This policy explains what happens to your personal information when you browse this website, check availability for the villa, send us a booking request or write to us with a question. It sets out what we collect, why we collect it, who helps us run the booking process, how long we keep your details and what you can ask us to do with them. The site exists to arrange stays at a single private property, so the amount of information involved is modest and almost all of it comes directly from you. The Terms of Service published on this site set out the booking terms themselves, including how a request becomes a confirmed booking and how the price is split into a down payment and a final payment; this policy deals only with the information side of that process. We have kept the language as plain as we can, because you should be able to see at a glance what you are handing over when you plan a stay with us.

Who We Are

Stayora is the name under which we let the villa at 27 Oceanview Drive, Palma, Spain, to private guests, and we run this website in connection with that letting. Where this policy says “we”, “us” or “our”, it means the business behind Stayora, which decides why and how the personal information submitted through this site is used; in the language of applicable data protection law, that makes us the controller of that information, and the Terms of Service use the same three words in exactly the same sense. Enquiries, booking requests, arrival arrangements and questions during a stay are handled by our host, Isabelle Moretti, supported by a small number of assistants and local service partners who help us look after the property. You can reach us about anything in this policy at hello@stayora.com or on +1 (555) 248-7316.

This policy covers the pages of this website, the availability search and the booking request form on it, and the correspondence that follows once you contact us about a stay. It does not cover other sites we link to, such as a map, a local guide or a social profile, each of which publishes its own policy and answers for what it does with your data. If you first came across the villa on a listing or booking platform, that platform’s policy governs what it collected from you there, and this one applies to whatever reaches us. It also covers the personal information involved once you are at the property, such as the identity check on arrival described in the Terms of Service and any guest register that local rules require us to keep, although the practical detail of how those are handled is explained to you at the time.

Data We Collect

When you send a booking request, you give us the details the form asks for: your first and last name, your e-mail address and phone number, and the address we use for your booking record and any invoice, made up of street and number, ZIP or postal code, city and country. The person who submits the form is the lead guest for the booking, so those are the contact details we work with throughout. We need those fields to answer a request and to draw up an agreement, so if they are missing or clearly incomplete we will not be able to take the request any further. Two fields are genuinely optional. You can tell us an approximate arrival time so that we can plan the key handover, and you can write a message to the host about anything that matters for your stay. Whatever you type in that message is stored with the rest of the request, so please keep it to what is relevant and call us instead if you would rather discuss something sensitive.

The request also carries the stay details you chose earlier on the site. When you pick your check-in and check-out dates and the number of adults and children travelling with you, those values are passed to the booking confirmation page as parameters in the page address, shown back to you there alongside the nightly rate, taxes, the down payment and the final payment, and then submitted together with your contact details. Because they travel in the address of the page, your dates and guest numbers may also appear in your own browser history and in the routine server logs kept by the providers that deliver this site. We treat them as part of your booking record and use them only to check availability, price the stay and prepare it.

Separately from anything you type, the site and the services behind it record a limited amount of technical information each time a page is loaded. This usually includes your IP address, the browser and type of device you are using, the pages you opened and when, and the page or search that referred you to us. We also see basic delivery information about the e-mails that pass between us, such as whether a message was accepted or bounced, which is how we can tell whether a confirmation actually reached you. Apart from the payment confirmations described further below, we do not buy or receive information about you from any other source.

Why We Use Your Data

The main reason we handle your information is to deal with your booking request and, if the dates are free and we both want to go ahead, to arrange and carry out the stay. That means checking the requested dates and guest numbers against our calendar, replying to you, confirming the nightly rate, taxes, the down payment and the final payment, sending the payment details with our written confirmation, issuing invoices and receipts, agreeing the arrival time and key handover, and staying in touch about practical matters while you are there. All of that is necessary to take steps at your request before an agreement is made and, afterwards, to perform the rental agreement itself, and that is the basis on which we rely for it.

We also use your information for a narrower set of purposes that support the letting without forming part of it. These include keeping our own records of enquiries and stays so that we can see how the calendar is filling and answer follow-up questions, checking that a request looks genuine before we set dates aside or send payment details, keeping the website and our inbox secure and working properly, and being able to bring or defend a claim if a dispute over a stay, a damage deposit or damage to the property ever arises. Here we rely on our legitimate interest in running a small rental business carefully, and we have weighed that interest against what you would reasonably expect us to do with the details you gave us.

Some processing is out of our hands. Accounting and tax rules oblige us to keep records of the payments we receive and the documents behind them, and short-term lets in the area can carry guest registration duties that require us to record and pass on limited details about the people staying; where a duty of that kind applies, we process your data because the law requires it, and we will tell you what is being asked of us. Anything genuinely optional, such as non-essential cookies or an occasional message about the villa, happens only if you have agreed to it, and you can take that agreement back at any time without it affecting a booking that is already under way.

