Guest Privacy Notice

Last updated: November 2024

Overview

At Buena Vista Holidays, operated by the Malta-based, family-run, Buena Vista Holidays Limited, we aim to be your friendly hosts and guides in Malta. We do this through the provision of luxurious and comfortable self-catering accommodations for short-lets as well other travel-related services. Whether you are seeking to have a couple’s retreat, family holiday, friendly getaway or a business trip, we at Buena Vista Holidays offer a vast portfolio of properties and services to ensure that you have an unforgettable stay on the sunshine-island of Malta.

To be able to do so, it is necessary that we collect, process and store certain types of personal data about you, which personal data we take great care in keeping safe.

Through this Privacy Notice we wish to be as transparent as possible in outlining and explaining to you our data collection and processing procedures, as well as your rights. This in line with the European Union’s General Data Protection Regulation [EU] 2016/679 (the “GDPR”) and the Data Protection Act (Chapter 586 of the Laws of Malta) (the “Act”), together the “Data Protection Laws”.

For these reasons, our Privacy Notice, which applies whenever you make use of the Buena Vista Holidays’ online platform (accessible here, https://buenavistaholidays.com, the “Website”), or visit our offices (located at 15, Ix-Xatt Ta’ Qui – Si – Sana, Tas-Sliema, SLM 3111), or otherwise engage with us for the purpose of booking your next holiday in Malta, is intended to provide you with information with respect to the following:

Buena Vista Holidays Limited
What Personal Data do we collect?
How do we collect your Personal Data?
How do we use the Personal Data we collect?
Disclosure of Personal Data to Third-Parties
Third-Party Service Terms
Transfers to Third Countries
Protection of your Personal Data
Data Retention
Your Rights
Contact Information and Responsible Entities

Please note that we may make changes to this Privacy Notice from time to time, so we recommend that you visit this page occasionally to keep yourself informed. If we make any updates to this Privacy Notice that we believe will impact you significantly, we will make sure to inform you about any such changes before these come into force.

1. Buena Vista Holidays Limited

In this Privacy Notice, the terms ‘we’, ‘us’ and ‘our’ refer to Buena Vista Holidays Limited, and, as elaborated upon below, we collect and handle Personal Data in the course of operating the Buena Vista Holidays business. The Personal Data we collect relates primarily to our clients when they use our Website and/or create an account as guests, and make use of our services, as further explained below. This makes Buena Vista Holidays Limited the “Controller” (as defined under the GDPR) of the Personal Data.

Our contact details are as follows:

Full name of Controller: Buena Vista Holidays Limited

Company registration number: C76834

Postal address: 15, Ix-Xatt ta’ Qui-Si-Sana, Tas-Sliema, Malta

Email address: info@buenavistaholidays.com

Contact number: (+356) 7939 6674

2. What Personal Data do we collect?

No Personal Data is collected without a purpose. We may collect, use, store and transfer different kinds of Personal Data about you, and your travel companions where necessary, for the purpose of providing you with our services, amongst which the creation of an account on our Website; the processing of your bookings, whether these are made through our Website or by contacting us directly through other means of communication or by visiting us physicially at our offices; providing feedback to your queries and requests whenever you get in touch with us with such; to be able to offer you a comfortable and more personalised experience in anticipation of, and throughout, your stay.

We have, therefore, grouped the Personal Data that we may collect, use, store and transfer together, as follows:

General Data

Identity Data: This includes name, surname, age, passport number or ID Card number, footage of you which may be captured by the cameras which are installed and operating in our offices for security purposes. This may also include the name, surname and age of your travel companions. The collection of certain Identity Data will depend on your booking type, on the features you use on our Website, and the way in which you create your booking with us – whether online either through our Website or through other means of communication directly with us or through other third-party booking platforms that we partner with, or physically at our offices.

Account Data: This includes your email address which will generally be considered as your ‘username’, and an encrypted record of your login password to access your account on our Website.

Contact Data: This includes contact number, email address, and postal address.

