Privacy Policy

1. Controller

The controller responsible for processing personal data in this section of the website is:

Private Hideaway, S.L.U.
Carrer Barcella 1
07141 Marratxí, Balearic Islands, Spain

Email: architecture@privatehideaway.com
Telephone: +34 871 249 993

Please use the email address stated there for privacy enquiries or to exercise your rights.

2. Scope

This privacy policy explains how we process personal data when you visit our website, manage your cookie settings, subscribe to a newsletter or use section-specific services such as booking or property enquiry functions. Personal data is any information relating to an identified or identifiable individual.

3. Hosting and website delivery

This WordPress website is hosted by HostPress GmbH, Bahnhofstraße 34, 66571 Eppelborn, Germany. When you access the website, technical data may be processed, including your IP address, date and time of access, requested page or file, amount of data transferred, referrer URL, browser, operating system and status information.

The processing is necessary to provide the website securely, reliably and efficiently. It is based on our legitimate interests under Article 6(1)(f) GDPR. HostPress processes data on our behalf under Article 28 GDPR. Log data is deleted once it is no longer needed for these purposes, unless security requirements or statutory duties require longer retention.

4. Cookies and consent management with Cookiebot

We use Cookiebot CMP, provided by Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark. Cookiebot displays the cookies and similar technologies used on this website, stores your choices and enables us to demonstrate consent where required.

The data processed may include your consent choices, a shortened IP address, browser and device information, the URL visited, and the date and time of your selection. Cookiebot stores the consent state together with a randomly generated key in the CookieConsent cookie. It may be retained for up to twelve months.

Processing is necessary to comply with our legal obligations and manage your choices. It is based on Article 6(1)(c) GDPR. Storage of or access to information on your device is governed by section 25(2)(2) TDDDG or Article 22.2 LSSI-CE.

Non-essential services are only activated after you have given consent. You may change or withdraw your choices at any time through “Cookie settings” in the footer. An up-to-date list of cookies, providers, purposes and retention periods is available in the cookie declaration generated by Cookiebot.

5. Language settings with WPML

We use WPML to provide the website in several languages. The necessary cookie wp-wpml_current_language stores the language currently selected so that content and functions can be delivered in the appropriate version. Its intended retention period is currently one day.

Processing is based on our legitimate interest in providing a consistent multilingual website under Article 6(1)(f) GDPR. Access to the language setting is necessary to provide the language version you have selected and is governed by section 25(2)(2) TDDDG or Article 22.2 LSSI-CE.

6. Google Tag Manager, Google Analytics and Meta Pixel

Where the relevant services are activated, and subject to your consent, we use Google Tag Manager and Google Analytics, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Meta Pixel, provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

Google Tag Manager is used to manage website tags. Google Analytics helps us understand how the website is used and may process pages viewed, interactions, approximate origin, device and browser information, protected or shortened IP addresses, and time and usage data. Meta Pixel allows us to measure the effectiveness of our communications and advertising and create audiences for interest-based advertising. Meta may process usage, device, browser and interaction data and associate information with an existing Meta account.

These services are only activated after the corresponding choice has been made in Cookiebot. Processing is based on your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG or Article 22.2 LSSI-CE. Google and Meta may process data in the United States. Their relevant US companies participate in the EU-US Data Privacy Framework; standard contractual clauses may also be used where required.

7. Newsletter and website tracking with Brevo

We use Brevo, provided by Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany, for newsletter subscriptions, double opt-in, delivery and performance measurement. We process your email address and, where provided, your name, language, relevant website section, subscription time and double-opt-in records. Brevo may also process delivery, opening and click data where you have consented to this.

The Brevo tracker is also integrated into the website. After you have given consent, it may record page views, URLs visited, interactions and form submissions and use a visitor identifier to associate these activities with an existing Brevo contact profile, for example after you submit a Brevo form or follow a link in a Brevo message. We use this data only for the purposes selected in Cookiebot.

Newsletter delivery, performance measurement and website tracking are based on your consent under Article 6(1)(a) GDPR and, where information is stored on or accessed from your device, section 25(1) TDDDG or Article 22.2 LSSI-CE. You may withdraw newsletter consent through the unsubscribe link in each message and change your tracking choices through the cookie settings. After unsubscribing, your email address may be retained on a suppression list to prevent further messages, based on our legitimate interests under Article 6(1)(f) GDPR.

