Privacy policy

• First name and surname.
• Email address.
• Telephone number.
• The message or query you send.
• Any data you choose to include in the form.
• Technical data about the submission (IP address and browser), to stop automated or abusive submissions.

• First name and surname of the person making the booking.
• Contact details.
• The accommodation selected.
• Arrival and departure dates.
• Number of guests.
• Preferences, special requests or comments attached to the booking.
• Information needed to handle changes, cancellations, incidents or assistance during the stay.

In order to comply with the applicable rules on accommodation and public safety, we may request the legally required details of the people staying, including, as appropriate:

• Identifying details.
• Identity document or passport, type and number.
• Nationality.
• Date of birth.
• Sex, where this is compulsory.
• Address or contact details, where these are required.
• Relationship to, or details of, accompanying minors, where the rules require it.
• Arrival and departure dates.
• Signature on the entry form, where this is required.

Sereno will neither request nor keep full copies of identity documents or passports unless there is a specific legal obligation or a duly documented lawful basis for doing so.

• The booking amount.
• Payment status.
• Transaction reference.
• Billing details where these are needed.
• Partial or tokenised payment method information provided by the payment provider.

Card payments are processed through Stripe. Sereno does not store full bank card details.

If you choose to pay for your booking in instalments, Stripe stores your card so that the remaining instalments can be charged automatically on the dates shown to you when you book.

If you have an account on the website, you can also ask Stripe to remember your card so that you can pay for future bookings without typing it again, by ticking the box when you pay or by adding it from your account. You can see and remove your saved cards at any time from your account, except while an instalment is still due on that card.

Sereno never sees the full card number: only the brand, the last digits and the expiry date, so that you can recognise it. A saved card is only used for payments you make or for the instalments you agreed to when booking.

When you contact Sereno as an owner, a prospective owner, a supplier, a partner or an investor, we may process:

• First name and surname.
• Email address and telephone number.
• Details of the home or property.
• Financial, contractual or operational information needed to assess or manage the relationship.
• Communications exchanged with Sereno.

If you write to us using the owner request form, we also process: the town and address of the home, how many homes you have, whether they have a holiday rental licence, your financial expectations, any photos you choose to upload, how you heard about us and the language in which you filled in the form. Photos are kept in private storage that only the Sereno team can access.

When you send us your application through the ‘Work with us’ form, or send us your CV by any other means, we may process:

• First name and surname.
• Email address and telephone number.
• Town or city of residence.
• Your CV and all the information you decide to include in it.
• The roles and areas you are interested in working in, and whether you have a vehicle.
• Any message or covering note you write to us.
• The date of your consent and technical details of the submission, such as the IP address, so that we can evidence it.

We do not ask for your identity document, date of birth or a photograph in order to join the talent pool. Those details are only requested if we go on to hire you.

So that we do not have to copy your CV by hand, an artificial intelligence system (Microsoft Azure OpenAI) reads it and suggests some details for your record, such as where you live, your driving licence, languages or years of experience. It is only a suggestion that a member of our team reviews: decisions about your application are always made by a person, never by the system on its own.

When you visit the website we may process:

• IP address.
• Online identifiers.
• Browser and device type.
• Pages visited.
• Date and time of access.
• Traffic source.
• Interactions with the website.
• Technical errors that occur in your browser (the page, the error message and whether the browser was translating the page), so that we can fix them.

Some parts of the website are loaded from other providers, which therefore receive your IP address and technical data about your browser:

• Cloudflare Turnstile, on the owner, job application and season alert forms: it checks that the form is being sent by a person and not by an automated program. It does not set tracking cookies.
• CARTO, which serves the map images on each house page. It only receives the area of the map being viewed, not who you are.
• Vimeo, which serves the background video on the owners page. It is loaded in Vimeo's no-tracking mode ("Do Not Track"), which sets no cookies and stores no data about your session.

Details of cookies and similar technologies are available in the Cookie policy.

