Privacy Policy

Data controller: Elizabeth Over

Contact: fincabooking@gmail.com

Last updated: 3 August 2026

This policy explains how we handle your personal data when you book a stay at Finca Rustica, in line with the EU GDPR (and UK GDPR where applicable).

1. What we collect

• Booking details: your name, email address, phone number, dates of stay, and number of guests.
• Payment: payments are processed by Stripe. We do not see or store your full card details — Stripe handles them directly.
• Technical: basic technical data such as standard server logs from our hosting provider (Vercel).

2. Why we use it (lawful basis)

• To take and manage your booking and payment — performance of a contract.
• To send booking confirmations and essential information about your stay — contract.
• To meet legal/accounting obligations — legal obligation.

3. Who we share it with

• Stripe (payment processing) and Resend (sending your confirmation emails).
• Supabase / Vercel as our database and hosting providers.
• We do not sell your data or share it for third-party marketing.

4. How long we keep it

• Booking and payment records are kept for 6 years to meet legal and accounting requirements, then deleted.

5. Your rights

• You may request access to, correction of, or deletion of your personal data, and object to or restrict certain processing. To exercise any right, contact fincabooking@gmail.com.
• You may complain to your data protection authority — in Spain, the Agencia Española de Protección de Datos (AEPD); in the UK, the ICO.

6. Data storage & security

• Data is stored securely with access controls. Direct database access is restricted; guest data is never exposed publicly through the website.