Last updated: October 2026
1. Controllers
Marne Benedetti and Verena Benedetti
Försterweg 16d, 22525 Hamburg, Germany
Email: info@villaohana.es
Phone: +49 176 48151717
We rent out Villa Ohana on Lanzarote privately. We have not appointed a data protection officer, as we are not required to do so. If you have any questions about data protection, simply write to us at the address above.
2. Overview
We only process personal data where this is necessary to run this website, answer your enquiries and handle your booking, or where you have given your consent. The legal bases are in particular:
- Art. 6(1)(a) GDPR – your consent
- Art. 6(1)(b) GDPR – contract or pre-contractual enquiry (e.g. a booking)
- Art. 6(1)(c) GDPR – legal obligations (e.g. retention and registration duties)
- Art. 6(1)(f) GDPR – legitimate interests (e.g. operating the website securely)
3. Hosting and server logs
This website is hosted by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. When you visit the website, the server processes technically necessary data (IP address, date and time, page requested, browser and operating system, referrer). This serves the secure and stable operation of the website (Art. 6(1)(f) GDPR). We have a data processing agreement with the host. The logs are deleted automatically after a short period.
Emails sent via this website (e.g. booking confirmations) are also delivered through ALL-INKL's mail server.
4. Security (Wordfence)
To protect the website against attacks we use the security plugin Wordfence. It checks requests to the website and processes IP addresses and request data on our server. To update its protection rules it connects to the provider Defiant Inc., 800 5th Ave Suite 4100, Seattle, WA 98104, USA; the IP addresses of blocked requests may be transmitted in the process. The legal basis is our legitimate interest in a secure website (Art. 6(1)(f) GDPR). For transfers to the USA we rely on appropriate safeguards (EU-US Data Privacy Framework or EU Standard Contractual Clauses).
5. Cookies and consent
We set technically necessary cookies without consent, for example to remember your language. All other services, in particular the Google map, are only loaded after you have given your consent in the cookie banner (Art. 6(1)(a) GDPR). You can change or withdraw your choice at any time via “Manage consent”. Details of the individual cookies can be found in our cookie policy.
6. Bookings and booking enquiries
When you book via the booking form, we process your details (name, address, email, phone, travel dates, number of guests, payment information and, if applicable, your message) in order to handle the booking (Art. 6(1)(b) GDPR). We keep invoices and booking records for as long as required by tax and commercial law (usually up to ten years, Art. 6(1)(c) GDPR) and delete them afterwards.
7. Payment
You can pay by bank transfer or via PayPal. If you choose PayPal, you will be redirected to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. PayPal processes your payment data as an independent controller; PayPal's privacy policy applies. The legal basis is Art. 6(1)(b) GDPR.
8. Guest registration (legal requirement in Spain)
Holiday rentals in Spain are required to record the details of all guests aged 14 and over and to pass them on to the authorities (Guardia Civil / Ministry of the Interior). We use our online guest registration form for this purpose and process name, date of birth, nationality, type and number of identity document, date of issue, address, phone, travel dates and your signature confirming our house and pool rules. The legal basis is our legal obligation (Art. 6(1)(c) GDPR in conjunction with Spanish Organic Law 4/2015 and Royal Decree 933/2021). The details are sent to us by email and deleted from the website automatically after one day. We keep the records required by law for as long as Spanish law demands (currently three years).
9. Contact form and email
If you write to us via the contact form or by email, we process your details in order to answer your enquiry (Art. 6(1)(b) or (f) GDPR). We delete the data once your enquiry has been dealt with and no retention obligations apply.
10. Calendar synchronisation
To avoid double bookings, our availability calendar is synchronised automatically with Airbnb and Fewo-direkt. Only booked periods are exchanged (Art. 6(1)(b) and (f) GDPR).
11. Google Maps
On some pages we show a map from Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The map is only loaded once you have given your consent in the cookie banner (Art. 6(1)(a) GDPR). Your IP address is then transmitted to Google; a transfer to the USA is possible. Google is certified under the EU-US Data Privacy Framework. You can withdraw your consent at any time.
12. Fonts, 360° tour and weather display
Fonts, icons and the 360° virtual tour are loaded directly from our server; no data is passed on to third parties. The weather display is retrieved by our server from OpenWeather – your data is not passed on.
13. Backups
We regularly back up the website, including the database, with the UpdraftPlus plugin. The backups are stored in our Google Drive account (Google Ireland Limited, Ireland; a transfer to the USA is possible, Google is certified under the EU-US Data Privacy Framework). Backups allow us to restore data after a failure (Art. 6(1)(f) GDPR). Older backups are deleted automatically.
14. Links to social networks
We link to our profiles on Instagram and X with simple links only. No data is transmitted until you click a link; the privacy policy of the respective provider then applies.
15. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). You can withdraw any consent at any time with effect for the future. Just write to us at info@villaohana.es.
You also have the right to lodge a complaint with a data protection supervisory authority, for example the Hamburg Commissioner for Data Protection and Freedom of Information, which is responsible for us, or the authority in your country of residence.
16. Obligation to provide data, automated decisions
We need the details in the booking and registration forms to perform the contract or because of legal obligations; without them we cannot accept the booking. We do not use automated decision-making or profiling.