Booking Data: This includes check-in and check-out dates, and total number of guests staying at the property.

Payment Data: This includes bank account and/or payment card details. This will be collected by us when you make a booking directly with us. When you make a booking through one of the third-party booking platforms that we partner with, unless payment is made during the booking process with any such third-party booking platforms directly, your bank account and/or payment card details may also be sent to us by the said third-party booking platforms for us to be able to process payment. We may also collect damage deposits and we will process your Payment Data to withdraw and use such deposits to remedy any possible damages made during your stay.

Technical Data: This includes details of the device that you use to access our Website. This could be information that identifies your device, its operating system, internet address, your login data such as browser and plug-ins, as well as your location details.

Marketing and Communications Data: This includes data which we may collect for marketing and communications purposes, including information relating to your preferences in receiving marketing/communications from us.

Additional Information Provided by You: This includes information that you voluntarily choose to provide us with, such as when you fill in a form, add information to your account, respond to surveys, post to community forums, communicate with our support team, or share your experience with us in any other way. Additional information may also consist of personal details, whether these are your own or of your travel companions, shared by you with us via email or other means of communication.

By providing us with personal information about your travel companions, whether these are required by us in terms of this Privacy Notice for identification and booking purposes, or provided by you voluntarily, you certify that you have obtained permission to share their personal information with us and that they are aware of the purposes as outlined in this Privacy Notice.

[NOTE: Although providing your Personal Data to us is totally voluntary, we may not be able to provide you with some or all of our services if you fail to provide us with, or opt to restrict, the Personal Data that we need to collect from you, as outlined above.]

Special Categories of Data

This includes certain other ‘special information’ which, by law, requires greater security measures to guarantee its protection. These include any information relating to the following;

Racial or ethnic origin
Political opinions
Religious or philosophical beliefs
Trade union membership
Genetic data
Biometric data for the purpose of uniquely identifying a natural person
Data concerning health
Data concerning a natural person’s sex life or sexual orientation

We generally do not collect any Special Categories of Personal Data and we shall not collect, process and store any other data which is deemed to consist of special categories of data unless:

you have made your sensitive data manifestly public
you have given your explicit consent
you have voluntarily provided this to us in your communications with us
we are required to do so through the introduction of a law which governs a specific type of data processing for a specific purpose related to public interest or health

Personal Data concerning Minors

Our services are only intended for use by persons who are over 18 years of age. For this reason, we only knowingly collect and process data relating to minors with the consent of their parents or legal guardians, and when such data is provided by the minors’ parents or legal guardians themselves. The limited circumstances we might need to collect the personal data of minors include part of a booking, the purchase of other travel-related services, or other exceptional circumstances (such as features offered to families). Again, this will only be used and collected as provided by a parent or legal guardian and with their consent.

If we become aware that we have collected the information of a minor without the valid consent of a parent or guardian, we will take all the appropriate measures to safely delete this information.

CCTV Data

In line with our security procedures, we have installed CCTV cameras in restricted areas in our offices. Notices are affixed to on the walls of our offices to inform our walk-in clients of this form of surveillance. Some of these CCTV cameras also record audio. These cameras are used solely for security purposes.

We generally retain CCTV footage for a period of seven (7) days, unless we are required to retain CCTV footage for a longer period for security reasons, or upon request of any competent authority or the Police.

3. How do we collect your Personal Data?

Although we mainly collect your Personal Data from yourself, there may be circumstances in which we may collect your Personal Data from other sources. Collection of Personal Data may, therefore, happen through:

Direct Interactions: The collection of your Identity Data, Account Data, Contact Data, Booking Data, Payment Data, Technical Data, Marketing and Communications Data, and of any other Additional Information Provided by You happens when you engage with us directly in our offices, by phone, email, our Website or otherwise. This includes Personal Data you provide us with when:

creating and making use of a personal account on our Website
navigating and making use of our Website, either as an account holder or as a general user
registering your marketing preferences with us
booking a property from our portfolio and making use of our services
contacting us with any queries, demands, requests, complaints or other feedback
participating in a survey and/or completing a questionnaire compiled by us
visiting our offices and passing through our CCTV areas as specifically marked
interacting with us through any one of our social media platforms

Automated technologies and/or interactions: The collection of your Technical Data happens whenever you access our Website and make use of our services online, and your Account Data whenever you choose to create an account on our Website and upon subsequent log-ins. We generally collect Technical Data automatically via the use of cookies which are covered under a specifically designated section further below in this Privacy Notice, and explained in more detail in our Cookie Notice available on our Website.