8. Browser push notifications with WonderPush by Brevo

Our website contains technology for browser push notifications from WonderPush by Brevo. It is only activated if you have consented through Cookiebot and have also expressly allowed notifications in your browser.

The data processed may include a random installation identifier, push token, subscription status, browser and device information, language, time zone, and information about the delivery, receipt and opening of notifications. This data is used to manage the subscription, deliver notifications and evaluate their use.

Processing is based on your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG or Article 22.2 LSSI-CE. You may withdraw your consent through the cookie settings and disable push notifications at any time in your browser or device settings. If this function is not used at launch, it will be disabled and this section will not be published.

9. Protection of the newsletter form with Cloudflare Turnstile

We use Cloudflare Turnstile to protect the newsletter form against automated submissions and misuse. The service uses technical signals to assess whether a submission is likely to originate from a person or an automated program. The data processed may include the IP address, browser and device information, operating system, country of origin, page visited, and the time and result of the check. According to Cloudflare, form entries are not accessed for this purpose.

Processing supports the security and operation of the form and is based on Article 6(1)(f) GDPR. Our legitimate interest is to protect the website against spam, misuse and automated attacks. Where access to information on your device is strictly necessary to provide the secure form function you have requested, it is governed by section 25(2)(2) TDDDG or Article 22.2 LSSI-CE. Cloudflare may process data in the United States, subject to the safeguards required by law.

10. WhatsApp and external links

We may offer the option of contacting us through WhatsApp. The provider for users in the EEA is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. If you choose WhatsApp, WhatsApp processes your telephone number and communication and metadata. We process your message and contact details to respond to your enquiry.

Processing is based on Article 6(1)(b) GDPR where your message relates to a contract or pre-contractual steps, and otherwise on our legitimate interest in efficient communication under Article 6(1)(f) GDPR. Please do not send particularly sensitive or confidential information via WhatsApp.

Our website also contains links to external services, particularly Google Maps, Instagram and LinkedIn. No content from these providers is embedded merely by visiting our website. When you follow a link, you leave our website and the relevant provider processes your data under its own responsibility.

11. Sharing within the Private Hideaway group

If your enquiry clearly concerns another Private Hideaway division, we may forward your information to the company responsible for that division where this is necessary to deal with your enquiry and you can reasonably expect the transfer or have consented to it.

The legal basis is Article 6(1)(b) GDPR for pre-contractual steps, Article 6(1)(a) GDPR where you have consented, or Article 6(1)(f) GDPR in other appropriate cases. Your details are not shared for independent marketing without any consent required by law.

12. Recipients, international transfers and retention

We use providers for hosting, maintenance, consent management, newsletters, analytics, advertising and section-specific CRM, booking and property functions. Processors are bound by agreements under Article 28 GDPR. Other recipients receive data only where necessary for a contract, required by law, covered by your consent or otherwise legally permitted.

Where data is transferred outside the EEA, we rely on an adequacy decision, the EU-US Data Privacy Framework or appropriate safeguards such as standard contractual clauses.

We retain personal data only for as long as required for the relevant purpose, unless statutory retention periods, legal claims or continuing consent justify longer storage.

13. Your rights and security

Subject to the GDPR, you have rights of access, rectification, erasure, restriction and data portability. You may object to processing based on legitimate interests for reasons arising from your particular situation. You may withdraw consent at any time for the future and lodge a complaint with a data protection supervisory authority.

We use appropriate technical and organisational safeguards. The website is delivered over an encrypted HTTPS connection.

Last updated: 31 August 2026

Project and planning enquiries

When you provide project information by email or another agreed channel, we process your contact details and the land, building, planning, budget and project information supplied to assess and deal with your enquiry. Processing is based on Article 6(1)(b) GDPR. Where necessary, information may be shared with architects, engineers, specialist consultants, advisers or contractors involved in the project, on an appropriate contractual and data protection basis.

