Skip to content
Velcaya

Privacy Policy

This Privacy Policy explains how Biz Caribe sp. z o.o., the operator of the Velcaya website, collects, processes and protects the personal data of users of https://www.velcaya.com.

This Privacy Policy fulfils the information obligations set out in Articles 13 and 14 of the General Data Protection Regulation (GDPR).

1. Personal Data Controller

The Controller of your personal data is:

BIZ CARIBE SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ

ul. Radziwie 7 m 268
01-164 Warsaw, Poland

KRS: 0001184339
NIP: 5273173707
REGON: 542268438

E-mail: hello@velcaya.com
Tel.: +1 (849) 564-6630

hereinafter referred to as the Controller.

The Controller has not appointed a Data Protection Officer. For all matters concerning personal data and privacy, please contact us at hello@velcaya.com.

2. Purposes and Legal Bases for Processing

2.1 Contact Form and Property Enquiries

Purpose: handling enquiries submitted through the contact form, by e-mail, telephone or WhatsApp.

Data processed: name, e-mail address, telephone number where provided, and the content of the message.

Legal basis: Article 6(1)(b) or Article 6(1)(f) of the GDPR.

Retention period: up to 3 years from the date of the last contact.

2.2 Booking and Provision of Accommodation Services

Purpose: conclusion and performance of a booking or short-term rental agreement, check-in and check-out arrangements, communication before and after the stay, and settlement of utility or other applicable charges.

Data processed: full name, e-mail address, telephone number, dates and place of stay, number of guests, payment details processed by the relevant payment service provider, and any special requests submitted by the Guest.

Legal basis: Article 6(1)(b) of the GDPR, where processing is necessary for the performance of a contract, and Article 6(1)(c) of the GDPR, where processing is necessary to comply with tax, accounting or other legal obligations.

Retention period: 5 years from the end of the calendar year in which the agreement was performed.

2.3 Newsletter

Purpose: sending offers, news and marketing materials by e-mail.

Data processed: e-mail address and, where provided, name.

Legal basis: Article 6(1)(a) of the GDPR, based on the user’s consent.

Retention period: until consent is withdrawn, with information confirming the granting of consent retained for up to 3 additional years where necessary for evidentiary purposes.

2.4 User Account

Where the Website provides the option to create a user account, personal data may be processed for the purpose of registration, login, booking management and access to booking or stay history.

Data processed: name, e-mail address, securely stored password data and booking history.

Legal basis: Article 6(1)(b) of the GDPR.

Retention period: for the duration of the user account and up to 3 years following its deletion, where necessary for the establishment, exercise or defence of legal claims.

2.5 Direct Marketing

Purpose: sending offers and marketing communications by e-mail, SMS, telephone or WhatsApp.

Legal basis: Article 6(1)(a) of the GDPR, where consent is required, or Article 6(1)(f) of the GDPR where the Controller relies on its legitimate interest in maintaining relationships with existing customers, subject to applicable law.

Users may withdraw their consent or object to direct marketing at any time.

2.6 Security of Properties and Guests

Purpose: ensuring the safety of persons staying at the properties, protecting property, verifying the identity of Guests where necessary, and preventing fraud or misuse.

Data processed: full name, booking number and, where required for check-in or under applicable law, identification details.

Legal basis: Article 6(1)(f) of the GDPR, based on the Controller’s legitimate interest in protecting Guests and property, and Article 6(1)(c) of the GDPR where processing is necessary to comply with applicable legal obligations, including obligations arising under Dominican law.

2.7 Ratings and Reviews

Purpose: enabling Guests to submit ratings and reviews of properties and allowing such reviews to be displayed publicly on the Website.

Data processed: name or nickname, review content and rating.

Legal basis: Article 6(1)(a) of the GDPR.

2.8 Google Analytics

Purpose: analysing Website traffic, usage and performance.

Legal basis: Article 6(1)(a) of the GDPR, based on consent provided through the cookie consent mechanism.

Google may process certain data outside the European Economic Area in accordance with applicable data-transfer mechanisms and safeguards.

2.9 Meta Pixel

The Website may use Meta Pixel in connection with Facebook and Instagram advertising.

Purpose: measuring the effectiveness of advertising campaigns, remarketing and displaying personalised advertisements.

Legal basis: Article 6(1)(a) of the GDPR, based on consent provided through the cookie consent mechanism.

Data may be processed by Meta Platforms Ireland Limited and other entities within the Meta group in accordance with their applicable privacy policies and international data-transfer safeguards.

2.10 Communication via WhatsApp

Purpose: handling enquiries, providing customer support and communicating with Guests before, during and after their stay.