When you sign up on the website or on the guest portal to be told when next season’s dates open or to receive our news, or tick the marketing communications box when you create your account on the website, we may process:

• First name and email address.
• Telephone number, only if you tick the box to receive the alerts by WhatsApp as well.
• The language you are browsing in and where you signed up (the website, account sign-up, the guest portal or the traveller register).
• The date of your consent, the version of the text accepted, your IP address and browser, so that we can evidence it.

The subscription is activated when you confirm the link we send you by email (double opt-in); until then we send you nothing. If you sign up from your account on the website or when creating it, we do not ask for that confirmation: the account email has already been verified, with a code when the account was created or by Google if you sign in with Google, and we record it that way as proof. You can unsubscribe from any message.

Serena is an automated assistant that answers questions about our houses, availability and prices in the website chat. It does not ask for personal details and we recommend you don’t type any. When you use it, we process:

• The text of the messages you write and of the assistant’s replies.
• The page you write from, the language, and the date and time of each message.

We do not store your IP address with the conversation. To prevent abuse we count how many messages are sent from the same connection using an encrypted fingerprint of the IP, which is deleted automatically within 24 hours at most.

If you accept marketing cookies and reach the website from a Google ad, when you send the request form for owners we tell Google Ads that the ad brought in a contact (a “conversion”). To measure it more accurately (enhanced conversions) your email and phone number are also sent, encrypted by your own browser (SHA-256) before they leave it: Google only receives that encrypted fingerprint and uses it to match existing Google accounts and count the conversion.

The same happens when you complete a booking on the website: with marketing cookies accepted, the booking is reported to Google Analytics and Google Ads together with your email, encrypted in the same way in your browser, so that we know which ad brought it in. If you have not accepted marketing cookies, the booking is measured without your email.

With the same consent, Google Ads may add your browser to lists of people who have visited the website, together with which houses you have viewed or started to book (their identifier, destination and price, never your contact details), to show you Sereno ads, including for those same houses, on other sites (remarketing). If you do not accept marketing cookies, or withdraw them from “Cookie settings”, none of this data is sent.

You can book without an account. If you choose to create one, with your email and a password or with your Google account, we process:

• Your email address, which identifies your account.
• First name, surname and telephone number.
• Billing address, if you add it.
• Whether you sign in with a password, with Google or both, the language of the website, the date you signed up and the date of your last sign-in.
• The reference of your customer record in Stripe, so that we can show you your saved cards and receipts.
• If you sign up for the season notice from your account, which season and when, so that we do not offer it to you again (the subscription itself is handled as explained in section 2.8).
• The identifier of your user in Microsoft Entra External ID, so that we can delete it when you delete your account.
• Proof that you accepted the terms and conditions and this policy: which version of each, the date, how you did it (by ticking the box on the form or by continuing with Google, with the notice below the button), your IP address and your browser.
• A random identifier for Google Analytics, which is not derived from your email or any other data about you. Only if you are signed in and have accepted analytics cookies do we send it to Google Analytics, so that your visits from your phone and your computer count as coming from the same person. Your email and name are not sent with it.

Sign-in is handled by Microsoft Entra External ID: it checks your password and sends you the verification codes by email. Sereno never stores your password. If you sign in with Google, Google knows that you have signed in to Sereno and gives us your email address.

With your account we show you your direct bookings (those made on the website, by phone or by WhatsApp with the same email as the account), what you have paid and what is still due, your receipts, and we give you direct access to the portal for your stay. We also fill in the booking form with your details. Bookings made on Airbnb, Booking.com or other platforms do not appear in the account.

You can change your details and delete the account from the account itself, with the «Delete my account» button, or ask us to delete it by writing to gestion@tusereno.es. If you have an outstanding payment on a booking, deletion waits until it is paid, because that charge is made to the card you used. When the account is deleted, we remove your user in Microsoft Entra External ID and your profile, and detach your saved cards from Stripe. Bookings and invoices are kept for the legal periods set out in section 7. Whatever Google Analytics has received with the account’s random identifier stays there until it expires under its own retention period but, once the account is deleted, we can no longer link it to you.