1. Controller

The controller responsible for processing personal data in this section of the website is:

Private Hideaway, S.L.U.
Carrer Barcella 1
07141 Marratxí, Balearic Islands, Spain

Email: property@privatehideaway.com
Telephone: +34 871 249 992

Please use the email address stated there for privacy enquiries or to exercise your rights.

2. Scope

This privacy policy explains how we process personal data when you visit our website, manage your cookie settings, subscribe to a newsletter or use section-specific services such as booking or property enquiry functions. Personal data is any information relating to an identified or identifiable individual.

3. Hosting and website delivery

This WordPress website is hosted by HostPress GmbH, Bahnhofstraße 34, 66571 Eppelborn, Germany. When you access the website, technical data may be processed, including your IP address, date and time of access, requested page or file, amount of data transferred, referrer URL, browser, operating system and status information.

The processing is necessary to provide the website securely, reliably and efficiently. It is based on our legitimate interests under Article 6(1)(f) GDPR. HostPress processes data on our behalf under Article 28 GDPR. Log data is deleted once it is no longer needed for these purposes, unless security requirements or statutory duties require longer retention.

4. Cookies and consent management with Cookiebot

We use Cookiebot CMP, provided by Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark. Cookiebot displays the cookies and similar technologies used on this website, stores your choices and enables us to demonstrate consent where required.

The data processed may include your consent choices, a shortened IP address, browser and device information, the URL visited, and the date and time of your selection. Cookiebot stores the consent state together with a randomly generated key in the CookieConsent cookie. It may be retained for up to twelve months.

Processing is necessary to comply with our legal obligations and manage your choices. It is based on Article 6(1)(c) GDPR. Storage of or access to information on your device is governed by section 25(2)(2) TDDDG or Article 22.2 LSSI-CE.

Non-essential services are only activated after you have given consent. You may change or withdraw your choices at any time through “Cookie settings” in the footer. An up-to-date list of cookies, providers, purposes and retention periods is available in the cookie declaration generated by Cookiebot.

5. Language settings with WPML

We use WPML to provide the website in several languages. The necessary cookie wp-wpml_current_language stores the language currently selected so that content and functions can be delivered in the appropriate version. Its intended retention period is currently one day.

Processing is based on our legitimate interest in providing a consistent multilingual website under Article 6(1)(f) GDPR. Access to the language setting is necessary to provide the language version you have selected and is governed by section 25(2)(2) TDDDG or Article 22.2 LSSI-CE.

6. Google Tag Manager, Google Analytics and Meta Pixel

Where the relevant services are activated, and subject to your consent, we use Google Tag Manager and Google Analytics, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Meta Pixel, provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

Google Tag Manager is used to manage website tags. Google Analytics helps us understand how the website is used and may process pages viewed, interactions, approximate origin, device and browser information, protected or shortened IP addresses, and time and usage data. Meta Pixel allows us to measure the effectiveness of our communications and advertising and create audiences for interest-based advertising. Meta may process usage, device, browser and interaction data and associate information with an existing Meta account.

These services are only activated after the corresponding choice has been made in Cookiebot. Processing is based on your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG or Article 22.2 LSSI-CE. Google and Meta may process data in the United States. Their relevant US companies participate in the EU-US Data Privacy Framework; standard contractual clauses may also be used where required.

7. Newsletter and website tracking with Brevo

We use Brevo, provided by Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany, for newsletter subscriptions, double opt-in, delivery and performance measurement. We process your email address and, where provided, your name, language, relevant website section, subscription time and double-opt-in records. Brevo may also process delivery, opening and click data where you have consented to this.

The Brevo tracker is also integrated into the website. After you have given consent, it may record page views, URLs visited, interactions and form submissions and use a visitor identifier to associate these activities with an existing Brevo contact profile, for example after you submit a Brevo form or follow a link in a Brevo message. We use this data only for the purposes selected in Cookiebot.

Newsletter delivery, performance measurement and website tracking are based on your consent under Article 6(1)(a) GDPR and, where information is stored on or accessed from your device, section 25(1) TDDDG or Article 22.2 LSSI-CE. You may withdraw newsletter consent through the unsubscribe link in each message and change your tracking choices through the cookie settings. After unsubscribing, your email address may be retained on a suppression list to prevent further messages, based on our legitimate interests under Article 6(1)(f) GDPR.

