Privacy policy

Owner / controller: Villa DG Tax ID (NIF/CIF): [to be completed by the owner] Registered address: Camino Sifones, 44600 Alcañiz Email: reservas@villadg.com Website: https://villadg.com Tourism licence / registry number (Aragón): B55455638 Short-term rental registry number (NRUA, RD 1312/2024): [to be completed by the owner]

Some identification details are still marked as pending. They are maintained in the admin panel (Check-in › SES settings) and will appear here automatically once completed. In the meantime you may request them by email.

Booking and contact data: name, email, phone, stay dates, number of guests, notes, language, acceptance of terms, payment status and Stripe references (we never see or store full card numbers).

Online check-in / traveller register (RD 933/2021): for every guest, name and surnames, sex, identity document type, number and support number, nationality, date of birth, address, phone and email; kinship with a responsible adult when minors travel; payment method type. Document and support numbers are encrypted at rest (AES-256-GCM).

Technical data: strictly necessary cookies and session tokens, IP address and security logs (rate limiting, abuse prevention) and server logs.

Messages you send us by email or WhatsApp.

Performance of a contract / pre-contractual steps (Art. 6.1.b GDPR): handle enquiries, bookings, payments, confirmations, arrival instructions and the stay itself.

Legal obligation (Art. 6.1.c GDPR): registration of travellers and communication to the Ministry of the Interior through SES.Hospedajes within the time limits set by RD 933/2021 (within 24 hours of arrival), tax and accounting duties, and replying to requests from competent authorities.

Legitimate interest (Art. 6.1.f GDPR): security of the website and of the property, fraud prevention and defence of claims. We do not profile users for advertising.

Consent (Art. 6.1.a GDPR): only for optional communications you expressly request. We do not send newsletters by default and you may withdraw consent at any time.

Providing booking and traveller-register data is required to contract and to comply with the law; without it we cannot confirm the stay.

Ministry of the Interior (SES.Hospedajes) and security forces, as required by RD 933/2021 and Organic Law 4/2015.

Stripe Payments Europe, Ltd. (Ireland) – card payments, as independent controller for its payment services.

Resend, Inc. (USA) – transactional email delivery (booking confirmations, check-in reminders), as processor.

Hostinger International Ltd. – hosting of the website and database (EU), as processor.

Tax, legal or accounting advisers where necessary. We do not sell or rent personal data.

Data is hosted in the European Union. Where a processor is located outside the EEA (e.g. Resend, Stripe’s US entities), transfers rely on the EU-US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses.

Traveller register (RD 933/2021): 3 years from the end of the stay, then deleted.

Booking, invoicing and payment records: as long as the contractual relationship lasts and then for the statutory periods (generally 4 years for tax purposes and up to 6 years for commercial records), blocked during that time.

Security logs and rate-limit records: a short period (days) strictly needed to prevent abuse.

Enquiries that do not lead to a booking: up to 12 months.

You may exercise your rights of access, rectification, erasure, restriction, portability and objection, and withdraw consent, by writing to reservas@villadg.com (please attach proof of identity when necessary). We reply within one month.

Traveller-register data already submitted cannot be edited through the public check-in form for privacy reasons; contact us to correct it. Data that we are legally required to keep (RD 933/2021, tax law) cannot be erased before the statutory period ends.

If you consider your rights have been infringed you may lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid – www.aepd.es.

Bookings may only be made by adults. Data of minors is collected solely to comply with RD 933/2021 and is provided by the responsible adult, who must state the kinship.

We apply technical and organisational measures appropriate to the risk: HTTPS, encryption of identity document numbers, access control to the administration panel, rate limiting and periodic backups. We do not take decisions based solely on automated processing that produce legal effects on you.