Privacy policy
v1.0 · 2026-07-14
Data collected
When you make a booking request: identity, email, phone, country, dates, group composition and message. Legal basis: pre-contractual measures (Art. 6.1.b GDPR).
Recipients & processors
Your data is processed by the owners and by our technical processors: Supabase (database, EU), Resend (email), Vercel (hosting, EU). No data is sold.
Retention & rights
Retained for 24 months without a booking, then purged/anonymised. You have the right to access, rectify and erase your data: privacy@villarosesardegna.com (reply within 30 days).