VillaVerify
← Terug naar juridische documenten

Privacy Policy

Last updated: 1 October 2026

This Privacy Policy explains how Balearic Waves SL processes personal data through villaverify.com ("VillaVerify"), in line with the EU General Data Protection Regulation (GDPR) and the Spanish Organic Law on Data Protection and Digital Rights Guarantee (LOPDGDD). This document uses plain-language descriptions rather than precise legal citations.

1. Who is responsible for your data (the "controller")

The data controller is:

Balearic Waves SL Pl Dos Puntod Dos 120, 07820 Sant Antoni De Portmany, Ibiza, Spain CIF: B19739507 Contact: privacy@villaverify.com

VillaVerify does not currently offer user accounts. Almost everything you can do on the site (running a checker query, browsing the directory) can be done without creating any account or profile.

2. What we collect, and why

a. Checker submissions (licence numbers / listing URLs). When you run a check, we process the licence number or URL you submit in order to return a result. We keep an aggregate log of checks (the submitted value and the resulting tier/score) to improve the service and build our internal dataset. This log is not linked to any user account or identifier; we do not ask for or store your name, email, or a persistent user ID alongside a check.

b. IP addresses. We process your IP address to apply rate-limiting and stop abuse (for example, automated scraping). It is used only for this technical purpose and is not part of the check log or linked to your submissions. Technical data used for rate limiting, including IP addresses, is kept for no longer than 24 hours.

c. Operator-submitted data. Operators who use the "Claim this business" flow voluntarily provide business information, proof-of-control documents, contact details, and, optionally, the licence numbers of properties they exclusively manage and one or more IBANs for the IBAN-confirmation feature (see §3). This is covered in more detail in our Operator Terms.

d. IBAN hashes, never the IBAN itself. Where an operator opts into the IBAN-confirmation feature, we store a one-way cryptographic hash (HMAC-SHA256) of each IBAN they provide, not the IBAN itself. See §3 below.

e. Google review metadata. For operator profiles, we display the count and average rating of Google reviews. We never store or republish the text of any review: counts and ratings only. To show a public Google rating next to an operator, we query Google's Places API with the operator's public business name and town, store the resulting Google place identifier, and refresh the rating and review count at least every 30 days. We never store review text. Google's logo is shown next to the rating as required by Google. Google's processing is governed by its own privacy policy.

f. Forms (report, appeal, contact, guest-post submission). If you use a report, appeal, contact, or guest-post form, we process what you submit (which may include your name and email if you choose to give them) in order to respond to you and, where relevant, to run our evidence and moderation process described in the Content, UGC & Blacklist Policy.

g. Technical/cookie data. See our separate Cookie & Analytics Notice for our (minimal) use of self-hosted, privacy-friendly analytics.

3. The IBAN-confirmation feature, in plain terms

Some operator profile pages let a guest check whether an IBAN they were asked to pay matches that operator's own registered account(s): a targeted anti-fraud check, not a lookup tool.

  • Operators opt in and provide their own IBAN(s) during or after claiming their profile. We never solicit or accept a third party's IBAN.
  • We store only HMAC-SHA256(IBAN, secret key), a one-way hash. The plain IBAN is never stored.
  • When a guest submits an IBAN on that operator's page, we hash it the same way and compare it to the stored hash(es) for that one operator. We return only "matches this operator's records" or "not among this operator's registered accounts" (absence is not proof of fraud); we never display, return, or search IBANs.
  • The check only ever runs in the context of one specific operator's page; VillaVerify does not offer a general "look up this IBAN" search.
  • VillaVerify does not process payments or move money; this feature only compares data.

4. Our lawful bases for processing

  • Consent: for operator-provided data (business/contact details, licence numbers, IBANs), given when the operator submits the claim form.
  • Legitimate interest: for running the checker itself and maintaining the aggregate check-log dataset (our interest, and the public's, in consumer-fraud prevention in the Balearic short-term rental market), balanced against the minimal data collected (no persistent user identifiers).
  • Legitimate interest: for the guest side of the IBAN-confirmation check (fraud prevention), scoped narrowly as described in §3.
  • Consent / legitimate interest: for optional contact details you give us via forms, to respond to you.

5. Who we share data with

We do not sell personal data. We may share data with hosting and infrastructure providers who process it on our behalf under contract (as data processors); the relevant official licence-register authorities are never "sent" data. We only compare against data they already publish. Operator-provided data (contact details, exclusively-managed licence numbers, IBAN hashes) may also inform Balearic Waves SL's own related, disclosed businesses (for example Domundos) for direct-sourcing purposes. This is described fully, and separately flagged, in the Operator Terms.

The services we currently use, and what each one does:

  • Vercel: hosting and request logs
  • Supabase: the database
  • Resend: transactional email delivery
  • Zoho Mail: our own mailboxes
  • Umami, self-hosted on our own infrastructure: web analytics

Embedded map. Licence result pages that have coordinates show a map embedded from OpenStreetMap (openstreetmap.org). When such a page loads, your browser makes a request to OpenStreetMap, a third party, which receives your IP address. The embed sets no cookies, but the request itself reaches OpenStreetMap.

6. International data transfers

Some of our infrastructure or service providers may be located outside the European Economic Area. Where that is the case, we rely on an appropriate transfer safeguard (such as the EU Standard Contractual Clauses).

7. Retention

  • Aggregate check logs: kept indefinitely to build and improve our dataset, because they contain no user identifiers and so are not personal data.
  • IP addresses: used only for rate limiting and abuse prevention, kept for no longer than 24 hours.
  • Email delivery logs (technical records of whether the emails we send were delivered): kept for 30 days.
  • Operator claim data: for a claim that resulted in Verified status, kept for as long as that operator is shown as Verified, because the record is the evidence for a statement we publish about them, and deleted within 12 months of the Verified status being removed; for a claim that was rejected or withdrawn, kept for 24 months from the decision.
  • Form submissions (reports/appeals/contact enquiries/guest posts): kept for 24 months after we close the matter, to allow moderation and follow-up.

8. Your rights

Under GDPR/LOPDGDD you have the right to access, rectify, erase, or restrict processing of your personal data, to object to processing based on legitimate interest, to data portability where applicable, and to withdraw consent at any time (without affecting processing carried out before withdrawal). To exercise any of these, contact us at privacy@villaverify.com. You also have the right to complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD), at www.aepd.es.

9. Security

We apply technical and organisational measures appropriate to the data involved, including one-way hashing for IBANs, encrypted connections, and access controls limiting who can see operator-submitted data. No system is perfectly secure, and we cannot guarantee absolute security.

10. Children

VillaVerify is not directed at children, and we do not knowingly collect personal data from children.

11. Changes to this policy

We may update this Privacy Policy from time to time; the "Last updated" date above will change accordingly. Material changes will be flagged on the site.

12. Contact

Data protection queries: privacy@villaverify.com. We have not appointed a Data Protection Officer.