Privacy policy

Version of 4 November 2026.

1. Who we are

PFP Invest Winterswijk B.V., Jan Tooropstraat 29, 7103 AA Winterswijk, the Netherlands (KVK 69878358), rents out Tentalaria Apartments and is responsible for the personal data described here. Questions and requests: booking@tentalariacuracao.com.

2. What we collect

When you book: your name, email address, phone number, the dates, the number of guests and any message you send. Your card details go directly to our payment provider Stripe; we never see your full card number. We do see the payments: amounts, dates, status, refunds, and the card type and last four digits.

For your stay: your arrival time, the messages you exchange with us or with Chrissi's Curaçao, the electricity meter readings, and, if something is damaged or missing, photos and an estimate of the costs.

After your stay: the review you write, if you write one.

When you contact us: the details you fill in and your message.

When you visit the website: technical data such as your IP address, your browser and the pages you visit, and cookies and similar technology (section 10).

3. Why we use it

To handle your booking, payments and stay, including electricity and damage after your stay: needed for our agreement with you (GDPR article 6(1)(b)).

To keep our accounts and meet tax rules: a legal obligation (article 6(1)(c)).

To answer your questions, prevent fraud, keep the website secure and handle disputes: our legitimate interest (article 6(1)(f)).

To measure how the website is used: Hostaway, which runs the website, measures visits with Google Analytics on every page (article 6(1)(f): the interest in a website that works).

After your stay we email you once to ask for a review, as our legitimate interest. You can refuse it at any time by email and in the review email itself; we then do not send it, free of charge and without asking why.

We do not use your details for other marketing and we do not sell them.

4. Who receives it

Hostaway (Hostaway Opco Oy, Finland): the software that runs this website, our bookings and our messages. It processes data on our behalf, with service providers for the website, hosting, communication, analytics and AI features, among them Duda (the website builder), Amazon Web Services, Google Cloud, Twilio, OpenAI and Anthropic, some of them in the United States. We may use its AI features to help draft and translate our replies. Hostaway also uses booking data for its own compliance checks, as controller itself.

Stripe: our payment provider. It processes payments on our behalf and is itself responsible for its fraud checks and legal duties (stripe.com/privacy).

Chrissi's Curaçao: the company that looks after the apartments on Curaçao for us, for check-in, contact during your stay and cleaning. They process data on our behalf. They see your booking without the amounts (name, contact details, dates, number of guests, arrival time), the messages about your stay, the meter readings and any damage.

TransIP (the Netherlands): our email and domain provider; your emails to us are stored there.

Google: the reCAPTCHA check on the contact form and the booking pages, which protects them against misuse, and Google Analytics, which Hostaway runs on every page of the website (policies.google.com/privacy).

OpenStreetMap: the map on each apartment's page is loaded from its servers, which receive your IP address. The code that draws the map comes from unpkg.com, which receives your IP address too.

Our bank and our accountant: for payments by bank transfer and for our bookkeeping.

The tax authorities, where the law requires it.

5. Outside the European Union

Curaçao is outside the European Union and has no EU adequacy decision. Chrissi's Curaçao receives your details only under a processor agreement with the EU standard contractual clauses.

Stripe, Hostaway's service providers and Google may process your data in the United States. These transfers rely on standard contractual clauses or the EU-US Data Privacy Framework, as applicable.

OpenStreetMap is run from the United Kingdom, which has an EU adequacy decision. unpkg.com is served through Cloudflare and may receive your IP address in the United States.

You can ask us for a copy of these safeguards at booking@tentalariacuracao.com.

6. How long we keep it

Booking, invoice and payment records, with the meter readings and damage records that support a charge: 7 years, as Dutch tax law requires (article 52 of the Algemene wet inzake rijksbelastingen). Other details, such as messages: as long as needed for your stay and any questions or claims afterwards, at most 2 years after your stay. Messages that did not lead to a booking: at most 1 year. A review stays as long as it is published. Cookies: see section 10.

7. Your rights

You can ask to see, correct or delete your data, to restrict its use, and to receive it in a portable form. This is free. Email booking@tentalariacuracao.com; we answer within one month. If a request is complex, or you send many, we may take two more months; we then tell you why within the first month. Where we use data with your consent, you can withdraw it at any time; this does not affect what happened before. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or the authority in your own country.

Right to object: where we rely on our legitimate interest (section 3), you can object at any time. We then stop, unless we have compelling grounds or need the data for a legal claim. You can always object to the review email; we then stop sending it, without exception.

8. What we need from you

We need your name, email address, phone number and payment to make a booking; without them we cannot book your stay.

9. Automated decisions

We make no automated decisions about you. Stripe checks payments for fraud under its own responsibility.

10. Cookies

The website uses cookies it needs to work: for the booking steps. These need no consent.

Google Analytics: Hostaway's measurement of how the website is used, on every page. It sets the cookies _ga and _ga_DZF2BQ8W47, kept for about 13 months. Hostaway places it. The website shows Hostaway's cookie banner, where you can accept or decline non-essential cookies and change your choice under "Preferences"; at present Hostaway's Google Analytics also runs if you decline. You can block or delete these cookies in your browser settings.

reCAPTCHA: Google's check on the contact form and the booking pages against misuse. It sets the cookie _GRECAPTCHA, kept for 6 months, and stores data in your browser.

Map: each apartment's page shows a map loaded from OpenStreetMap, with its code from unpkg.com. It sets no cookies, but both receive your IP address.

Payment page: Stripe sets its own cookies there, to prevent fraud (stripe.com/cookie-settings).

We use no advertising cookies.

11. Changes

We may update this policy; the version date is at the top. If we want to use your data for a new purpose, we tell you first.