en
My booking
Check availability

Legal

Privacy policy

This English version is provided for information only. The legally binding version is the Spanish version (Política de privacidad).

Last updated: September 2026

1. Controller

Ursula Heimerdinger, trading as “Villa Rosalva”, Carretera Las Dehesas 37, Camino de los Perez, 38400 Puerto de la Cruz, Tenerife, Spain. NIF/NIE: ESX-3358898-R. Email: villarosalva@villarosalva.com, telephone: +34 922 37 37 09.

We process personal data in accordance with the General Data Protection Regulation (GDPR) and the Spanish data protection act (Ley Orgánica 3/2018, LOPDGDD). We are not required to appoint a data protection officer. For any questions about data protection, you can reach us at the address above.

2. Visiting the website

When you access the website, our hosting providers process technically necessary data: IP address, date and time, page visited, browser and operating system. This is necessary to deliver the website, protect it against attacks and find errors (Art. 6(1)(f) GDPR, legitimate interest in secure operation). These logs are automatically deleted after a short time, at the latest after 30 days.

Audience measurement with Rybbit: To understand how our website is used, we use the open-source tool Rybbit. We run it ourselves on a server of Hetzner Online GmbH in Germany; the data is not passed on to third parties. It records the pages visited, the referring website, browser, operating system, device type, screen size, language and the approximate country and region. Your IP address is only used to determine the approximate location and is not stored. So that repeat visits are counted as one visitor, your browser stores a random identifier in local storage (localStorage). Rybbit may also record visits as session recordings – mouse movements, clicks, scrolling and the page content shown – so that we can identify and fix usability problems. Entries in form fields (such as your name, email address or telephone number) are masked in your browser and not transmitted; the payment form of our payment service provider is not recorded. Pages with personal booking data (guest portal, booking confirmation, guest registration) are excluded from measurement and recording. We report completed bookings to Rybbit without any details about you (accommodation type, length of stay, number of guests, price, payment method) so that we can see which pages lead to bookings. We do not use analytics cookies, do not create cross-site profiles and do not use the data for advertising. The legal basis is our legitimate interest in designing the website to meet visitors’ needs (Art. 6(1)(f) GDPR). You can prevent measurement by clearing or blocking your browser’s local storage for this website or by using a tracking blocker.

3. Cookies and local storage

We only use what is necessary for the website to function, plus an identifier for audience measurement (Art. 6(1)(b) and (f) GDPR):

  • Booking process: During a booking, your browser stores the selected reservation and your entries in session storage (sessionStorage) so that they are not lost if you go back a page. The data is deleted when you close the tab.
  • Payment: On the booking page, our payment service provider Stripe embeds its payment form. Stripe sets cookies to prevent fraud and to process the payment securely.
  • Booking system: A session cookie is set when staff log in to the administration area (valid for 12 hours).
  • Audience measurement: your browser stores a random visitor identifier in local storage (localStorage, key “rybbit-visitor-id”), see section 2.

4. Booking accommodation

Data: first name and surname, email address, telephone number, country, number of adults and children, travel dates, selected accommodation and extras, your message to us, and the payment details of the booking.

Purpose and legal basis: conclusion and performance of the accommodation contract, including booking confirmation, payments, arrival information and invoices (Art. 6(1)(b) GDPR); compliance with tax and commercial law obligations (Art. 6(1)(c) GDPR).

Retention period: We keep booking and invoice data for as long as tax and commercial law requires (usually six years after the end of the financial year, Art. 30 Código de Comercio (Spanish Commercial Code)). We automatically delete data from incomplete (unpaid) booking attempts on the planned arrival date, but no later than three months after the booking attempt.

5. Payments

We process payments through Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland). Stripe receives the data needed for the payment (name, email address, amount, payment method). You enter card and PayPal details directly with Stripe; we do not see them. For a deposit payment, Stripe stores the payment method so that the balance can be collected on the agreed date. If you pay by bank transfer, Stripe provides you with dedicated bank details and a payment reference. The legal basis is Art. 6(1)(b) GDPR. Stripe is itself the controller for part of the processing (e.g. fraud prevention, legal obligations): Stripe’s privacy policy.