8. Browser push notifications with WonderPush by Brevo

Our website contains technology for browser push notifications from WonderPush by Brevo. It is only activated if you have consented through Cookiebot and have also expressly allowed notifications in your browser.

The data processed may include a random installation identifier, push token, subscription status, browser and device information, language, time zone, and information about the delivery, receipt and opening of notifications. This data is used to manage the subscription, deliver notifications and evaluate their use.

Processing is based on your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG or Article 22.2 LSSI-CE. You may withdraw your consent through the cookie settings and disable push notifications at any time in your browser or device settings. If this function is not used at launch, it will be disabled and this section will not be published.

9. Protection of the newsletter form with Cloudflare Turnstile

We use Cloudflare Turnstile to protect the newsletter form against automated submissions and misuse. The service uses technical signals to assess whether a submission is likely to originate from a person or an automated program. The data processed may include the IP address, browser and device information, operating system, country of origin, page visited, and the time and result of the check. According to Cloudflare, form entries are not accessed for this purpose.

Processing supports the security and operation of the form and is based on Article 6(1)(f) GDPR. Our legitimate interest is to protect the website against spam, misuse and automated attacks. Where access to information on your device is strictly necessary to provide the secure form function you have requested, it is governed by section 25(2)(2) TDDDG or Article 22.2 LSSI-CE. Cloudflare may process data in the United States, subject to the safeguards required by law.

10. WhatsApp and external links

We may offer the option of contacting us through WhatsApp. The provider for users in the EEA is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. If you choose WhatsApp, WhatsApp processes your telephone number and communication and metadata. We process your message and contact details to respond to your enquiry.

Processing is based on Article 6(1)(b) GDPR where your message relates to a contract or pre-contractual steps, and otherwise on our legitimate interest in efficient communication under Article 6(1)(f) GDPR. Please do not send particularly sensitive or confidential information via WhatsApp.

Our website also contains links to external services, particularly Google Maps, Instagram and LinkedIn. No content from these providers is embedded merely by visiting our website. When you follow a link, you leave our website and the relevant provider processes your data under its own responsibility.

11. Sharing within the Private Hideaway group

If your enquiry clearly concerns another Private Hideaway division, we may forward your information to the company responsible for that division where this is necessary to deal with your enquiry and you can reasonably expect the transfer or have consented to it.

The legal basis is Article 6(1)(b) GDPR for pre-contractual steps, Article 6(1)(a) GDPR where you have consented, or Article 6(1)(f) GDPR in other appropriate cases. Your details are not shared for independent marketing without any consent required by law.

12. Recipients, international transfers and retention

We use providers for hosting, maintenance, consent management, newsletters, analytics, advertising and section-specific CRM, booking and property functions. Processors are bound by agreements under Article 28 GDPR. Other recipients receive data only where necessary for a contract, required by law, covered by your consent or otherwise legally permitted.

Where data is transferred outside the EEA, we rely on an adequacy decision, the EU-US Data Privacy Framework or appropriate safeguards such as standard contractual clauses.

We retain personal data only for as long as required for the relevant purpose, unless statutory retention periods, legal claims or continuing consent justify longer storage.

13. Your rights and security

Subject to the GDPR, you have rights of access, rectification, erasure, restriction and data portability. You may object to processing based on legitimate interests for reasons arising from your particular situation. You may withdraw consent at any time for the future and lodge a complaint with a data protection supervisory authority.

We use appropriate technical and organisational safeguards. The website is delivered over an encrypted HTTPS connection.

Last updated: 31 August 2026

Property services with onOffice

We use onOffice enterprise and related website services provided by onOffice GmbH, Charlottenburger Allee 5, 52068 Aachen, Germany, to display properties, receive search and property enquiries, and manage prospective client, owner, buyer and seller data.

This may include identity, contact, search, property, communication and contract data. Processing for pre-contractual steps and contracts is based on Article 6(1)(b) GDPR. General relationship management and internal organisation may be based on our legitimate interests under Article 6(1)(f) GDPR. onOffice acts as a processor under Article 28 GDPR.