Third-parties: The collection of your Identity Data, Contact Data, Booking Data and Payment Data may also happen through third-parties either when:

you book one of our properties through one of the third-party booking platforms that we partner with; and/or
you are a travel companion to one of our guests making a booking with us, and you have given your consent to the guest for the provision of your data to us.

Publicly available sources: We may also need to collect Identity Data, Contact Data and Payment Data from various publicly available sources. This would likely happen in the regrettable case that we receive a complaint about you from an owner of a property that you would have booked through us, for example in the case of misconduct, extensive damage, and safety concerns for us to identify, detect, remedy and/or prevent harm to property and/or persons.

4. How do we use the Personal Data we collect?

We will only use your Personal Data on the basis of legally permissible grounds in terms of the Data Protection Laws. We will mainly process your Personal Data for the following reasons:

Reservation Purposes: Your Personal Data shall mainly be used to be able to organise, complete and administer your bookings. This may include sending you communications in relation to your bookings, such as the following:

booking confirmation emails,
proof of payment,
confirmation of any booking modifications carried out,
reminders of upcoming reservations or to pay the outstanding balance of an upcoming stay.

Personal Data may also be further processed prior to your check-in date and throughout the duration of your stay to be able to assist you with any other services that you would like us to coordinate and book for you (any additional services, such as excursions, activities, tours, charters, transport, and restaurant reservations).

Customer Service Purposes: We may also process your Personal Data to be able to provide you with customer service as may be required by yourself.

Damages and Recovery Purposes: In some exceptional cases, the Personal Data collected may also be used to enable us to withdraw and use damage deposits to remedy any possible damages made during your stay, or to assist you in recovering items left behind following the end of your stay.

Account Creation and Management Purposes: We offer the possibility to create an account on our Website. We will use the Personal Data that you use to create and to, subsequently, log into your account to be able to identify you and administer your account accordingly, allowing you to do a number of useful things such as managing and modifying your existing bookings, booking future trips easily and managing your personal settings at a click of a button.

Communication Purposes: There may be instances where we may need to process your Personal Data to communicate with you via email, by phone call and/or by text. There could be various reasons which necessitate such communication, such as for us to be able to respond and handle any requests you would have made, either directly to us or to any third-party booking platform that we partner with through which you would have secured your booking. We may also need to contact you to provide you with information that we feel might be useful to you in planning or getting the best out of your trip, as well as reminders of upcoming trips. We may also need to contact you after the termination of your stay to notify you of any belongings that you or any of your travel companions might have left behind, or of any damages to the property which would have occurred as a result of misuse, misconduct, fault or negligence on your or your travel companions’ part.

Client Review Purposes: During and/or after your trip, we might invite you and/or your travel companions to submit a review, which may then, with your consent, be shared publicly on our Website and/or on our other social media platforms.

Legal Purposes: We may need to process your Personal Data to handle and resolve legal claims and/or disputes. Your Personal Data may also be processed to ensure compliance with any lawful requests from law enforcement bodies, and that we abide by our legal obligations.

