Cloud/Supabase for hosting, database and owner access;
• Resend and Google Workspace for transactional email and owner replies;
• Sympl when an enquiry or stay is recorded manually;
• MailerLite only for eligible Villa Esquina marketing contacts and suppression records; and
• CookieYes for cookie choices when it is activated for the public site.

Cloudflare is currently used for DNS. We will update this notice if visitor-facing Cloudflare security services are enabled. We may also disclose information to accountants, professional advisers, property-service providers or public authorities where it is necessary for an agreed stay or required by law.

Some providers may process information outside the UK or European Economic Area. Where this happens, we require an applicable adequacy arrangement or contractual safeguard. Contact us if you would like more information about the safeguards relevant to your information.

6. How long we keep information

Our working retention periods are:

• an enquiry that does not become a booking: 12 months after the last meaningful contact, unless a dispute or another documented need requires longer;
• a confirmed booking, agreement or accounting record: normally six years after the end of the relevant financial year, subject to the applicable UK and Spanish legal and accountancy requirements;
• Spanish guest-registration information: only for the period required by applicable law and without unnecessary duplicate storage;
• a free-guide request without marketing: 12 months from the request;
• an active marketing record: while subscribed, with a review at least every 24 months;
• marketing source details recorded against an enquiry: 25 months from the enquiry date, after which they are cleared while the enquiry itself is retained;
• a marketing suppression record: the minimum identifier for as long as needed to prevent unwanted re-contact;
• a rate-limit digest: up to 24 hours; and
• an owner account or role: while authorised access is needed.

Historic Wix migration records are kept privately while the migration and cancellation are validated, followed by a 12-month safety window. Redundant personal exports will then be reviewed for secure deletion while required financial, suppression and audit evidence is retained.

7. Cookies and third-party content

Essential technologies may operate so the site, forms and privacy choices work. CookieYes provides a persistent way to make or change cookie choices, and non-essential services remain blocked until the required consent is given.

We use a first-party cookie (ve_attr, stored for 90 days) to record which advertisement, search or link brought you to our website, so that we can measure which marketing produces enquiries. It contains no personal information and is only used if you accept analytics or advertising cookies.

Links to external websites open services with their own privacy terms. Any third-party media retained at launch will be described and consent-gated where required.

8. Security

We use access controls, owner-only administration, audit records and other proportionate safeguards to protect personal information. No internet or storage system can be guaranteed completely secure.

9. Your rights

Depending on the circumstances, you may ask for access, correction, erasure, restriction or portability, or object to processing. Where we rely on consent, you can withdraw it at any time without affecting earlier lawful processing. You can always object to direct marketing.

To exercise a right, email info@villaesquina.com. We may need to verify your identity. You can also complain to the UK Information Commissioner’s Office. If Spanish data-protection law applies to the matter, you may also contact the relevant Spanish supervisory authority.

10. Changes to this policy

We will update this page when our website, service providers or handling of personal information changes. The date at the top shows when this version took effect.