Legal information
Privacy policy
Controller and contact
Finca Son Set Inversiones, S.L., Spanish tax number B57979932, Carrer Illes Balears 105 T, 07014 Palma, Mallorca, Spain. Write to this address marked “Data protection”, email fincasonset@gmail.com or call +34 601 908 930. You may also use these contact details to exercise your data protection rights.
The data we process
When you enquire about or book a stay, we process your name, email address, dates, guest and infant numbers, amount, payment method and status, booking references, telephone number, postal address and messages you send us. Required fields are identified in the form. We need them to process your booking. Do not submit health information or identity documents through the booking form.
Purposes and legal bases
We handle enquiries, availability, bookings, payments and assistance during your stay to take the pre-contractual steps you request and perform the contract (GDPR Article 6(1)(b)). Tax, accounting and, where applicable, traveller-registration duties are based on legal obligations (Article 6(1)(c)). We process technical connection data to protect the service and prevent fraud on the basis of our legitimate interest in security, balanced against your rights (Article 6(1)(f)). We do not use booking data for marketing without a specific legal basis or make solely automated decisions producing legal or similarly significant effects.
Payments and external services
For card payments, you are redirected to Stripe’s hosted checkout. We share the information necessary for the payment and booking. Stripe collects card details within its own environment and returns the payment outcome and transaction references. The Son Set website does not collect your full card number. Stripe also processes data for its regulatory and fraud-prevention duties under its own privacy policy. Bank transfers involve the relevant financial institutions.
Recipients and hosting
Where necessary and subject to the applicable contractual safeguards, data may be accessed by authorised personnel and providers of hosting and technical infrastructure (OpenAI Sites and Cloudflare), transactional email (Resend), maintenance and professional advice. Data is disclosed to public administrations, authorities and financial institutions where legally required or necessary for payment. The Holidu calendar is checked by our server to verify availability; this does not send your booking-form details to Holidu. We do not sell your data.
Links and international transfers
WhatsApp, Google Maps and Stripe are external services. WhatsApp and Google Maps open only when you follow their links; their providers process data under their own policies. International technology services may involve access from outside the European Economic Area. Where applicable, we use an adequacy decision or safeguards under GDPR Article 46, including standard contractual clauses and any necessary supplementary measures. Contact the controller for information about providers, destinations and safeguards.
Retention
We retain enquiry data while handling your request and booking data during the contractual relationship. Afterwards, we keep only what is needed for legal obligations or potential liabilities, with restricted access or blocking where appropriate: accounting records for six years and tax documentation for the general four-year period, subject to interruptions, extensions and other applicable duties. Enquiries that do not lead to a booking are reviewed for deletion when no longer needed and are not retained indefinitely. These periods do not authorise marketing use.
Your rights
You may request access, rectification, erasure, restriction, objection and, where applicable, portability by contacting the controller. You may withdraw consent where processing is based on it, without affecting earlier lawful processing. Identify your request and provide a way to reply; we ask for additional identity evidence only if necessary. We normally respond within one month, subject to the reasoned extensions permitted by the GDPR. You may also complain to Spain’s data protection authority, the Agencia Española de Protección de Datos: www.aepd.es.
Other guests and children
The person making the booking must be an adult and supply accurate information. If you provide data about other guests, you must inform them of this policy and have a lawful basis for sharing it. The booking form asks only for the number of infants, not their names. Any information legally required for traveller registration is collected separately with the corresponding privacy information.
Agencia Española de Protección de Datos · Stripe privacy policy