LEGAL GROUNDS FOR PROCESSING

The above information provides a general overview of how we use your Personal Data. If you are looking for more detail, the table below provides a description of the ways we process your Personal Data, and which of the legal bases under the GDPR we rely on to do so. We may process your Personal Data on the basis of more than one lawful ground, depending on the specific purpose for which we are using your Data, as follows:

Purpose of Processing	Personal Data that may be Processed	Legal Grounds for Processing
Creating your personal online account on our Website.	Identity Data Account Data Technical Data Marketing and Communications Data	Performance of our contractual obligations to you Protection of our legitimate interests (or those of a third party), such that we may require this information to enhance our efficiency in offering a reliable, superior and customised service to you Understanding your preferences, based on your consent, to receiving marketing material, including SMS and emails from us
Processing your bookings – when you choose to book your stay with us from our Website; through one of the third-party booking platforms that we partner with; in-person at our offices; or through any other means of communication directly with us.	Identity Data Contact Data Account Data (when booking through our Website) Booking Data Payment Data Technical Data (when booking through our Website) Marketing and Communications Data Additional Information Provided by You	Performance of our contractual obligations to you Protection of our legitimate interests (or those of a third party), such that we may require this information for administrative and logistical purposes and to better understand what listings you are interested in; for security reasons; to recover monies due to us Complying with our legal or regulatory obligations Understanding your preferences, based on your consent, to receiving marketing material, including SMS and emails from us
Receiving and reacting to your queries, demands, requests, complaints, or other feedback.	Identity Data Contact Data Account Data Additional Information Provided by You	Performance of our contractual obligations to you Protection of our legitimate interests (or those of a third party), such that we may require this information for administrative and logistical purposes in the general course of our business; to better understand what listings you are interested in; to better the services that we offer to you; to provide you with a reply; and to update our internal records as necessary
Sending promotional material and advertising which is relevant to you.	Identity Data Contact Data Account Data Marketing and Communications Data Technical Data	Protection of our legitimate interests (or those of a third party), such that we may require this information to better understand what services and property listings you are most interested to find in our portfolio and on our Website; to be able to provide you and/or recommend the listings that you, as one of our active customers, may be the most interested in; to better the services that we offer to you; to exercise and update our marketing strategies as required; and to continue growing our business Understanding your preferences, based on consent, to receiving promotional material, including SMS and emails, from us
Properly administering our business operations, Website and IT systems.	Identity Data Contact Data Account Data Technical Data Additional Information Provided by You	Protection of our legitimate interests (or those of a third party), such that we may require this information for administrative and logistical purposes in the general course of running our business in the best possible way; to manage our IT systems; and to ensure the security of our networks Complying with our legal or regulatory obligations
Processing of CCTV footage and audio as captured by our CCTV cameras located at our office.	(a) Identity Data	Protection of our legitimate interests (or those of a third party), such that we may require this information to enhance the security levels on our premises thereby protecting ourselves, our employees, our clients and walk-ins. Complying with our legal or regulatory obligations, including lawful requests from law enforcement bodies
Using data analytics to improve your experience on our Website, the services and property listings that we offer, and our relationship with you.	Technical Data	Protection of our legitimate interests (or those of a third party), such that we may require this information for administrative and logistical purposes in the general course of running our business in the best possible way; to better understand what services and property listings you are most interested to find in our portfolio and on on our Website; to update our marketing strategies as required; to better the services that we offer to you; and to continue growing our business

MARKETING AND COMMUNICATIONS

We may process your Personal Data, as an active client of ours, for marketing and communications purposes in the following instances:

when you would have specifically opted-in to directly receive marketing communications from us;
when we believe that any of our services and/or property listings may be of particular interest to you in being similar to those services and/or property listings that you might have requested or booked from us within a twelve (12) month period; and/or
when we have legitimate reasons to do so.

Any such Personal Data shall be collected and processed in line with the requirements and safeguards mandated by the Data Protection Laws, in line with the section above entitled, ‘LEGAL GROUNDS FOR PROCESSING’.

You can request us to stop sending you promotional material and, or communications for marketing purposes at any time should you wish to opt-out of our marketing chain, or should you no longer want us to keep you updated with our services and property listings, by following the opt-out links on any marketing message sent to you, or by contacting us directly via email, telephone or via our other channels of communication.