6. “My booking” guest portal

Using your email address, you can request a login link and view your bookings, invoices and outstanding amounts. For this, we process your email address and a random access code; only an irreversible hash value is stored. Login links are valid for a maximum of 30 days, sessions for 24 hours (Art. 6(1)(b) GDPR).

7. Guest registration form (reporting obligation)

Spanish law requires us to record the details of all travellers and transmit them to the Ministerio del Interior (Spanish Ministry of the Interior) via the SES.HOSPEDAJES platform (Ley Orgánica 4/2015 and Real Decreto 933/2021).

Data: name, date of birth, sex, nationality, type and number of identity document, address, telephone or email, for minors the relationship to the accompanying adult, travel dates and booking details.

Legal basis: Art. 6(1)(c) GDPR (legal obligation). Without this information, we are not permitted to accommodate you.

Recipients: the competent security authorities via SES.HOSPEDAJES.

Security and retention period: We store identity document numbers in encrypted form; every access is logged. The data is deleted three years after your departure, as required by Real Decreto 933/2021.

Newsletter: You can subscribe to our newsletter using the form on our website, or voluntarily tick a box on the guest registration form to say you would like to receive news from us. To make sure the email address belongs to you, we first send you an email with a confirmation link (double opt-in); you only receive the newsletter after you click it. If you do not confirm, we remind you once at most. As proof, we store the time and wording of your consent and the time of your confirmation. We use your email address and, if provided, your name for our newsletter on the basis of your consent (Art. 6(1)(a) GDPR, Art. 21 LSSI-CE) until you withdraw it. Every newsletter contains an unsubscribe link; you can also unsubscribe by sending us a short email. We use the Plunk service to send it (see section 11).

8. Contact by email, telephone or WhatsApp

If you contact us, we process your details in order to answer your enquiry (Art. 6(1)(b) GDPR for booking enquiries, otherwise point (f)). If you use WhatsApp, WhatsApp’s privacy policy (WhatsApp Ireland Limited) also applies. We delete enquiries that do not lead to a booking after two years at the latest.

9. Emails we send

We send booking confirmations, payment reminders, arrival information, invoices and login links via Cloudflare’s email service (see section 11). These emails are part of performing the contract (Art. 6(1)(b) GDPR).

10. Occupancy calendar

To manage occupancy, we transfer bookings (name, travel dates, accommodation, number of guests, booking number) to non-public calendars from Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The legal basis is Art. 6(1)(f) GDPR (legitimate interest in reliable occupancy planning).

11. Service providers (processors)

We use service providers who process data only on our instructions and with whom we have concluded contracts under Art. 28 GDPR:

  • Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA): operation of the booking system (servers, database, file storage), protection against attacks and sending our emails.
  • Webstudio, Inc. (USA): provision and hosting of the website.
  • Google Ireland Limited: occupancy calendar (see section 10).
  • Plunk (useplunk.com): sending our newsletter to people who have subscribed to it.
  • Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany): server for our audience measurement with Rybbit (see section 2).

12. Transfers to third countries

Some service providers are based in the USA or may process data there. Cloudflare, Google and Stripe are certified under the EU-US Data Privacy Framework, for which there is an adequacy decision by the European Commission. Otherwise, we base transfers on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

13. Links to other services

Our website links to Google Maps, Instagram, Facebook, YouTube and WhatsApp. Data is only transmitted to the respective provider once you click such a link; that provider is then responsible for it. We serve fonts and images from our own servers.

14. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw your consent at any time with effect for the future (Art. 7(3)). Simply write to us at villarosalva@villarosalva.com.

You can also lodge a complaint with a data protection supervisory authority; in Spain, this is the Agencia Española de Protección de Datos (AEPD, Spanish Data Protection Agency), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.

15. Obligation to provide data, no automated decision-making

We need the information marked as mandatory in the booking form and the guest registration form for the contract or because of legal obligations; without it, a booking or stay is not possible. No automated decision-making, including profiling, takes place.

16. Changes

We update this privacy policy when our processes or the legal situation change. The version published on this page at the time applies.