Privacy policy.
1. Data controller
- Controller: 3 VILLAS ALQUILER VACACIONAL, SL (“3Villas”).
- Tax ID (NIF): B16510968.
- Address: Calle Sant Jaume, núm. 51, 07712 Maó-Mahón (Balearic Islands), Spain.
- Data protection contact: [email protected].
3Villas is not required to appoint a data protection officer. Any privacy question is handled at the address above.
This policy applies to the data collected through www.3villas.com and in the handling of bookings. It complies with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
2. What data we process
- Contact and enquiry data: name, e-mail, phone and the message you send us through a form, by e-mail or by WhatsApp.
- Booking data: name of the lead guest, contact details, dates, home, number of guests, price and messages about the stay.
- Payment data: card payments are processed by Stripe. 3Villas does not see or store the full card number; it receives only the payment confirmation and limited transaction data.
- Traveller register data: the identity data the law requires for every adult guest (name, document, date of birth, nationality and the other data set by the regulation).
- Job applications: the data and CV you send through the “Empleo” (jobs) form.
- Newsletter: the e-mail address you subscribe with.
- Browsing data: IP address, browser type and pages visited, and, only with your consent, measurement and advertising data through cookies (see the Cookie policy).
3. Why we use the data and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Answer enquiries and prepare quotes | Pre-contractual steps at your request (art. 6.1.b) |
| Handle the booking, payment, deposit, stay and incidents | Performance of the contract (art. 6.1.b) |
| Traveller register and reporting to the authorities (Royal Decree 933/2021) | Legal obligation (art. 6.1.c) |
| Invoicing, accounting and tax obligations | Legal obligation (art. 6.1.c) |
| Payment fraud prevention and website security | Legitimate interest (art. 6.1.f) |
| Assess job applications | Consent of the applicant (art. 6.1.a) |
| Send the newsletter | Consent (art. 6.1.a), which you can withdraw in every mailing |
| Measure the use of the website and advertising (Google Analytics, Google Ads) | Consent through the cookie banner (art. 6.1.a) |
We do not take automated decisions with legal effects on you.
4. Mandatory data
The fields marked as mandatory in the forms and in the booking are needed to handle your request or to comply with the law. If you do not provide them, we cannot handle the enquiry or the booking.
5. Who we share the data with
- Authorities: traveller register data is reported to the competent police forces, because the law requires it. Tax data is reported to the Spanish Tax Agency where applicable.
- Home owners: the data needed for the stay, when the management of the home requires it.
- Booking platforms: if you booked through a platform, we exchange the booking data with it.
- Insurers and professional advisers: when needed to handle a claim or defend a right.
6. Providers that process data on behalf of 3Villas
3Villas uses providers that access data only to deliver their service and under a data processing agreement:
- Website hosting: Hostinger (servers in the European Union).
- Booking system: Hostaway.
- Card payments: Stripe.
- E-mail and shared inbox: Google Workspace and Front.
- Real-estate sales management: eGO Real Estate.
- Traveller register: Poli Check-In.
- Measurement and advertising, only with consent: Google (Analytics, Tag Manager, Ads).
- Reviews shown on the website: Trustindex. Home pictures served by images.weserv.nl.
Some of these providers can process data outside the European Economic Area, for example in the United States. In that case the transfer relies on an adequacy decision, such as the EU-US Data Privacy Framework for certified companies, or on standard contractual clauses approved by the European Commission.
7. How long we keep the data
- Enquiries without a booking: up to one year after the last message.
- Bookings, invoices and payments: six years (Spanish Commercial Code, art. 30) and the periods set by tax law.
- Traveller register: three years (Royal Decree 933/2021).
- Job applications: one year, unless you ask us to delete them earlier.
- Newsletter: until you unsubscribe.
- Cookies: the periods stated in the Cookie policy.
After that, the data is blocked for the limitation periods of any possible liability and then deleted.
8. Your rights
You can exercise the rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent you gave at any time, without affecting the lawfulness of the processing before. Write to [email protected] or use the “Gestión de datos” (data requests) form on this website, stating the right you exercise. We answer within one month.
If you think we did not handle your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
9. Minors
The website is not aimed at children under 14. Bookings are made by an adult, who is responsible for the data of the minors in the group that the law requires to register.
10. Security
3Villas applies technical and organisational measures suited to the risk: encrypted connection (HTTPS), restricted access to the systems and payment through a certified provider.
11. Changes
We can update this policy. The version in force is always the one published on this page, with its date.
Last updated: [publication date].