Villa Valentín

Villa Valentín Privacy Policy

Effective date: October 25th, 2026

1. Privacy policy and consent to use your data

We take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this data protection declaration.

This privacy policy applies to:

  • (A) our website, villavalentin.com, and bookings made through it (Part A)
  • (B) guest communication over WhatsApp through the WhatsApp Business Platform (Meta Cloud API) on +1 541-639-7953 (Part B)
  • (C) our mobile iPhone and Android apps ("app") (Part C)

It explains the type, purpose, and scope of data collection for each of them.

We would like to point out that data transmission on the Internet may be subject to security gaps. A complete protection of data against access by third parties is not possible.

2. Responsible body (controller)

"Responsible body" means the body that collects, processes, or uses personal data (e.g. names, email addresses, etc.).

Details of the responsible body: KAH OREGON HOLDINGS, LLC, operating Villa Valentín C. Palapa 12, Ojo de Agua, 63023 Sayulita, Nayarit, Mexico Email: [email protected] · Phone/WhatsApp: +1 541-639-7953

Data Protection Officer: AVIV HADAR, CEO

If you wish to object to the collection, processing, or use of your data by the responsible body in accordance with these data protection regulations, as a whole or for individual measures, you can send your objection by email or letter to the contact data above.

---

Part A: Website and bookings

A1. Information we collect

  • Booking and inquiry details: name, email, phone number, address, travel dates, number of guests (including children and pets), and special requests (for example, weddings, retreats, or concierge services).
  • Payment information: processed by our booking platform and our payment processor Stripe. We do not store full card numbers ourselves.
  • Messages you send us by email or through the website's AI concierge chat.
  • Device and usage data, such as IP address, browser, pages visited, and referring site, collected through cookies and analytics.

A2. How we use it

To answer inquiries; manage reservations, payments, and stays; arrange the services you request (concierge, weddings, retreats, transportation); run, secure, and improve the website; and meet our legal, tax, and accounting obligations.

A3. Cookies and analytics

The website runs on Lodgify and shows a cookie consent banner where you can accept or customize functional and analytical cookies. We use Google Analytics (Google Tag Manager / gtag) to understand how the site is used. You can change your choices in the banner, block cookies in your browser, or use Google's opt-out add-on (https://tools.google.com/dlpage/gaoptout).

A4. Service providers

  • Lodgify (website, booking engine, and checkout)
  • Payment processors connected to Lodgify and Stripe
  • Google (Analytics and Fonts)
  • Bunny.net CDN (website images and scripts)
  • Netlify (hosts the website's AI concierge chat)
  • Cloudflare (website security and message routing)
  • Local providers you ask us to book for you (for example, drivers, chefs, or wedding vendors)

---

Part B: WhatsApp communication

We use the WhatsApp Business Platform (Meta Cloud API) to communicate with guests on +1 541-639-7953.

  • What we collect: your WhatsApp phone number, profile name, the messages and media you send, and technical message details such as timestamps and delivery or read status.
  • How we use it: only to answer your inquiries, coordinate your booking and stay (arrival, concierge requests, check-in and check-out), and send messages about your reservation. We do not send marketing on WhatsApp without your consent.
  • Processing by Meta: messages are transmitted and processed by Meta Platforms, Inc. / WhatsApp LLC under the WhatsApp Business terms (https://www.whatsapp.com/legal/business-terms) and Meta's Privacy Policy (https://www.facebook.com/privacy/policy). Incoming messages are relayed to us through Cloudflare.
  • Retention: we keep conversations as long as needed to handle your inquiry or stay, and generally no longer than 3 months after your last message or checkout, unless the law requires longer.
  • Opt-out and deletion: reply STOP, or tell us you no longer want WhatsApp messages, and we'll stop. To have your conversation history deleted from our systems, message us on WhatsApp or email [email protected]. Copies on your own device are controlled by your WhatsApp app and Meta's policies.

---

Part C: Guest mobile app (iPhone and Android)

C1. Collection, processing and use of personal data

Basically you can download and use our app without being personally identifiable. You are not required to disclose any personal information. We only get the push ID of the app installation. This data is anonymized and does not allow any conclusions to be drawn about your person. This information is evaluated for statistical purposes only. As an individual user you remain anonymous.

The collection of further personal data by this app only takes place if we are legally entitled to do so or if you have expressly consented to the data collection in question.

C2. Data collection in the context of app use

Personal data may be collected as part of the use of the app, in particular in the following manner: 1. Your data will be collected on the basis of the access rights required by this app and granted to us (e.g. location data), see C4. 2. Data you enter in the app.

Purpose of data processing: providing hotel services, i.e. digital guest communication between us and our guests.

Type and scope of data collection, processing and use: guests enter personal data in the app. This data is forwarded via AWS Mailclient to our email address. After the message is sent, the sent message, and with it the personal data, is deleted, depending on the applicable law.

Amazon Web Services, Inc., P.O. Box 81226, Seattle, WA 98108-1226, http://aws.amazon.com The hosting takes place via Amazon Web Services (server rooms), AWS Region Ireland.

The app platform is provided by Gastfreund

Possible personal data of the guest (contact details): name; address; phone number; email; number and age of children (if relevant for booking a room); time and duration of stay; date and place of birth.

Notice: should users of the services enter personal data of third parties, this must be done with their consent.

