Privacy policy

Data controller

Sandra Loots & Johan Nerinckx, Torenveld 110, 3980 Tessenderlo, Belgium. Casa do Branco is rented as a private holiday home. We are joint data controllers for the personal data you share with us through this website.

1. What data we collect

When you submit a booking request we process: first name, last name, email, phone, street + house number (+ optional apartment unit), postal code, city, country, arrival and departure date, number of guests, how you found us and any remarks. We also automatically log your IP address in technical logs of our backend and of Cloudflare Turnstile (bot protection).

2. Why we use this data

We use your data to assess and confirm your booking request, draft a rental agreement, communicate with you about your stay and meet our legal record-keeping duties. The legal basis is performance of a (prospective) contract (art. 6.1.b GDPR) and, for bot protection and security logs, our legitimate interest (art. 6.1.f GDPR).

3. Processors

To run this website we rely on the following processors:

• Supabase (database + edge functions) — hosts bookings and website content, EU region (Ireland).
• Resend (email delivery) — sends the confirmation email and the PDF contract. Resend is based in the US and certified under the EU–US Data Privacy Framework.
• Cloudflare Turnstile (bot protection) — receives your IP and browser signals to block automated requests. Sets a short technical cookie (cf_chl / cf_clearance).
• Plausible Analytics (aggregate visitor statistics) — cookieless and privacy-friendly, stores no personal data or cross-site identifiers.
• Vercel (website hosting) — serves pages from EU edge locations.

4. Cookies & local storage

We don't use tracking cookies. We do use: a short Cloudflare Turnstile cookie during a bot check, and sessionStorage in your browser to temporarily save your booking form if you accidentally navigate away. Both are strictly functional and contain no identifiers.

5. Retention period

Booking files and invoices are kept for 7 years per Belgian accounting law. Unconfirmed requests are deleted within 12 months. Technical security logs (Turnstile, edge functions) expire within 30 days.

6. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. Submit a request via email. We respond within one month. Not satisfied? You can file a complaint with the Belgian Data Protection Authority (gegevensbeschermingsautoriteit.be).

7. Transfers outside the EEA

Resend and Cloudflare may process data in the US. These transfers happen under standard contractual clauses and — where applicable — the EU–US Data Privacy Framework.

8. Contact

For privacy questions, access requests or complaints: email the contact address in the footer. State your request clearly so we can help you quickly.