Cookies, Analytics and Marketing

This website uses a small number of cookies and similar pieces of browser storage. The ones we treat as strictly necessary keep the pages and the booking form working, help protect the form against automated abuse, and remember the choice you made in the cookie notice so that you are not asked again on every page. They are set as soon as you arrive and cannot be switched off from within the site, although your browser will always let you block or delete cookies yourself, at the cost of parts of the site no longer working properly. Your selected dates and guest numbers are not held in a cookie; as described above, they travel between pages in the address of the booking confirmation page.

We may also use a website analytics service to see, in aggregate, how many people visit the site, which pages hold their attention and how they found us. We use that to improve the site and the way the villa is presented, not to build a profile of you or to follow you around other websites, and we ask the provider to collect as little as the service allows, including shortening or masking IP addresses where that option exists. Analytics and any other non-essential storage are switched on only after you have agreed through the cookie notice, and you can change your mind at any time by clearing the cookies for this site and making a new choice, or by asking us using the contact details at the end of this policy.

Most of the messages you get from us are simply part of arranging a stay: an answer to your request, our written confirmation with the payment details, reminders for the down payment and the final payment, arrival details or a reply to a question. You cannot opt out of those while a booking is live, because they are how the booking works. There is no newsletter sign-up on this site, we do not sell, rent or swap your details, and we do not make them available for anyone else’s marketing. If we ever want to write to past guests with news about the villa or an offer for a quieter season, we will ask you first, keep it infrequent and put a way to stop it in every message, and saying no makes no difference to how you are treated as a guest.

Who We Share Data With

We rely on a handful of service providers to run the site and the booking process, and your information passes through their systems as a result. They are the provider that hosts this website and delivers its pages, the service that receives submissions from the booking form and forwards them to us, our e-mail provider, our payment provider, and the accountant or tax adviser who sees the records of a stay once it has been paid for. Each of them works on our instructions under a written agreement, may use your data only to provide the service we have asked for, and is expected to keep it secure and to delete or return it when the arrangement ends. Locally, the housekeeper and the people who hand over keys are told only what they need in order to do that, which is usually a name, the dates and an arrival time.

The booking form does not take payment, so no card or bank details are entered on this site. Our written confirmation carries the instructions for the down payment, and closer to arrival we send the request for the final payment; those payments are handled by our payment provider or by ordinary bank transfer, and in either case we see the amount, the date, the name behind the payment and a reference that lets us match it to your booking, never a full card number. Beyond our providers, we disclose personal information only where we must or where it is plainly justified: to public authorities when a legal duty or a valid request obliges us, to our own lawyers or insurers if a claim about a stay arises, and, if the villa or the business behind it ever changes hands, to the buyer, who would have to go on handling your data in line with this policy.

Some of the providers behind this site keep their servers in a country other than the one you are writing from, which means your information may be sent to and stored somewhere whose data protection rules are not the same as those where you live. Where that happens we choose providers who commit in their contracts to protecting the data they handle for us, and we make sure that the safeguards recognised for such transfers under applicable data protection law are in place before the data travels. You are welcome to ask which providers are involved and how those transfers are covered, and we will describe the arrangements in plain terms.

How Long We Keep Your Data

A booking request that does not lead to a stay is kept for a limited period only, as a rule no longer than twelve months, which is long enough to answer any follow-up questions and to see whether the same enquiry comes back with different dates; after that we delete it or reduce it to anonymous figures about which weeks people ask for. Requests that do become bookings are kept for the length of the stay and then archived, because questions about a damage deposit, about something noticed after departure or about a complaint can surface well after the keys come back. The Terms of Service give us fourteen days from departure to settle a damage deposit and allow you a reasonable period after your stay to raise a complaint, and we keep the booking record long enough after those points to deal with anything arising from them. Correspondence by e-mail is kept for as long as the conversation it belongs to is still useful, and is cleared out together with the booking record it relates to.

Records that involve money are the exception, and we hold them longer than we otherwise would: invoices, confirmations of the down payment and the final payment, and the name and address that appear on them are kept for as many years as accounting and tax rules require, and the same goes for anything we have to retain under a guest registration duty. Technical data lives for a far shorter time, with server logs and analytics records deleted or aggregated after the short retention period set by the providers concerned. When a retention period ends we delete the data or strip out whatever could identify you, and if you ask us to erase something sooner we will do it unless one of these obligations stands in the way, in which case we will tell you which one and when it expires.

