Privacy statement

Who is responsible

Paraiso Beach is a holiday apartment in Villajoyosa, Spain. The controller responsible for processing your personal data is Sandra Smeets. For questions and requests about your data, please email info@paraisobeach.nl or use the contact form.

What data we process

• Your name, email address and — if you provide it — your phone number.
• The dates and the number of guests in your booking request.
• The content of your message or comments.
• The language of the page and the time you sent the form; for a booking request, also the time you agreed to this statement.
• What we add ourselves: the price, the status of your request, your country and our own notes. A booking made by phone or email is recorded by us, with the same details.
• To protect the forms against misuse: codes calculated from your IP address, your email address and what you entered. Your data itself cannot be recovered from them.

Why we need this data

We use your data to answer your question, assess your booking request, carry out the rental agreement and meet our legal obligations as a landlord in Spain. We do not use your data for advertising and we do not sell it on.

A person always decides on your booking request: we do not use automated decision-making or profiling.

We need your name and email address to be able to reply; your phone number and comments are optional. The legal bases under the GDPR are:

• Your booking request and your booking: necessary to enter into and carry out a rental agreement at your request (Article 6(1)(b)).
• Your question via the contact form: our legitimate interest in answering it (Article 6(1)(f)).
• Accounting: a legal obligation, such as the statutory retention period for tax purposes (Article 6(1)(c)).
• Protecting the website against misuse: our legitimate interest (Article 6(1)(f)).

How long we keep it

We keep your data no longer than necessary. The website deletes it automatically every night, according to these periods:

• Messages via the contact form: twelve months after receipt.
• Booking requests that do not become a booking because they were declined or withdrawn: twelve months after that. A request that was never answered: twelve months after the requested departure date.
• Bookings, including those cancelled after confirmation: seven years from the end of the year of departure, for accounting and tax purposes.
• Your phone number, your comments and our notes on a booking: erased two years after departure. After that we keep only your name, email address, country and language, the dates, the number of guests and the amount, for the accounts.
• Codes used against misuse: 24 hours. One-time form codes: one day. Failed login attempts to the admin area: 30 days.
• The log of changes, without your name, contact details or messages, but with the reference, the dates, the number of guests and the price: as long as the booking exists, otherwise two years.
• Deleted data remains in the database backups for up to seven days.
• Outside the website: the administrators delete the emails they receive about your request or message from their mailboxes twelve months after receipt.

Who we share it with

We do not pass your data on to others, unless the law requires us to. The website does work with three services that process it on our instructions; they are listed below under Where your data is stored.

Your rights

You may ask us what data we hold about you, have it corrected or deleted, and object to its processing. You may also ask us to restrict its processing, or to provide your data in a file that you can pass on to someone else. Please send your request via the contact form or to info@paraisobeach.nl. We will reply within one month.

Data that we are required by law to keep, such as booking details for the accounts, can only be deleted once that period has ended.

If you disagree with how we handle your data, you can lodge a complaint with a supervisory authority: in the Netherlands the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), in Spain the Agencia Española de Protección de Datos (AEPD).

Where your data is stored

Whatever you enter on this site is stored in the website’s admin area, and the administrators receive an email about it. Only the administrators have access to the admin area, each with their own password and a code from an authenticator app. We do not put your data into newsletters or advertising platforms.

The website works with three services. They process your data only on our instructions, and we have a data processing agreement with each of them:

• Supabase: the website’s database and the administrators’ login. The database is located in Ireland.
• Vercel: the hosting. The pages are delivered by Vercel’s network; whatever you enter in a form is processed in Dublin. Like any hosting provider, Vercel processes your IP address and technical details of your request, such as the page requested.
• Resend: the email to the administrators about your request or message, sent from Ireland. It comes from noreply@paraisobeach.nl, with your email address as the reply-to address. The website itself never emails you: we reply to you personally.

Data outside the EU

Not everything stays within the EU. At Supabase, support and part of the network may be outside the EU. Vercel processes data mainly in the United States. Resend keeps account details and, for a limited time, the emails sent, including their content, in the United States.

These transfers are covered by the European Commission’s standard contractual clauses, which form part of the data processing agreements. Resend is also covered by the EU-U.S. Data Privacy Framework.

Protection against misuse

To prevent spam and misuse, we count how many forms are sent from an IP address and with an email address. For this, the database only stores a code calculated from the address, never the address itself; after 24 hours the website deletes that code.

When you fill in a form, it receives a one-time number, so that it cannot be sent too quickly or more than once. With that number we keep a code of what you entered for one day, not the content itself. That way, a form that is accidentally sent twice remains a single request.

The admin area is protected by a password and a code from an authenticator app. Failed login attempts are counted in the same way and deleted after 30 days.

What the website itself stores

The site does not place advertising cookies and does not track you across other websites. There are no statistics or analytics services, and the site loads nothing from other websites: fonts, photos and icons all come from this website itself.

In a cookie, we only remember your choice of language. Your browser sends this cookie only to this website, so that you see your own language straight away on your next visit. The cookie is only set when you choose a language yourself, and it lasts for one year. You can delete it at any time in your browser settings.

If you send a form just after the website has been updated, your browser briefly keeps what you entered in the same tab, so that it comes back after the page refreshes. It is deleted straight afterwards, or otherwise as soon as you close the tab.

Administrators receive a session cookie when they log in, which is only used in the admin area. Visitors to the website never receive this cookie.