Skip to content
Villa Capitan
EN ES DE FR RU

Legal

Privacy Policy

How we handle your personal data on villacapitan.com.

This page explains what personal data we collect, what we use it for, who we share it with, and what rights you have over it. If anything is unclear, write to us at info@villacapitan.com and we’ll explain it in plain English.

1. Data controller

  • Legal name: Villa Capitan (Profintis Group, S.L.U.)
  • Spanish tax ID (NIF): B54738364
  • Address: Orihuela Costa (Alicante), Spain
  • Email: info@villacapitan.com
  • Phone: +34 679 120 466

For any privacy enquiry or to exercise your rights, the contact is the same email address.

2. What data we collect

  • Booking data: name, email, phone, optional notes (for example check-in preferences), stay dates, number of guests, and the language you selected.
  • Payment data: card numbers and related details are processed directly by Stripe. They never reach our servers — we only store a transaction identifier.
  • Technical data: IP address, browser, and pages visited, logged by Vercel (our hosting provider) in access logs kept for 30 days for security and performance reasons.
  • Anonymous usage data (with your consent): if you accept the cookie banner, Google Analytics 4 records page views, device, country and language. Your IP address is anonymised. We do not collect personally identifiable data through Google Analytics. More details in our Cookie Policy.
  • Messages: if you write to us on WhatsApp, Facebook Messenger or Instagram, we process the name shown on your profile, the identifier that platform assigns to the conversation and the content of your messages, in order to answer your enquiry and manage your booking. We access Facebook and Instagram messages through Meta’s official API; nothing else from your profile is collected.

We do not collect special-category data (health, religion, political views, etc.) and we do not collect data from children.

3. What we use it for

  • To manage your booking: confirm it, send check-in instructions, reminders, and communicate with you during your stay.
  • To meet legal and tax obligations: guest registration, invoicing, and bookkeeping.
  • To prevent payment fraud, through Stripe.
  • To keep the site technically secure.

We do not use your data for marketing, and we do not share it with third parties for advertising. No newsletters, no profiling, no data sales.

  • Performance of a contract (Art. 6.1.b GDPR): to process your booking, communicate with you during the stay, and issue an invoice.
  • Legal obligation (Art. 6.1.c GDPR): to keep invoices and guest records for the periods required by Spanish law (5 years for tax records, under the General Tax Act and the Commercial Code).
  • Legitimate interest (Art. 6.1.f GDPR): technical security of the site (logs) and payment fraud prevention.

5. Who we share your data with

We work with a small set of suppliers that act as data processors, in the following categories:

  • Supabase (Supabase, Inc., 970 Toa Payoh North, #07-04, Singapore 318992) — PostgreSQL database for bookings, availability and email audit. Data stored in eu-west-1 (Ireland) region.
  • Payment processor — all card information and payments are handled directly by Stripe, never reaching our own servers.
  • Website hosting and database — cloud infrastructure providers, primarily with servers in the European Union.
  • Web analytics — we use Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to measure aggregated site usage, only if you have accepted the cookie banner. Google may process data on servers outside the EEA under the Standard Contractual Clauses and additional DPF (Data Privacy Framework) commitments. Google Privacy Policy.
  • Transactional email delivery — a specialised provider for booking confirmations, reminders and check-in instructions.
  • Corporate email — the provider of the info@villacapitan.com mailbox. If you email us at that address, your message is processed on their servers.
  • Messaging platforms — Meta Platforms Ireland Ltd (Facebook Messenger, Instagram and WhatsApp): if you contact us there, your messages travel through their infrastructure under Meta’s privacy policy. We do not pass your booking data to Meta.

We do not sell your data. We do not pass it on to third parties for marketing. If you need to know the specific names of our current providers, email us at info@villacapitan.com and we’ll share them.

6. International transfers

Some of our providers process data outside the European Economic Area. In those cases we operate under the Standard Contractual Clauses (SCC) approved by the European Commission, which offer adequate safeguards under the GDPR, or we use EU-hosted services where possible.

In particular, Google Analytics transfers data to the United States. Google is certified under the EU-US Data Privacy Framework and is committed to the Standard Contractual Clauses. If you’d rather not share your data with Google, reject the analytics cookies in the banner.

If you’d rather not send personal data by email, you can reach us via WhatsApp or by phone on +34 679 120 466.

7. How long we keep your data

  • Booking data (including contact details): 5 years from check-out, in line with the Spanish Commercial Code (art. 30) and the General Tax Act (art. 66).
  • Vercel access logs: 30 days.
  • Google Analytics data: 14 months from the last visit (the minimum possible setting).
  • Transactional emails on Resend: kept according to their policy, normally 30 days for deliverability and then deleted.
  • Messages on WhatsApp, Messenger and Instagram: for as long as we need them to handle your enquiry and, if you book, together with the booking data (5 years from check-out). Copies kept in our own systems are deleted on request (see section 8).

Once these periods are over, the data is deleted or anonymised.

8. Your rights

You have the right to:

  • Access your data.
  • Rectify it if it is inaccurate.
  • Erase it (“right to be forgotten”), unless we are required to keep it for tax reasons.
  • Restrict its processing.
  • Object to processing based on legitimate interest.
  • Portability: receive your data in a structured format.

To exercise any of these rights, write to info@villacapitan.com clearly stating what you want, and attach a copy of your ID document or passport so we can verify your identity. We will reply within a maximum of one month.

Deleting data obtained through Facebook or Instagram. If you contacted us via Messenger or Instagram and want us to delete what we hold, send a message on the same platform saying “delete my data” or email info@villacapitan.com from the address you used. We will delete the conversation and any copy in our systems within 30 days and confirm it to you, except for data we must keep by law (invoices and guest records).

9. Complaints

If you believe we have not handled your data correctly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

10. Changes to this policy

We may update this policy to reflect changes in legislation or in our services. The date of the last update is shown at the bottom of the page. If the changes are substantial, we will email people with an active booking.

Last updated: 19 September 2026