Circle of persons concerned: users of services offered by us (guests).

C3. Analytical tools

When you access our app, your behavior can be statistically evaluated using specific analysis tools and analyzed for market research purposes or to improve our offerings.

Firebase: Firebase is a real-time database. It can be used to embed real-time information. User data is transmitted to Firebase anonymously. Firebase is part of Google and is based in San Francisco (CA), USA. Firebase's privacy policy: https://firebase.google.com/support/privacy

Google Analytics: in order to comprehensively optimize our offers, we use the web analysis service Google Analytics, which uses cookies to scan usage both in real time and over the long term. The data is usually transmitted to US servers and stored there. Because we have activated IP anonymisation, however, Google must first shorten your IP address in EU and EEA countries (only in exceptional cases, such as technical failures in Europe, may the IP address be shortened in the USA instead). You can object to the described data collection and processing in apps by deactivating them in the settings (on Android and iOS directly in the app menu under Privacy Policy).

C4. Access rights of the app

To provide our services through the app, we need the access rights listed below, which allow us to access certain functions of your device.

  • Location: the app accesses your exact GPS location. The GPS data is required to display your location on the map and to calculate the distance. If access to the exact data is not possible, the application accesses the approximate, network-based location.
  • Images, media, files: the app requires access rights to change or delete SD card contents. This right is required for downloading app photos and for uploading feedback photos and basic entry photos. The protected memory must be tested to check whether a file is stored in the SD card memory or in the internal memory of the phone.
  • Camera: the access right to your device's camera allows you to upload a photo for the feedback function or when suggesting a basic entry. You can also scan QR codes with the camera and go directly to your desired page.
  • Wi-Fi connection information: the Wi-Fi connection is called up to allow you access to the app via Wi-Fi.
  • Miscellaneous: the application also requires access to the Internet to download app content from the backend so that you can access the app from your mobile phone. The application must detect whether the idle state of your device is deactivated in order to be able to send push messages via the news function.

C5. Storage of data

GPS data is cached in the app until it is replaced by an updated location. This position data is not personalized and does not allow any conclusions to be drawn about persons or end devices. Images from the device or camera are only processed in the context of feedback requests, sent by email. The push ID of the respective app installation is saved by default. This data is anonymized and does not allow any conclusions to be drawn about persons or end devices. All data will be saved until the app is deleted.

C6. Links

In our app you will find links to other websites, such as partners, touristically relevant websites, and magazines. While we strive to maintain links only to sites that share our high standards and respect for privacy, we are not responsible for the content and security of these other sites or their handling of personal information. Therefore, once you have left our app, we cannot assume any responsibility for the protection of the data you subsequently provide. In any case, you should exercise care and read the privacy statements of the websites concerned carefully.

---

3. Sharing

We do not sell your personal information. We share data only with the providers named in Parts A–C, with local providers you ask us to book, and with authorities when the law requires it. Our providers may process data in the United States, the EU (including AWS Ireland), and other countries, under their standard safeguards.

4. Security and encryption

Our website and app use SSL/TLS encryption for security reasons and to protect the transmission of confidential content, such as the requests you send to us. This encryption prevents the data you transmit from being read by unauthorized third parties. WhatsApp messages are protected in transit by WhatsApp/Meta. We also use access controls and trusted providers.

5. Retention

We keep personal data only as long as needed for the purposes described above, or as long as the law requires (for example, tax records). After that, we delete or anonymize it. Specific periods for the app and WhatsApp are given in Parts B and C.

6. Your rights

  • Right to information: you have a right to free information about your stored data and, where applicable, a right to correction, blocking, or deletion of data.
  • Mexico (LFPDPPP): you have ARCO rights, which let you Access, Rectify, Cancel, or Oppose the use of your data, and you can withdraw consent at any time.
  • EU/UK (GDPR): you can access, correct, erase, restrict, or port your data and object to processing.
  • California (CCPA/CPRA): you can know what we collect, request deletion or correction, and opt out of "sale" or "sharing" (we don't sell personal information). We will not discriminate against you for using these rights.

To ensure that personal data is not disclosed to third parties, please send your request by email or post, clearly identifying yourself to the responsible body named in Section 2.

7. Right of appeal to a supervisory authority

You have the right to lodge a complaint with the competent supervisory authority in the event of data protection violations. For example, in Mexico you can contact the authority responsible for personal data protection; in the EU/EEA, the data protection authority of your country. In Germany, a list of authorities is available from the BfDI (https://www.bfdi.bund.de).

8. Children

Our services are meant for adults who book stays. We do not knowingly collect data from children under 16, except details a parent or guardian provides for a booking (such as a child's age). If you think a child has sent us personal data, contact us and we will delete it.

9. Objection to advertising mails

We hereby object to the use of contact data published within the scope of the imprint obligation to send unsolicited advertising and information material. The operators expressly reserve the right to take legal action in the event of unsolicited advertising information, such as spam emails.

10. Amendment of this privacy policy

We reserve the right to change this privacy policy at any time in compliance with legal requirements. We'll post the new version on this page with a new effective date.

11. Contact

KAH Oregon Holdings, LLC / Villa Valentín, C. Palapa 12, Ojo de Agua, 63023 Sayulita, Nayarit, Mexico Email: [email protected] · WhatsApp/Phone: +1 541-639-7953