Privacy policy

Who is responsible for your data

Anna Małgorzata Ciok (NIE Y9608071L), Calle San Pedro Abajo 12, 38500 Güímar, Santa Cruz de Tenerife, Spain, is the controller for this website and for your booking. We are a small, family-run holiday home: there is no data protection officer — the person who answers you is the person who fixes things.

Privacy questions, requests and complaints: ania@ciok.art or +34 619 204 201.

The short version

We only process your data to run your booking and answer your questions. There is no account, no profiling and no data selling. Analytics and advertising measurement stay switched off until you consent, and you can switch them off again at any time.

Bookings and payments

When you book, we store your name, e-mail address, an optional phone number, your dates, the number of guests, the language of your booking and the amount paid. We use this to conclude and manage the rental contract: confirming the booking, sending the confirmation and arrival e-mails, your private booking page, and handling changes, cancellations and refunds. These e-mails are part of the service: we send no advertising e-mails.

Payments run through Stripe. We never see or store your card details; Stripe tells us only whether the payment succeeded.

Every booking has a private status page at a long random address that only you receive. Treat that link like a key.

Arrival instructions

On the day of arrival we e-mail the entry details (the key-box code and the Wi-Fi) to the e-mail address you booked with. Please keep them within your party: anyone with that message can open the door.

Messages and questions

If you call us, write to us or send a WhatsApp message, we use your contact details and what you write only to answer you and to organise your stay.

Traveller registration (required by law)

Spanish law (Real Decreto 933/2021) requires holiday homes to record who stays in them and to report each stay to the Ministry of the Interior through its SES.Hospedajes platform, normally within 24 hours. We may therefore ask you for the details the law lists (name, identity document, nationality and similar) for everyone in your party. We use them only for this registration. The reports go into files of the Ministry of the Interior, which the state security forces and bodies, the courts and the public prosecutor’s office can access by law.

If you ask for an invoice, we issue one with the details you give us (IGIC is included in the price).

Site security and abuse prevention

To keep the booking system working and to stop bots and card-testing abuse, the server keeps short-lived rate-limit records: salted one-way hashes of your IP address or e-mail address. The raw values are never stored and the hashes cannot be reversed. A bot check (Cloudflare Turnstile) protects the payment form, and our hosting provider (Cloudflare) processes technical request data to serve the site and defend it from attacks.

Analytics and advertising measurement (only with your consent)

With your consent, Google Analytics 4 tells us how the site is used — which pages are visited and how far visitors get in the booking process, pseudonymised, with no advertising personalisation — and the Meta Pixel shows us whether our adverts on Facebook and Instagram lead to bookings. Nothing optional is loaded or set before you agree. You can withdraw at any time via “Cookie settings” in the footer; the details are in the cookie policy.

Your cookie choice itself (accept, reject or individual categories) is stored only in your browser, expires after 12 months and never reaches our servers.

Legal bases

We only process your data on one of these grounds:

• Contract (Article 6.1.b GDPR): handling your booking, the payment and your stay.
• Legal obligation (Article 6.1.c GDPR): traveller registration and invoices.
• Legitimate interests (Article 6.1.f GDPR): keeping this site and its booking system secure and free of abuse.
• Consent (Article 6.1.a GDPR): analytics, advertising measurement and all non-essential cookies. You can withdraw consent at any time, with effect for the future.

Booking and payment details are needed for the contract itself: without them we cannot make a booking. The traveller-register data is a legal obligation: without it you cannot lawfully stay in a Spanish holiday home. Analytics and cookies are optional — you can use the site without giving anything.

Who receives your data

We do not sell your data. It goes only to the providers we need to run this site and your booking:

• Supabase — database hosting, servers in the EU (Ireland); stores bookings and guest contact details.
• Stripe — card payments; receives the booking amount and your contact details as the payer.
• Cloudflare — hosting and bot protection; processes technical request data.
• Our e-mail delivery provider — sends the confirmation and arrival e-mails on our behalf.
• Google (Analytics) and Meta (Pixel) — only if you have consented; see the cookie policy.
• The Ministry of the Interior (SES.Hospedajes) — the traveller data Spanish law obliges us to report.
• Public authorities where the law requires it — for example the police or the tax authorities.

If you book through a platform such as Booking.com instead, it is that platform that processes your data and that — as EU law has required since May 2026 — shares booking data with the authorities; please see the platform’s own privacy information.

Transfers outside the European Economic Area

Some of the providers above are based in the United States (Stripe, Cloudflare, Google, Meta). They are certified under the EU–US Data Privacy Framework, or we rely on the European Commission’s standard contractual clauses together with additional safeguards. Transfers are limited to what each purpose needs.

How long we keep your data

We keep your data no longer than each purpose needs:

• Bookings and invoices: for as long as Spanish tax and commercial law requires (up to six years).
• The traveller register: three years, as required by Real Decreto 933/2021.
• Correspondence: up to two years after your stay.
• Rate-limit records: 30 days at most.
• Analytics: Google Analytics data at most 14 months; its cookies 2 years (see the cookie policy).
• Your cookie choice: 12 months.

Your rights

You can ask us at any time to:

• give you access to the data we hold about you;
• correct anything that is wrong;
• delete data we no longer need;
• restrict certain processing, or stop it where you object;
• hand you your booking data in a machine-readable format (portability);
• take account of a consent you withdraw — cookies, for example, can be withdrawn at any time via “Cookie settings” in the footer.

Write to ania@ciok.art; we answer within one month. If our reply does not satisfy you, you can complain to the Spanish data protection authority (AEPD, www.aepd.es) or to the authority of your home country in the EU.

Children

Children are welcome guests, but a booking must be made by an adult. We do not knowingly collect data directly from children: a child’s data reaches us only through the booking made by their parent or guardian — including the traveller register the law requires.

How we protect your data

Everything runs over encrypted connections (HTTPS), access to the data is restricted, payments are handled exclusively by Stripe, and our servers store neither raw IP addresses nor card data. Sensitive access details go only to the e-mail address of a confirmed booking. If the worst happened, we would inform you and the AEPD, as the law requires.

No automated decisions

We do not profile you, and nothing about your data is decided automatically.

Changes to this policy

If this policy changes, the new version appears here with a new date. If you have an active booking, we will also e-mail you about a material change.