Privacy Policy

Responsible for the treatment

• Responsible: VESTA HOLIDAYS, S.L.U..
• CIF: B24903767.
• Home: Calle Francisco Guerrero Cazorla, 10, 2º A, 38004 Santa Cruz de Tenerife, Spain.
• Email: info@vestaholidays.es.
• Web form: Contact page.

This policy applies to data processing carried out through the vestaholidays.es website and to communications arising from requests received through its forms, email or contact channels linked to the Vesta Holidays brand.

Data that we can process

Through the contact form, email, calls, messages or communications related to a request for information, we can process the following data:

• Identification data: name, surname, company or representation, if applicable.
• Contact information: email, telephone, preferred communication channel and information necessary to respond.
• Data about the home: area, municipality, type of property, license or registration status, publication status, management needs and any information you decide to include in the message.
• Commercial context data: interest in preparing a home, reviewing existing management, evaluating prices, studying an investment or requesting a first orientation.
• Technical navigation data: IP address, online identifiers, language, pages visited, device, browser and data derived from cookies or similar technologies, as explained in the cookie policy.
• Data voluntarily included in communications, documents or files that you may send during a subsequent conversation.

We do not request special categories of personal data through the website. If a user voluntarily includes sensitive information or third-party data in a message, they must have sufficient legitimacy to do so and limit the information sent to what is strictly necessary.

Purposes

We may process data for the following purposes:

• Respond to queries received from the web.
• Initially assess whether a home can fit with Vesta Holidays’ management services.
• Prepare a commercial conversation, a service proposal or a preliminary needs review.
• Manage communications related to the consultation, follow-up of opportunities, clarifications and sending requested information.
• Maintain a reasonable history of conversations to avoid duplication, understand the context of a request and improve service.
• Manage forms, web security, spam prevention, technical maintenance and normal operation of the site.
• Measure website usage, analyze performance, understand what content works and improve navigation, always in accordance with the cookie policy and applicable consent settings.
• Comply with legal obligations, meet administrative requirements or defend legitimate rights and interests if necessary.

When a request evolves into a possible professional relationship, we may also process data to prepare meetings, request additional information, order documentation, carry out preliminary checks, prepare a proposal, record operational preferences or coordinate next steps.

If the relationship is not formalized, the information will not be used for purposes incompatible with the initial consultation. However, we may keep a minimum record of the communication to prove what was requested, what response was given, and avoid subsequent claims or misunderstandings.

Legal basis

The legal basis will depend on the specific purpose. When you send a form accepting this policy, we process your data based on your consent and the request that you yourself send us. When the communication seeks to receive information about services, budget or fit of a home, the treatment may also be based on the application of pre-contractual measures requested by the interested person.

Certain technical, security, abuse prevention, website maintenance or minimum conservation of communications treatments may be based on the legitimate interest of the person responsible, always weighing the rights of the affected persons. When there is a legal obligation, the treatment will be based on compliance with said obligation.

The use of non-technical cookies or analytical tools will be governed by the legal basis and the corresponding consent according to the applicable regulations and the cookie policy.

Common treatments per channel

For greater clarity, these are the usual treatments depending on the channel or situation:

• Contact form: management of the query, response, monitoring and preliminary assessment of the property fit.
• Email: response to messages, filing of necessary communications and sending requested information.
• Telephone or messaging: conversation about the request, coordination of next steps and clarification of data sent by the interested party.
• Web browsing: technical operation, security, language, measurement and improvement of the website in accordance with the cookie policy.
• Pre-contractual relationship: request for documentation, initial review of needs, preparation of proposal or budget.
• Contractual relationship: administrative, operational, accounting, fiscal, documentary and communications management necessary to provide the contracted service.

Data minimization

The first contact is designed to request only the information necessary to respond in a helpful way. It is not necessary to send deeds, ID, bank details, contracts, complete licenses, receipts or sensitive documentation in the initial form unless Vesta Holidays expressly requests it at a later stage.

If during a subsequent conversation documentation is requested from the home or the owner, the specific purpose will be indicated and only the information necessary to assess, prepare or execute the requested service will be processed.

Commercial communications

If a person requests information about Vesta Holidays services, we may respond with information related to that specific request. No unsolicited bulk commercial communications will be sent without legitimate basis or consent where necessary.

In subsequent communications linked to a query or commercial relationship, you can always request that we stop contacting you for commercial purposes, except for communications strictly necessary for a current contractual, legal or administrative relationship.

Conservation

We will retain the data for the time necessary to respond to the query, manage the relationship arising from it and maintain reasonable monitoring. If a commercial relationship is not initiated, the data of a request may be kept for the period necessary to address possible subsequent communications, avoid duplication and prove the management carried out.

