Site operator
- Company
- Vacantier
- [email protected]
1. Who is responsible for your data
The data controller is Vacantier, with the identification details shown in the "Site operator" box. For any question or request about your data, write to us at [email protected].
2. In short
- we do not ask for any data to let you search or compare offers;
- we do not sell or rent data to anyone, and we do not pass it to partners when you visit them;
- we do not process payments and never see your card details;
- visit statistics use an anonymised identifier that changes daily, not tracking cookies;
- third-party affiliate scripts load only with your consent;
- you can delete your account and all of its data yourself, from your settings.
3. What data we process
The data depends on what you do on the site:
| When | Data |
|---|---|
| Any visit | IP address and browser type, in the server's technical logs and in the session; the language and currency chosen; your cookie choice. |
| Searches | the search criteria (destination, dates, filters), the number of results and an anonymised visit identifier, computed from the IP, browser and the day's date, which cannot be reversed and changes at midnight. |
| Click to a partner | the offer or hotel chosen, the partner, the price shown, the search that led there, the referring page, campaign parameters (utm), browser type, the anonymised visit identifier and, if you are signed in, your account. |
| Traveller account | name, email address, password (stored only in irreversibly hashed form), email language, the date your address was confirmed, the date and version of the terms accepted. |
| Account features | favourite hotels, price alerts (hotel, number of nights, target price), saved searches and the history of emails sent for them. |
| Agency account | in addition to the account data: the agency name, website and phone, the decision on the access request, and the offers and feeds it manages. |
| Correspondence | what you write to us by email and the contact details you give us. |
We do not collect special categories of data (health, religion, political opinions and the like), and ask you not to send them to us.
4. Why we process it and on what basis
| Purpose | Legal basis (GDPR, Art. 6) |
|---|---|
| Showing the site, searching and comparing offers, keeping language and currency preferences. | Our legitimate interest in operating and providing the service requested — Art. 6(1)(f). |
| Creating and running the account, favourites, price alerts, saved searches and the emails you ask for. | Performance of the contract (these terms) — Art. 6(1)(b). |
| Service emails: address confirmation, password reset, notices about the account or changes to the terms. | Performance of the contract and legal obligations — Art. 6(1)(b) and (c). |
| Reviewing an agency's access request and running the portal. | Steps at your request before a contract, and its performance — Art. 6(1)(b). |
| Recording clicks to partners, aggregate statistics, settling commissions, preventing click fraud. | Our legitimate interest in funding and protecting the service — Art. 6(1)(f). |
| Site security: limiting abuse, detecting bots, investigating incidents. | Legitimate interest — Art. 6(1)(f). |
| Third-party affiliate scripts (Travelpayouts, Kiwi.com). | Your consent — Art. 6(1)(a), which you can withdraw at any time. |
| Answering requests and complaints, and obligations towards authorities. | Legal obligation and legitimate interest — Art. 6(1)(c) and (f). |
Where we rely on legitimate interest, we have checked that it does not override your rights: we use as little data as possible, anonymise it where we can and delete it quickly. We make no automated decisions with legal effects on you and build no profile of you. Offer scores describe offers, not people.
5. How long we keep data
| Data | Period |
|---|---|
| The session | 2 hours from the last activity; longer only if you choose "Remember me", in which case we recognise you for up to 400 days. |
| Clicks to partners, in detail | 90 days, after which only daily totals remain, without any identifier. |
| The search log | 180 days. |
| Password reset link | 60 minutes. |
| The account and its data | as long as you have the account; on deletion, we immediately remove the account, favourites, alerts and saved searches. |
| An agency's access request | as long as the agency account exists. |
| Correspondence | as long as needed to resolve the request and, after that, at most 3 years, for possible complaints. |
| Backups | at most 30 days, after which they are overwritten. |
Agencies' billing and accounting data is kept as long as the law requires (currently 10 years).
6. Who we share data with
We do not sell personal data. We share it only where the service needs it:
- hosting, database, backup and email delivery providers, who work on our behalf under contract and may not use the data for any other purpose;
- Travelpayouts and Kiwi.com, only if you accept marketing cookies: their scripts receive your IP address, browser information and their own cookies directly from your browser;
- authorities, only when the law requires it and within the limits of their request.
When you leave for a partner (an agency, Agoda, Kiwi.com), we pass on only the offer or the search criteria (for example the dates of the stay and the number of guests) and our affiliate marker, not your name, email or account. Any data you then give the partner to book is processed by them, under their own privacy policy.
7. Transfers outside the European Economic Area
We keep data in the European Union. Some providers or partners may process data outside the European Economic Area. In that case, transfers are made only to countries with a European Commission adequacy decision or under the Commission's standard contractual clauses, with the necessary supplementary measures. You can ask us for a copy of the safeguards at [email protected].
8. How we protect data
- all traffic is encrypted (HTTPS), and session cookies are encrypted and not readable by scripts;
- passwords are stored only as irreversibly hashed values;
- access to administration is restricted to the people who need it, with a confirmed email address;
- sensitive forms are rate limited, and unsubscribe links are signed;
- statistics use anonymised identifiers that change daily and are deleted after the periods above.
No system is perfectly secure. If a personal data breach occurs that may affect your rights, we notify the authority within 72 hours and you without undue delay, as the GDPR requires.
9. Your rights
Under the GDPR, you have the right:
- of access — to know what data we hold about you and receive a copy;
- to rectification — to correct wrong data; you can change your name and email yourself in your Account settings;
- to erasure — to delete your account and data; you can do it yourself in your Account settings;
- to restriction — to ask us to stop using the data while a dispute is checked;
- to portability — to receive your account data in a structured, machine-readable format;
- to object — to processing based on legitimate interest;
- to withdraw consent at any time, without affecting processing before then; for cookies, from "Cookie settings" in the page footer;
- to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), 28-30 G-ral. Gheorghe Magheru Blvd., Sector 1, Bucharest, or with the authority in the country where you live.
To exercise your rights, write to us at [email protected] from the address linked to your account. We answer free of charge within one month at most; this can be extended by two further months for complex requests, in which case we will tell you. We may ask for additional information only to confirm the request comes from you.
10. Minors
Accounts are intended for people aged 16 or over. We do not knowingly collect data about younger children. If you learn that a child has created an account, write to us and we will delete it.
12. Changes to this policy
We update this policy when the data we process, or the way we process it, changes. The date it takes effect is shown at the top of the page. We notify account holders of significant changes by email.
Questions about this document?
Write to us at [email protected]. We answer within 30 days at most, usually much sooner.