Privacy Policy

Data You Give Us We collect information about you when you register an account, make a booking, subscribe to our newsletter, or contact our customer service team. This includes:

Identity Data: First name, last name, title, date of birth.

Contact Data: Billing address, email address, and telephone numbers.

Financial Data: Payment card details (processed securely by our third-party merchant provider; we do not store full card numbers).

Transaction Data: Details about payments to and from you and other details of products and services you have purchased from us.

Profile Data: Your username and password, purchases or orders made by you, your interests, preferences, feedback, and survey responses.

Co-Traveller Data Where you provide personal data of other guests in your party (e.g. names and ages), you confirm that you have obtained their consent to share this data with us for the purposes of the booking.

Booking Fulfilment We use your data to: Process your booking request and communicate with the Property Owner/Supplier. Send you your booking confirmation, arrival instructions, and essential travel information. Collect payments and issue refunds. Notify you about changes to our terms or privacy policy.

Use of Artificial Intelligence (AI) We may use artificial intelligence tools (such as OpenAI/ChatGPT) to assist with customer support, content creation, and process efficiency.

Data Safety: We do not use AI tools to make automated decisions that produce legal effects concerning you (e.g. credit scoring) without human review.

Processing: Any personal data processed by AI tools is governed by strict Data Processing Agreements to ensure security.

Mandatory Data Sharing To fulfil your contract, we must share your personal data with the third-party Property Owner or Supplier of your specific villa. This is necessary for them to prepare the property and arrange your arrival.

International Security Laws (API) In certain destinations (including Spain, Italy, and Portugal), local laws (such as Spain's Royal Decree 933/2021) require accommodation providers to register the details of all guests with the police or local authorities.

What We Collect: We are legally required to collect the Full Name, Date of Birth, Passport Number, and Nationality of all guests aged 16 and over.

How It Is Used: This data is transmitted securely to the relevant local authority (e.g. Guardia Civil) via our secure API or directly by the Owner.

Retention: This sensitive data is deleted from our active systems 14 days after your check-out, though a record may be kept by the local authority as per their national laws.

Security Measures We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way. All information you provide to us is stored on our secure servers behind firewalls. Any payment transactions will be encrypted using SSL technology.

Data Retention We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. By law, we have to keep basic information about our customers (including Contact, Identity, Financial and Transaction Data) for six years after they cease being customers for tax purposes.

Your Rights Under GDPR Under certain circumstances, you have rights under data protection laws in relation to your personal data: Request access to your personal data (a "data subject access request"). Request correction of the personal data that we hold about you. Request erasure of your personal data where there is no good reason for us continuing to process it. Object to processing of your personal data where we are relying on a legitimate interest. Request restriction of processing of your personal data. Request the transfer of your personal data to you or to a third party.

To exercise any of these rights, please email us at info@bnbstay.co.uk. We try to respond to all legitimate requests within one month.