When there is a contractual, pre-contractual relationship or legal obligation, the data may be kept for the periods required by civil, commercial, tax, accounting, tourism, consumer or any other applicable regulations. Once the necessary deadlines have expired, the data will be deleted or blocked where appropriate.

Technical data, cookies and analytical data will be kept according to the terms of each tool and the applicable configuration. You can consult more information in the cookies policy.

As a general rule, simple queries will be retained for the time necessary to respond and provide reasonable follow-up. Communications with potential contractual or pre-contractual relevance may be kept during the periods in which responsibilities may arise. Contractual documentation, billing, accounting or legal information will be kept for the periods required by applicable regulations.

Recipients and managers

We do not sell personal data. We may allow access to data to providers necessary to operate the website and provide related services: hosting, technical maintenance, email, forms, security, management systems, web analytics, professional advice, technological support or communication tools.

These providers will act, where appropriate, as data processors or independent controllers according to the service provided and their own conditions. In particular, the site loads Google tools through Site Kit or Google Tag Manager, which may process technical and navigation information in accordance with their policies.

Data may also be communicated when there is a legal obligation, a requirement from a competent authority, the need for legal defense or the intervention of advisors, public administrations, financial entities, professional suppliers or courts within the framework of a contractual or legal relationship.

Supplier Categories

To operate the website and manage requests we can rely on suppliers of different categories:

• Web hosting, security, backups and technical maintenance.
• Form managers, email, office tools and document storage.
• Web analytics, performance and traffic measurement tools.
• Tax, accounting, legal or administrative advice when necessary.
• Communication, agenda, documentation or internal management services.

Supplier access to personal data will be limited to what is necessary to provide the corresponding service. When they act as data processors, they must process the data following the instructions of the person responsible and with the required contractual guarantees.

International transfers

Some technology providers may process data outside the European Economic Area or be subject to international data transfer frameworks. When using third-party services that involve international transfers, we will ensure that there are adequate guarantees in accordance with the General Data Protection Regulation, such as standard contractual clauses, adequacy decisions or other valid mechanisms.

In particular, tools from large technology providers may involve international access or processing. The specific information will depend on the current configuration, the activated services and the policies of each provider.

Rights

You can request access, rectification, deletion, opposition, limitation of processing and portability of your data when applicable. You can also withdraw consent if the processing is based on it.

To exercise rights, use the Contact form or write to info@vestaholidays.es indicating the right you wish to exercise.

To process a request it may be necessary to prove the identity of the requesting person, especially if changes, access or deletion of information are requested. If you consider that the treatment does not comply with the regulations, you can file a claim with the Spanish Data Protection Agency.

How to exercise rights

To exercise your rights, clearly indicate which right you want to exercise and over what data or processing. If you write by email, use an identifiable subject such as “Data protection” or “Exercise of rights”.

We will respond within the legally established deadlines. If the request is complex, repetitive, excessive or does not allow the applicant to be identified, we may request additional information or act in accordance with the limits provided in the regulations.

The exercise of rights is free, except in legally provided cases of manifestly unfounded or excessive requests.

Obligation of truthfulness and third party data

The person who provides data guarantees that it is true, accurate and up-to-date. If data from third parties is provided, there must be sufficient authorization or legal basis to do so, informing said people when necessary.

Vesta Holidays may request additional information if the data received is incomplete, incorrect or insufficient to respond to a request.

Security measures

We apply reasonable technical and organizational measures to protect the information received, limit access to those who need to process it, prevent unauthorized access and maintain the confidentiality of communications. No system connected to the Internet can guarantee absolute security, but efforts are made to maintain a level of protection appropriate to the type of data processed.

Among other measures, efforts are made to limit internal access, use separate credentials, keep tools updated, reduce data requested in the first contact and avoid unnecessary processing. Effective protection also depends on the user not sending excessive or especially sensitive information through inappropriate channels.

Minors

The website is not directed to minors. Personal data of minors should not be sent through the form unless there is sufficient legal representation and a legitimate purpose related to the query.

Automated decisions

No automated decisions with legal effects on users are made based on the data sent by the form. Analytics tools may generate aggregate metrics or navigation statistics, but they are not used to automatically decide whether to accept a home or provide a service.

Relationship with the cookie policy

Browsing the website may generate technical and measurement data associated with cookies, tags or similar technologies. These treatments are explained in more detail in the cookie policy, which should be read in conjunction with this privacy policy.

Cookie settings may vary if measurement tools, forms, plugins, maps, videos or external services are activated or deactivated. For this reason, the technical treatments associated with navigation must be reviewed together with the current cookie policy.

Changes to this policy

This policy may be updated to reflect regulatory, technical, organizational or service changes. The version published on this page will be the one in force at all times.

When the change is relevant, efforts will be made to identify the update date so that the user can know which version they are consulting.