Who we are
This website is operated by Estadia Solutions Ltd ("Estadia", "we"), a private limited company registered in England and Wales under company number 17202719, with registered office at 128 City Road, London, EC1V 2NX, United Kingdom. We are the controller of any personal data you share with us through this website. You can reach us at [email protected] for anything related to this policy.
What personal data we collect
Through the contact form on this site we collect your name, email address, the number of properties you manage, the city or region where you operate (if you share it) and the content of your message.
To protect the form from automated bulk submissions we also briefly retain a derived identifier (SHA-256 hash) of your source IP address for a maximum of 1 hour. We do not store your IP address in plain text.
We also collect your approximate location, device type and referring URL from standard server logs, the same technical information every website receives when a browser connects.
If you later become a customer, the guest and reservation data your account processes is governed by a separate Data Processing Agreement signed at onboarding, not by this policy.
Why we process it
We use what you send through the contact form to reply, schedule a setup call and, if you decide to use Estadia, onboard your account. Server logs are used to keep the site secure and functioning. We do not use your contact details for marketing and we do not share them with third parties for marketing.
Legal basis
We rely on Article 6(1)(f) of the GDPR (legitimate interests of the controller) for the information you send through the contact form: we have a legitimate commercial interest in responding to enquiries from holiday-rental operators who contact us voluntarily with a view to using the service, and we limit processing strictly to what is necessary to reply and, if you proceed, onboard your account. You can object at any time by writing to [email protected]. We also rely on Article 6(1)(f) (legitimate interest in running a secure website) for server logs.
How long we keep it
Contact-form submissions are retained for 24 months and then deleted automatically. The network identifier (IP hash) used for rate-limiting is deleted within 1 hour. If you become a customer, your contact-form data is merged into your account record and is then governed by the Data Processing Agreement signed at onboarding. Server logs are kept for 30 days.
Who processes your data on our behalf
To deliver the service we engage a small number of carefully selected processors, each bound by a Data Processing Agreement under Art. 28 GDPR:
Supabase Inc.: database, authentication and storage of contact-form submissions. Hosted in the European Union (Ireland, eu-west-1).
Brevo SAS: sends the internal notification to the Estadia team when a contact-form submission is received. The message includes your name, email address, property count and message content. Hosted in the European Union. Covered by Brevo's standard DPA (https://www.brevo.com/legal/dpacca/).
Cloudflare Inc.: hosting and content-delivery network for the website. Processed at Cloudflare's European edge locations.
Functional Software Inc. (Sentry, sentry.de): error monitoring for the website. Hosted in Germany. Personally identifying fields are scrubbed before transmission.
Umami Software, Inc. (Umami Cloud): privacy-respecting analytics for the marketing site. Operated from the United States. No cookies are set in your browser and no personally identifiable information is collected; visit data is aggregated.
The public, up-to-date list is published at https://estadia.host/en/subprocessors. We do not share your contact data with any other third party except where required by law.
International transfers
The processors listed above process the data within the European Economic Area. Their parent groups are established outside the EEA (United States); incidental access by affiliates is therefore governed by the Standard Contractual Clauses included in each contract, together with the corresponding technical and organisational measures.
Your rights
You have the right to access the personal data we hold about you, to rectify inaccuracies, to request deletion, to restrict or object to processing, and to receive your data in a portable format. Exercise any of these rights by writing to [email protected]. We respond within 30 days.
You also have the right to lodge a complaint with your local data-protection authority. In Spain this is the Agencia Española de Protección de Datos (www.aepd.es); in the United Kingdom, the Information Commissioner's Office (www.ico.org.uk).
Changes to this policy
If we change how we process personal data we update this page and change the date at the top. Material changes will be highlighted in the next reply you receive from us.