1. Controller

The controller responsible for processing personal data in this section of the website is:

Bella Residencia Immobilienverwaltungs GmbH
Im Steingerüst 32
76437 Rastatt, Germany

Email: residences@privatehideaway.com
Telephone: +49 7222 9609-991

Please use the email address stated there for privacy enquiries or to exercise your rights.

2. Scope

This privacy policy explains how we process personal data when you visit our website, manage your cookie settings, subscribe to a newsletter or use section-specific services such as booking or property enquiry functions. Personal data is any information relating to an identified or identifiable individual.

3. Hosting and website delivery

This WordPress website is hosted by HostPress GmbH, Bahnhofstraße 34, 66571 Eppelborn, Germany. When you access the website, technical data may be processed, including your IP address, date and time of access, requested page or file, amount of data transferred, referrer URL, browser, operating system and status information.

The processing is necessary to provide the website securely, reliably and efficiently. It is based on our legitimate interests under Article 6(1)(f) GDPR. HostPress processes data on our behalf under Article 28 GDPR. Log data is deleted once it is no longer needed for these purposes, unless security requirements or statutory duties require longer retention.

4. Cookies and consent management with Cookiebot

We use Cookiebot CMP, provided by Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark. Cookiebot displays the cookies and similar technologies used on this website, stores your choices and enables us to demonstrate consent where required.

The data processed may include your consent choices, a shortened IP address, browser and device information, the URL visited, and the date and time of your selection. Cookiebot stores the consent state together with a randomly generated key in the CookieConsent cookie. It may be retained for up to twelve months.

Processing is necessary to comply with our legal obligations and manage your choices. It is based on Article 6(1)(c) GDPR. Storage of or access to information on your device is governed by section 25(2)(2) TDDDG or Article 22.2 LSSI-CE.

Non-essential services are only activated after you have given consent. You may change or withdraw your choices at any time through “Cookie settings” in the footer. An up-to-date list of cookies, providers, purposes and retention periods is available in the cookie declaration generated by Cookiebot.

5. Language settings with WPML

We use WPML to provide the website in several languages. The necessary cookie wp-wpml_current_language stores the language currently selected so that content and functions can be delivered in the appropriate version. Its intended retention period is currently one day.

Processing is based on our legitimate interest in providing a consistent multilingual website under Article 6(1)(f) GDPR. Access to the language setting is necessary to provide the language version you have selected and is governed by section 25(2)(2) TDDDG or Article 22.2 LSSI-CE.

6. Google Tag Manager, Google Analytics and Meta Pixel

Where the relevant services are activated, and subject to your consent, we use Google Tag Manager and Google Analytics, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Meta Pixel, provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

Google Tag Manager is used to manage website tags. Google Analytics helps us understand how the website is used and may process pages viewed, interactions, approximate origin, device and browser information, protected or shortened IP addresses, and time and usage data. Meta Pixel allows us to measure the effectiveness of our communications and advertising and create audiences for interest-based advertising. Meta may process usage, device, browser and interaction data and associate information with an existing Meta account.

These services are only activated after the corresponding choice has been made in Cookiebot. Processing is based on your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG or Article 22.2 LSSI-CE. Google and Meta may process data in the United States. Their relevant US companies participate in the EU-US Data Privacy Framework; standard contractual clauses may also be used where required.

7. Newsletter and website tracking with Brevo

We use Brevo, provided by Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany, for newsletter subscriptions, double opt-in, delivery and performance measurement. We process your email address and, where provided, your name, language, relevant website section, subscription time and double-opt-in records. Brevo may also process delivery, opening and click data where you have consented to this.

The Brevo tracker is also integrated into the website. After you have given consent, it may record page views, URLs visited, interactions and form submissions and use a visitor identifier to associate these activities with an existing Brevo contact profile, for example after you submit a Brevo form or follow a link in a Brevo message. We use this data only for the purposes selected in Cookiebot.

Newsletter delivery, performance measurement and website tracking are based on your consent under Article 6(1)(a) GDPR and, where information is stored on or accessed from your device, section 25(1) TDDDG or Article 22.2 LSSI-CE. You may withdraw newsletter consent through the unsubscribe link in each message and change your tracking choices through the cookie settings. After unsubscribing, your email address may be retained on a suppression list to prevent further messages, based on our legitimate interests under Article 6(1)(f) GDPR.