HYPERLINKS

Our Website may contain hyperlinks to other websites not owned or managed by us who have their own data protection polices which we have no control over. It shall be your responsibility to check their privacy policies. We shall not be liable for how your Personal Data is dealt with by such external websites.

COOKIES

Cookies are text files placed on your computer or portable device when using our Website, and which in effect work to collect standard internet log information and visitor information on our Website.

You can set up your browser to refuse all or some cookies or to alert you when websites set or access cookies. However, please be aware that, should you choose to disable or refuse your consent to certain cookies, our Website or some parts of our Website, may not function in the intended manner and your experience on our Website may be significantly diminished.

For more detailed information about how we use cookies, please refer to our Cookie Notice available on our Website.

5. Disclosure of Personal Data to Third-Parties

When it comes to sharing your Personal Data with third-parties, oftentimes deemed “Processors” in terms of the GDPR, we are very mindful who we share it with, and it is only shared if necessary for the purposes outlined in section 4 directly above. Your Personal Data may be shared with the following third-party Processors:

Building Managers and Property Owner(s): We may share your Personal Data and that of your travel companions with the owner(s), and/or their agents such as building or property managers, of the property that you may be staying at upon confirmation of your booking. The information shared is limited only to what is necessary (such as check-in and check-out dates, and number of persons staying at the property).

Local Service Providers and Business Owners: Mainly to assist you in coordinating, booking and managing any additional services (such as excursions, activities, tours, charters, transport, and restaurant reservations) that you may request before or throughout your stay.

IT Security and Software Support Service Providers: These include service providers who help us in ensuring that your Personal Data is kept secure and that our IT and software systems continue to run smoothly.

Other Service Providers Assisting us with IT Backups and Email Hosting: Mainly to ensure that your Personal Data is securely stored and to ensure business continuity.

CCTV Security Systems and Maintenance Providers: These include service providers who help us ensure that your Personal Data remains secure and that our security systems are properly maintained and working as expected.

Website Security and Maintenance Providers: These service providers assist us in ensuring that our website is secure and continues to run smoothly.

Administrative Software and Assistance Provided by Third-Parties: Mainly to enable us to organise and manage our internal administrative processes, including bookings, in a more efficient manner.

Third-Party Consultants and Professional Advisors: These include experts who assist us in various matters, including legal advisors, auditors, payroll assistants, accountants, insurers and brokers.

Payment Services Providers: These include service providers that facilitate payment transactions.

Marketers and Media Partners: These include service providers who may be assisting us with our marketing and communications strategies, practices and activities over time.

Regulatory, Governmental or Legal Authorities: These include entities that may require the disclosure of processing activities and/or certain Personal Data in certain circumstances.

6. Third-Party Service Terms

We partner with third-party booking platforms (such as Booking.com and Airbnb) to ensure the outreach of our property portfolio and services to you. Our booking system may therefore link to third-party booking platforms to ensure confirmation of your booking in real time. We do not however own or in any way control these third-party booking platforms. When you interact with these third-party booking platforms and choose to use their services to book one of the properties within our portfolio through them, you will be providing information and Personal Data to them, some of which Personal Data may then be shared by these third-party booking platforms with us for booking confirmation and management purposes as outlined in this Privacy Notice.

Your use of these third-party booking platforms and of their services is subject to the privacy notices and the service terms of these third-parties. We urge you to familiarise yourself with such third-party privacy notices and service terms to ensure that you are well-informed as to how your Personal Data will be processed by them.

7. Transfers to Third Countries

We may, in the course of our day-to-day business, need to share your Personal Data with the third-parties identified further above in this Privacy Notice, some of which may be located outside of Malta and in other countries within the European Union (“EU”) and the European Economic Area (“EEA”). We may also be required to share your Personal Data with third-party Processors located in third countries outside of the EU and the EEA. Our need to share your Personal Data with third-party Processors shall be limited by the following purposes:

the performance of contractual or pre-contractual obligations between you and Buena Vista Holidays Limited
IT security / software support
adherence with our legal and/or regulatory obligations
the establishment, exercise or defence of legal claims
any other reason where any such transfer would be permitted in terms of law

We require all third parties with whom we share Personal Data to respect the security of such Personal Data and to treat it in accordance with the law. We also ensure that agreements, or other safeguards in line with the Data Protection Laws, are in place when sharing Personal Data with any such third-party Processors to safeguard the security thereof.

