The statement covers the three actual data processing activities: booking processing via Booking.com, the legally required guest registration in Spain, and the server log files at STRATO. It takes into account that the data controllers are based in Germany and the rented property is located in Spain—meaning two supervisory authorities have jurisdiction, and both are named.
Privacy Policy
1. Data Controllers
The data controllers within the meaning of Article 4(7) of the GDPR are:
Stephan Wuensch and Katja Knabe
Christianspries 27
24159 Kiel
Germany
Email: villa-panoramica-yaiza@gmx.de
Phone: +491711715500
For inquiries regarding your data, you may contact either of the data controllers.
2. What Data We Process and Why
This website itself does not collect any personal data via forms. There is no contact form and no newsletter.
a) Booking via Booking.com
When you book the villa, you enter your data on Booking.com. Booking.com is the independent data controller responsible for processing the booking. We receive from Booking.com the data necessary to facilitate your stay: name, address, email address, phone number, booking period, number of guests, and payment information. Legal basis: Art. 6(1)(b) GDPR (performance of the accommodation contract) and Art. 6(1)(c) GDPR (compliance with legal obligations). Information regarding processing by Booking.com can be found in their privacy policy.
c) Server Log Files
When you visit this website, technical access data is stored in server log files:
IP address, date and time, page accessed, browser used, and operating system. This data is used to ensure the secure operation of the website and is deleted after 7 days.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation). The website runs on a server operated by STRATO AG, Berlin. STRATO processes this data on our behalf based on a data processing agreement pursuant to Article 28 of the GDPR.
No further disclosure of this data takes place.
d) Cookies and Embedded Content
The website uses a cookie consent banner. Technically necessary cookies are set without consent (Art. 6(1)(f) GDPR). All other cookies—analytics, marketing—are set only after you have given your explicit consent. You can revoke your consent at any time via the cookie settings.The website embeds videos from YouTube and contains links to Facebook and Booking.com. When you click on this content, data is transmitted to the respective providers. We have no control over how these providers process the data.
e) Google Search Console
We use Google Search Console to improve the website’s visibility. We do not analyse any personal data relating to individual website visitors.
3. Retention period
We store booking and invoicing data for the duration of the statutory retention periods. In Germany, tax-related documents must be retained for six or ten years in accordance with Section 147 of the German Fiscal Code (AO). The notification to the Spanish guest register is made within the statutory deadline and is stored there in accordance with Spanish regulations.
4. Recipients of the data
We only disclose your data to: Booking.com (for booking processing), the payment service provider, the Spanish authorities where required by law, the on-site support team in Yaiza where necessary for the organisation of your stay, and STRATO AG as the hosting provider.
Data will only be transferred to third countries outside the EU/EEA where this is necessary for the processing of your booking and the relevant safeguards under Article 46 of the GDPR are in place.
5. Your rights
You have the right of access (Article 15 GDPR), rectification (Article 16 GDPR), erasure (Article 17 GDPR), restriction of processing (Article 18 GDPR), data portability (Article 20 GDPR) and the right to object to processing (Article 21 GDPR). You may withdraw any consent you have given at any time with effect for the future.
To do so, please contact villa-panoramic-yaiza@gmx.de. You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority is:
Independent State Centre for Data Protection Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, https://www.datenschutzzentrum.de
Where the processing relates to the accommodation provider located in Spain, the Agencia Española de Protección de Datos (AEPD), Madrid, is also responsible.
6. Date
This privacy policy is dated 4 October 2026.