8. Browser push notifications with WonderPush by Brevo

Our website contains technology for browser push notifications from WonderPush by Brevo. It is only activated if you have consented through Cookiebot and have also expressly allowed notifications in your browser.

The data processed may include a random installation identifier, push token, subscription status, browser and device information, language, time zone, and information about the delivery, receipt and opening of notifications. This data is used to manage the subscription, deliver notifications and evaluate their use.

Processing is based on your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG or Article 22.2 LSSI-CE. You may withdraw your consent through the cookie settings and disable push notifications at any time in your browser or device settings. If this function is not used at launch, it will be disabled and this section will not be published.

9. Protection of the newsletter form with Cloudflare Turnstile

We use Cloudflare Turnstile to protect the newsletter form against automated submissions and misuse. The service uses technical signals to assess whether a submission is likely to originate from a person or an automated program. The data processed may include the IP address, browser and device information, operating system, country of origin, page visited, and the time and result of the check. According to Cloudflare, form entries are not accessed for this purpose.

Processing supports the security and operation of the form and is based on Article 6(1)(f) GDPR. Our legitimate interest is to protect the website against spam, misuse and automated attacks. Where access to information on your device is strictly necessary to provide the secure form function you have requested, it is governed by section 25(2)(2) TDDDG or Article 22.2 LSSI-CE. Cloudflare may process data in the United States, subject to the safeguards required by law.

10. WhatsApp and external links

We may offer the option of contacting us through WhatsApp. The provider for users in the EEA is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. If you choose WhatsApp, WhatsApp processes your telephone number and communication and metadata. We process your message and contact details to respond to your enquiry.

Processing is based on Article 6(1)(b) GDPR where your message relates to a contract or pre-contractual steps, and otherwise on our legitimate interest in efficient communication under Article 6(1)(f) GDPR. Please do not send particularly sensitive or confidential information via WhatsApp.

Our website also contains links to external services, particularly Google Maps, Instagram and LinkedIn. No content from these providers is embedded merely by visiting our website. When you follow a link, you leave our website and the relevant provider processes your data under its own responsibility.

11. Sharing within the Private Hideaway group

If your enquiry clearly concerns another Private Hideaway division, we may forward your information to the company responsible for that division where this is necessary to deal with your enquiry and you can reasonably expect the transfer or have consented to it.

The legal basis is Article 6(1)(b) GDPR for pre-contractual steps, Article 6(1)(a) GDPR where you have consented, or Article 6(1)(f) GDPR in other appropriate cases. Your details are not shared for independent marketing without any consent required by law.

12. Recipients, international transfers and retention

We use providers for hosting, maintenance, consent management, newsletters, analytics, advertising and section-specific CRM, booking and property functions. Processors are bound by agreements under Article 28 GDPR. Other recipients receive data only where necessary for a contract, required by law, covered by your consent or otherwise legally permitted.

Where data is transferred outside the EEA, we rely on an adequacy decision, the EU-US Data Privacy Framework or appropriate safeguards such as standard contractual clauses.

We retain personal data only for as long as required for the relevant purpose, unless statutory retention periods, legal claims or continuing consent justify longer storage.

13. Your rights and security

Subject to the GDPR, you have rights of access, rectification, erasure, restriction and data portability. You may object to processing based on legitimate interests for reasons arising from your particular situation. You may withdraw consent at any time for the future and lodge a complaint with a data protection supervisory authority.

We use appropriate technical and organisational safeguards. The website is delivered over an encrypted HTTPS connection.

Last updated: 31 August 2026

Booking and guest communication with Re:Guest

We use Re:Guest, provided by REGUEST AG, Via Alois-Kuperion 34, 39012 Merano, Italy, for booking enquiries, quotations and guest communication. The data processed may include identity, contact, enquiry, quotation, booking, stay and communication data.

Processing for pre-contractual steps and the accommodation contract is based on Article 6(1)(b) GDPR. Any use for newsletters, profiling or performance measurement is based on your consent under Article 6(1)(a) GDPR. Re:Guest acts as a processor under Article 28 GDPR.

We process data required for booking, guest care, invoicing, deposits and statutory guest registration. Where necessary, data may be shared with local guest-relations, cleaning, technical and administrative providers and competent authorities. Car hire, private chefs, yoga, boat and yacht services are supplied by independent providers. We share the necessary details only at your request and on an appropriate legal basis.