8. Protection of your Personal Data

We take the protection of your Personal Data very seriously. For this reason, we have implemented appropriate security measures to prevent your Personal Data from being lost, altered or disclosed in an unauthorised manner. In addition, access to your Personal Data is limited those employees, agents, contractors and other third-party Processors as disclosed in this Privacy Notice, who have a business need-to-know. They will only process your Personal Data on our instructions and are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected Personal Data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

9. Data Retention

We retain your Personal Data only as long as we have a valid legal reason to do so, which includes satisfying any legal, accounting or reporting requirements.

To determine the appropriate retention period for Personal Data, we consider the amount, nature, and sensitivity of the Personal Data, the potential risk of harm from unauthorised use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In general, we will keep Personal Data for as long as necessary for us to be able to provide you with our services or until such time as you ask us to delete it, unless we need to keep the data for a longer period such as to comply with our legal, tax, reporting, and auditing obligations, or for our legitimate purposes such as detection and prevention of money laundering or fraud, or damage to property or persons. Indeed, we may retain different types of Personal Data for different lengths of time in line with legal requirements.

In some circumstances we may anonymise your Personal Data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

10. Your Rights

As a Data Subject, you have certain data protection rights at law. Your rights as a Data Subject are being listed and explained in the table below:

Your rights under the GDPR	What does this mean?
ACCESS	You have the right to access your Personal Data and request a copy thereof.
RECTIFICATION	You have the right to rectify any incorrect Personal Data that we may hold about you.
ERASURE	You have the right to be forgotten, which enables you to ask us to delete your Personal Data where there is no good reason for us continuing to process it. On this point, note that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request. We may not be able to provide you with some of our services if we do not hold your Personal Data.
RESTRICTION OF PRCOCESSING	You have the right to request the restriction of our processing. This can be done in the following cases: (a) if you want us to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
PORTABILITY	You have the right to data portability. Your data may be requested in a machine-readable format and you may also ask that your data be transferred directly to another person or service provider.
OBJECTION TO PROCESSING	You may object to the processing of your data where we are relying on legitimate interests (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
WITHDRAWAL OF CONSENT	If you have provided consent for the processing of your data you have the right (in certain circumstances) to withdraw that consent at any time which will not affect the lawfulness of the processing before your consent was withdrawn.

[NOTE: We may not be able to provide you with some of our services if you opt to: erase, restrict processing, object to processing, or withdraw your consent.]

If you wish to exercise any of the rights set out above, please contact us. We will try to respond to all legitimate requests within one month and may require that you send over specific information to help us confirm your identity and ensure your right to access your Personal Data (or to exercise any of your other rights as outlined directly above). This is a security measure.

You will not have to pay to access your Personal Data (or to exercise any of the other rights mentioned above). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may, in such circumstances, refrain from complying with your request.

11. Contact Information and Responsible Entities

If you have any further questions about the processing of your Personal Data, please feel free to contact us. We are re-including our contact details below for your ease of reference:

Postal address: 15, Ix-Xatt ta’ Qui-Si-Sana, Sliema, Malta.

Email address: info@buenavistaholidays.com

Contact number: (+356) 7939 6674

Should you feel that our data protection practices have infringed your rights in any manner, you may lodge a complaint with the competent data protection supervisory authority. In Malta, this would be the Office for the Information and Data Protection Commissioner, the contact details of which are as follows:

OFFICE OF THE INFORMATION AND DATA PROTECTION COMMISSIONER [MALTA]

Email address: idpc.info@idpc.org.mt

Contact number: (+356) 2328 7100

We do, however, endeavour to receive and address your data protection concerns, and would therefore appreciate it if you were to contact us first should you feel that our practices may have violated any privacy rules.