Legal basis: Article 6(1)(b) or Article 6(1)(f) of the GDPR.

Communication through WhatsApp is also subject to the privacy terms and data-processing practices of WhatsApp and Meta.

2.11 Property Management System (PMS)

The Controller may use an external Property Management System (PMS) to manage bookings, availability calendars, Guest information and settlements.

Data processed: name, e-mail address, booking dates and booked property, as well as other information necessary to manage the reservation.

Legal basis: Article 6(1)(b) of the GDPR.

Where required, the Controller enters into appropriate data processing agreements with service providers processing personal data on its behalf.

3. Categories of Data Recipients

Personal data may be disclosed to the following categories of recipients where necessary:

  • property hosts and persons responsible for managing the property, to the extent necessary to provide the booked accommodation,
  • external booking platforms, including Airbnb, Booking.com and VRBO, where the reservation originates from or is managed through such platforms,
  • payment service providers, to the extent necessary to process payments,
  • providers of Property Management Systems,
  • IT, hosting, CRM, communication and mailing service providers,
  • providers of analytics and advertising tools, including Google and Meta,
  • local service providers in the Dominican Republic, including cleaning, maintenance and security providers, to the extent necessary to provide accommodation services,
  • professional advisers, accountants or legal advisers where necessary,
  • Polish, Dominican or other competent public authorities where disclosure is required by applicable law.

Where a third party processes personal data on behalf of the Controller, appropriate data processing arrangements are implemented where required by law.

4. Transfers of Data Outside the European Economic Area

Due to the international nature of the services provided by Velcaya, personal data may be transferred outside the European Economic Area.

In particular, data may be processed:

  • in the United States, in connection with services provided by technology, analytics or advertising providers such as Google and Meta,
  • in the Dominican Republic, where this is necessary to arrange and provide accommodation services, manage properties or support Guests during their stay.

Where required under the GDPR, the Controller uses appropriate safeguards for international transfers, including Standard Contractual Clauses or other legally recognised transfer mechanisms.

5. Data of Children and Minors

The Velcaya Website is intended exclusively for adults aged 18 or over.

The Controller does not knowingly collect personal data directly from persons under the age of 18.

Where information concerning minors is necessary in connection with a family or group booking, such information should be provided by the parent, legal guardian or another authorised adult.

If you become aware that a minor has provided personal data directly to us without appropriate authorisation, please contact us at hello@velcaya.com so that we can take appropriate action.

6. Rights of Data Subjects

Under the GDPR, you may have the right to:

  • access your personal data pursuant to Article 15 of the GDPR,
  • rectify inaccurate or incomplete data pursuant to Article 16,
  • request erasure of your personal data pursuant to Article 17,
  • request restriction of processing pursuant to Article 18,
  • receive and transfer your personal data pursuant to Article 20,
  • object to processing pursuant to Article 21,
  • withdraw your consent at any time where processing is based on consent.

Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.

Requests concerning personal data may be sent to:

hello@velcaya.com

or by post to:

Biz Caribe sp. z o.o.
ul. Radziwie 7 m 268
01-164 Warsaw, Poland

The Controller will respond to requests within the period required by applicable data protection law, normally within one month.

7. Right to Lodge a Complaint

If you believe that your personal data is being processed in breach of applicable data protection law, you have the right to lodge a complaint with the Polish supervisory authority:

President of the Personal Data Protection Office
(Prezes Urzędu Ochrony Danych Osobowych)

ul. Stawki 2
00-193 Warsaw, Poland

E-mail: kancelaria@uodo.gov.pl
Website: www.uodo.gov.pl

8. Profiling and Automated Decision-Making

The Controller may use marketing profiling to tailor advertising and promotional content to users based on their activity on the Website.

Such profiling does not produce legal effects concerning users or similarly significantly affect them.

Consent to analytics and marketing cookies may be withdrawn or changed at any time through the Website’s cookie consent settings.

9. Data Security

The Controller implements appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration, disclosure or destruction.

These measures may include:

  • HTTPS/SSL encryption,
  • access controls and authentication measures,
  • regular software and security updates,
  • appropriate agreements with service providers processing personal data,
  • internal procedures concerning access to personal data,
  • employee training and awareness measures.

Security measures are reviewed and updated where appropriate, taking into account the nature of the data processed and the risks associated with processing.

10. Changes to this Privacy Policy

This Privacy Policy may be updated from time to time, in particular where required due to changes in applicable law, the services provided by Velcaya or the technologies used on the Website.

Last updated: 1 June 2026.

The current version of this Privacy Policy is always available at https://www.velcaya.com.