1. Controller

The controller responsible for processing personal data in this section of the website is:

Private Hideaway, S.L.U.
Carrer Barcella 1
07141 Marratxí, Balearic Islands, Spain

Email: interior@privatehideaway.com
Telephone: +34 871 249 994

Please use the email address stated there for privacy enquiries or to exercise your rights.

2. Scope

This privacy policy explains how we process personal data when you visit our website, manage your cookie settings, subscribe to a newsletter or use section-specific services such as booking or property enquiry functions. Personal data is any information relating to an identified or identifiable individual.

3. Hosting and website delivery

This WordPress website is hosted by HostPress GmbH, Bahnhofstraße 34, 66571 Eppelborn, Germany. When you access the website, technical data may be processed, including your IP address, date and time of access, requested page or file, amount of data transferred, referrer URL, browser, operating system and status information.

The processing is necessary to provide the website securely, reliably and efficiently. It is based on our legitimate interests under Article 6(1)(f) GDPR. HostPress processes data on our behalf under Article 28 GDPR. Log data is deleted once it is no longer needed for these purposes, unless security requirements or statutory duties require longer retention.

4. Cookies and consent management with Cookiebot

We use Cookiebot CMP, provided by Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark. Cookiebot displays the cookies and similar technologies used on this website, stores your choices and enables us to demonstrate consent where required.

The data processed may include your consent choices, a shortened IP address, browser and device information, the URL visited, and the date and time of your selection. Cookiebot stores the consent state together with a randomly generated key in the CookieConsent cookie. It may be retained for up to twelve months.

Processing is necessary to comply with our legal obligations and manage your choices. It is based on Article 6(1)(c) GDPR. Storage of or access to information on your device is governed by section 25(2)(2) TDDDG or Article 22.2 LSSI-CE.

Non-essential services are only activated after you have given consent. You may change or withdraw your choices at any time through “Cookie settings” in the footer. An up-to-date list of cookies, providers, purposes and retention periods is available in the cookie declaration generated by Cookiebot.

5. Language settings with WPML

We use WPML to provide the website in several languages. The necessary cookie wp-wpml_current_language stores the language currently selected so that content and functions can be delivered in the appropriate version. Its intended retention period is currently one day.

Processing is based on our legitimate interest in providing a consistent multilingual website under Article 6(1)(f) GDPR. Access to the language setting is necessary to provide the language version you have selected and is governed by section 25(2)(2) TDDDG or Article 22.2 LSSI-CE.

6. Google Tag Manager, Google Analytics and Meta Pixel

Where the relevant services are activated, and subject to your consent, we use Google Tag Manager and Google Analytics, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Meta Pixel, provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

Google Tag Manager is used to manage website tags. Google Analytics helps us understand how the website is used and may process pages viewed, interactions, approximate origin, device and browser information, protected or shortened IP addresses, and time and usage data. Meta Pixel allows us to measure the effectiveness of our communications and advertising and create audiences for interest-based advertising. Meta may process usage, device, browser and interaction data and associate information with an existing Meta account.

These services are only activated after the corresponding choice has been made in Cookiebot. Processing is based on your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG or Article 22.2 LSSI-CE. Google and Meta may process data in the United States. Their relevant US companies participate in the EU-US Data Privacy Framework; standard contractual clauses may also be used where required.

7. Newsletter and website tracking with Brevo

We use Brevo, provided by Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany, for newsletter subscriptions, double opt-in, delivery and performance measurement. We process your email address and, where provided, your name, language, relevant website section, subscription time and double-opt-in records. Brevo may also process delivery, opening and click data where you have consented to this.

The Brevo tracker is also integrated into the website. After you have given consent, it may record page views, URLs visited, interactions and form submissions and use a visitor identifier to associate these activities with an existing Brevo contact profile, for example after you submit a Brevo form or follow a link in a Brevo message. We use this data only for the purposes selected in Cookiebot.

