Privacy Policy

Solwyn · Last updated: [DATE]

1. Who we are

This website is operated by Solwyn, S.L. (“Solwyn”, “we”, “us”), the data controller (responsable del tratamiento) for the personal data described in this policy.

We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR. Data protection enquiries should be sent to the address above.

This policy is issued under Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD), and Law 34/2002 on Information Society Services and Electronic Commerce (LSSI-CE).

2. What Solwyn does, and what that means for your data

Solwyn is a booking platform for rural and farmhouse stays across the Mediterranean. We publish editorial content about the properties we work with, and we facilitate bookings between travellers and independent property owners (“hosts”).

This matters for your data because:

• When you book a stay, we act as controller for the booking data we hold and process on our own platform.
• The host acts as a separate, independent controller for the data we pass to them in order to deliver your stay. Their own privacy policy governs what they do with it once received.
• We are not the provider of the accommodation. We facilitate the transaction.

3. Data we collect

3.1 Data you give us directly

Enquiry and contact forms — name, email address, and the content of your message.

Newsletter subscription — email address, and the date and source of your consent.

Property submissions (“Know a hidden gem?”) — your name and contact details, and any details you provide about the property. If you submit information about a property you do not own, please do not include personal data about third parties without their knowledge.

Booking a stay — full name, email, telephone, postal address, country of residence, arrival and departure dates, number and names of guests, and any special requests, dietary requirements or access needs you choose to tell us. Where you tell us about health-related needs (allergies, mobility, dietary restrictions), this may constitute a special category of data under Article 9 GDPR, which we process solely on the basis of your explicit consent in order to arrange your stay.

Payment — card and payment data is collected and processed directly by Stripe as an independent controller. Solwyn does not receive, store or have access to your full card number. We receive only a transaction reference, the amount, the currency, the payment status and the last four digits of the card.

Host and partner data — where you apply to join or are onboarded as a host, we collect your name, contact details, business or trading name, property address, tax identification number, bank or payout details, and identity or ownership documentation as required for verification and for our legal obligations.

3.2 Data collected automatically

When you visit the site we collect IP address, browser type and version, device type, operating system, referring URL, pages viewed, and time and duration of visit. This is collected through cookies and similar technologies. Non-essential cookies, including analytics and marketing cookies, are only set once you consent through our cookie banner. See our Cookie Policy for the full breakdown.

3.3 Data from third parties

We may receive data about you from our hosts (for example, confirmation that a stay was completed or amended), from social media platforms where you interact with our accounts, and from payment and fraud-prevention providers.

4. Why we process your data, and on what legal basis

DAC7 reporting

As an operator of a digital platform that facilitates the rental of immovable property, Solwyn is subject to reporting obligations under Council Directive (EU) 2021/514 (DAC7), transposed in Spain by Royal Decree 117/2024. We are required to collect, verify and report to the Spanish tax authority (Agencia Estatal de Administración Tributaria) identifying and financial information about hosts who earn income through the platform, including name, address, tax identification number, property address, and the consideration paid in each quarter. This information may then be exchanged with the tax authorities of other EU Member States. This is a legal obligation and hosts cannot opt out of it while using the platform.

5. Who we share your data with

We share personal data with the following categories of recipient:

Hosts. We transmit the details necessary to deliver your stay to the property you have booked. Each host is an independent controller of that data.

Service providers acting as processors on our behalf, under Article 28 GDPR contracts:

• Framer — website hosting and content delivery
• Stripe — payment processing (Stripe acts as an independent controller for card data)
• [Email provider] — transactional email and newsletter delivery
• Google — analytics and tag management, subject to your cookie consent
• [Booking / channel management provider] — calendar synchronisation and reservation management
• [CRM provider], where applicable

Professional advisers — accountants, gestoría and legal advisers, bound by confidentiality.

Public authorities — tax authorities under DAC7 and general Spanish tax law, and courts, police or regulators where we are legally required to disclose.

We do not sell your personal data. We do not share it with third parties for their own marketing purposes.

6. International transfers

Solwyn operates across the Mediterranean, including in countries outside the European Economic Area. Where you book a property located outside the EEA — for example in Morocco — your booking data will necessarily be transferred to the host in that country in order for your stay to take place. This transfer is necessary for the performance of the contract between you and the host, under Article 49.1.b GDPR.

Where our service providers process data outside the EEA, we rely on an adequacy decision of the European Commission where one exists, or otherwise on the European Commission’s Standard Contractual Clauses together with any supplementary measures required. You may request a copy of the relevant safeguards by writing to us.

7. How long we keep your data

After these periods, data is deleted or irreversibly anonymised. Data may be retained beyond these periods where it is blocked (bloqueo) under Article 32 LOPDGDD, meaning it is held solely at the disposal of public authorities for the resolution of possible liabilities.

8. Your rights

You have the right to:

• Access the personal data we hold about you
• Rectify data that is inaccurate or incomplete
• Erase your data (right to be forgotten), where the conditions apply
• Restrict processing in certain circumstances
• Object to processing based on our legitimate interests, and to object to direct marketing at any time
• Data portability — receive your data in a structured, machine-readable format
• Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal
• Not be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We do not carry out such processing.

To exercise any of these, write to [privacy@solwyn.co] or to our registered address, stating which right you wish to exercise. We may ask you for proof of identity. We will respond within one month, extendable by a further two months for complex requests, in which case we will tell you within the first month.

Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive.

If you believe we have not handled your data correctly, you may complain to the Spanish supervisory authority:

Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan, 6, 28001 Madrid
www.aepd.es — Tel. 901 100 099 / 912 663 517

You may also complain to the supervisory authority of your country of residence.

9. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit (TLS), access controls on a need-to-know basis, and confidentiality obligations for staff and contractors. No system is entirely secure, and we cannot guarantee absolute security. If a breach occurs that is likely to result in a high risk to your rights, we will notify you and the AEPD as required by Articles 33 and 34 GDPR.

10. Minors

Our services are directed at adults. We do not knowingly collect personal data from anyone under 14, the age of digital consent in Spain under Article 7 LOPDGDD. Where a booking includes children travelling in your party, you confirm you have parental responsibility for them or the authority of those who do. If you believe a minor has provided us with data, contact us and we will delete it.

11. Changes to this policy

We may update this policy to reflect changes in our services or the law. The version in force is always the one published on this page, with the date shown at the top. Where changes are material, we will notify registered users by email.

This is a working draft prepared for review. It is not legal advice and should be reviewed by a qualified adviser before publication. Placeholders shown in [square brackets] must be completed.