How We Protect Your Data

The site is served over an encrypted connection and the booking form transmits what you enter in encrypted form, so it cannot be read on the way to us. Access to booking records, to the inbox that receives requests and to the payment dashboard is limited to the host and the few people who genuinely need it to prepare a stay; those accounts are protected by strong individual passwords and, where the service supports it, a second authentication step, and access is withdrawn when someone stops working with us. We deliberately use established providers for hosting, e-mail and payments because they maintain the security practices, backups and monitoring that a small rental business could not run on its own.

No website or e-mail system can be made perfectly secure, and we cannot promise that information sent over the internet will never be intercepted, so please do not send copies of identity documents, card numbers or other sensitive material through the message field or by ordinary e-mail. The identity check that the Terms of Service describe is made in person when you arrive, and we will never ask you to send copies of documents in advance. If you need to share something sensitive with us before your stay, call us and we will agree a safer route for it. Should we ever become aware of a security incident that affects your personal information and is likely to put you at risk, we will tell you what happened, what it means for you and what we are doing about it, and we will notify the competent authority where we are required to do so.

Your Rights and Choices

Applicable data protection law gives you a set of rights over the information we hold about you. You can ask us to confirm whether we hold anything and to give you a copy of it, to correct details that are wrong or incomplete, such as a misspelt name or an address that has since changed, and to delete information we no longer have a good reason to keep. You can also ask us to pause our use of your data while a question about its accuracy or about our grounds for holding it is being resolved, and in certain cases you can ask for the details you gave us to be handed back in a common electronic format so that you can pass them on to someone else.

You can object to processing that we carry out on the basis of our legitimate interests by telling us why your situation calls for it, and we will stop unless we have compelling grounds to continue or still need the data for a legal claim. Where something rests on your consent, such as non-essential cookies or an occasional message about the villa, you can withdraw it at any time; doing so does not make what happened beforehand unlawful and has no bearing on a booking already in progress. We do not make decisions about you by automated means alone and we do not profile you: as the Terms of Service put it, whether we can take a booking is a judgement made by a person looking at the dates, the size of the party and the calendar.

To use any of these rights, write to hello@stayora.com or call +1 (555) 248-7316 and tell us as plainly as you can what you would like us to do; there is no form to complete and no charge for a reasonable request. We will reply within the period that applicable law allows, and if we cannot do what you ask we will explain why and what your options are. Because a request of this kind could expose your data to somebody else, we may ask a question or two to satisfy ourselves that it really comes from you, particularly where it concerns deletion or a copy of a whole booking file. If you are unhappy with how we have handled it, please tell us first if you can, and you are in any case entitled to complain to the data protection authority for the place where you live, where you work or where you believe the problem arose.

Children and Other Guests

This site is meant for adults who are able to enter into a rental agreement, and we do not knowingly collect personal information from children. When you tell us how many children are travelling with you, we record the number alone, because it affects the sleeping arrangements, the cleaning and the price; the form does not ask for their names or ages, and you should not add such details in the message field. If you believe a child has sent us information through this site without a parent or guardian knowing, please contact us and we will delete it promptly unless we are obliged to keep it.

A booking usually concerns more than one person, while the contact details on the form are those of the lead guest who submitted it. If you do pass on information about somebody else travelling with you, whether in the message field, in later correspondence about arrival, or because a local registration duty requires it, please make sure they know what you have shared and are content for us to use it to prepare the stay. We treat that information exactly as we treat yours, keep it with the same booking record and delete it on the same schedule, and anyone in your party is welcome to contact us directly to ask what we hold about them.

Changes to This Policy

We may revise this policy from time to time, for instance if we change the booking process, move to a different hosting, form or payment provider, or need to reflect a change in the law or in the way short-term lets are regulated where the villa is. The version published on this page is always the one in force, and the date shown with it tells you when it was last revised, so it is worth a glance if you are booking again after a long gap. Where a change materially affects how we use information we already hold, we will make that visible on the site rather than quietly swapping the text, and if you have a live booking or an open enquiry with us we will let you know by e-mail before the new version takes effect. We will not start using details you have already given us for a genuinely new purpose without a proper basis for doing so, and where that basis is your consent we will ask you first. The Terms of Service are updated separately and explain in their own closing section which version governs a booking that has already been confirmed.

Contact Us

If you have a question about this policy, about the information we hold or about anything else to do with privacy at Stayora, please get in touch: e-mail hello@stayora.com, call +1 (555) 248-7316, or write to us at Stayora, 27 Oceanview Drive, Palma, Spain, marked for the attention of Isabelle Moretti. Messages about privacy are read by a person rather than sorted by a system, and we usually answer within two working days. It helps if you say what your message is about, and, where it concerns a booking, the name it was made in and the dates you asked for, so that we can find the right record without having to ask you for more details than we need. Questions about the booking terms themselves, about a price, a change of dates or a cancellation reach us at the same addresses, but they are answered under the Terms of Service rather than under this policy.