Newsletter delivery, performance measurement and website tracking are based on your consent under Article 6(1)(a) GDPR and, where information is stored on or accessed from your device, section 25(1) TDDDG or Article 22.2 LSSI-CE. You may withdraw newsletter consent through the unsubscribe link in each message and change your tracking choices through the cookie settings. After unsubscribing, your email address may be retained on a suppression list to prevent further messages, based on our legitimate interests under Article 6(1)(f) GDPR.

8. Browser push notifications with WonderPush by Brevo

Our website contains technology for browser push notifications from WonderPush by Brevo. It is only activated if you have consented through Cookiebot and have also expressly allowed notifications in your browser.

The data processed may include a random installation identifier, push token, subscription status, browser and device information, language, time zone, and information about the delivery, receipt and opening of notifications. This data is used to manage the subscription, deliver notifications and evaluate their use.

Processing is based on your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG or Article 22.2 LSSI-CE. You may withdraw your consent through the cookie settings and disable push notifications at any time in your browser or device settings. If this function is not used at launch, it will be disabled and this section will not be published.

9. Protection of the newsletter form with Cloudflare Turnstile

We use Cloudflare Turnstile to protect the newsletter form against automated submissions and misuse. The service uses technical signals to assess whether a submission is likely to originate from a person or an automated program. The data processed may include the IP address, browser and device information, operating system, country of origin, page visited, and the time and result of the check. According to Cloudflare, form entries are not accessed for this purpose.

Processing supports the security and operation of the form and is based on Article 6(1)(f) GDPR. Our legitimate interest is to protect the website against spam, misuse and automated attacks. Where access to information on your device is strictly necessary to provide the secure form function you have requested, it is governed by section 25(2)(2) TDDDG or Article 22.2 LSSI-CE. Cloudflare may process data in the United States, subject to the safeguards required by law.

10. WhatsApp and external links

We may offer the option of contacting us through WhatsApp. The provider for users in the EEA is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. If you choose WhatsApp, WhatsApp processes your telephone number and communication and metadata. We process your message and contact details to respond to your enquiry.

Processing is based on Article 6(1)(b) GDPR where your message relates to a contract or pre-contractual steps, and otherwise on our legitimate interest in efficient communication under Article 6(1)(f) GDPR. Please do not send particularly sensitive or confidential information via WhatsApp.

Our website also contains links to external services, particularly Google Maps, Instagram and LinkedIn. No content from these providers is embedded merely by visiting our website. When you follow a link, you leave our website and the relevant provider processes your data under its own responsibility.

11. Sharing within the Private Hideaway group

If your enquiry clearly concerns another Private Hideaway division, we may forward your information to the company responsible for that division where this is necessary to deal with your enquiry and you can reasonably expect the transfer or have consented to it.

The legal basis is Article 6(1)(b) GDPR for pre-contractual steps, Article 6(1)(a) GDPR where you have consented, or Article 6(1)(f) GDPR in other appropriate cases. Your details are not shared for independent marketing without any consent required by law.

12. Recipients, international transfers and retention

We use providers for hosting, maintenance, consent management, newsletters, analytics, advertising and section-specific CRM, booking and property functions. Processors are bound by agreements under Article 28 GDPR. Other recipients receive data only where necessary for a contract, required by law, covered by your consent or otherwise legally permitted.

Where data is transferred outside the EEA, we rely on an adequacy decision, the EU-US Data Privacy Framework or appropriate safeguards such as standard contractual clauses.

We retain personal data only for as long as required for the relevant purpose, unless statutory retention periods, legal claims or continuing consent justify longer storage.

13. Your rights and security

Subject to the GDPR, you have rights of access, rectification, erasure, restriction and data portability. You may object to processing based on legitimate interests for reasons arising from your particular situation. You may withdraw consent at any time for the future and lodge a complaint with a data protection supervisory authority.

We use appropriate technical and organisational safeguards. The website is delivered over an encrypted HTTPS connection.

Last updated: 31 August 2026

Interior design and furnishing projects

When you provide information about an interior design or furnishing project, we process your contact, room, property, budget and project details, including plans and photographs supplied voluntarily, to assess the enquiry, prepare a quotation and carry out the project. Processing is based on Article 6(1)(b) GDPR. Where required, information may be shared with manufacturers, suppliers, consultants, logistics, installation or other project partners, limited to what is necessary.