Privacy policy

Version of 21 October 2026.

1. Who we are

PFP Invest Winterswijk B.V., Jan Tooropstraat 29, 7103 AA Winterswijk, the Netherlands (KVK 69878358), rents out Tentalaria Apartments and is responsible for the personal data described here. Questions and requests: booking@tentalariacuracao.com.

2. What we collect

When you book: your name, email address, phone number, the dates, the number of guests and any message you send. Your card details go directly to our payment provider Stripe; we never see your full card number. For your stay: your arrival time and the messages you exchange with us or with Chrissi's Curaçao. When you contact us: the details you fill in and your message. When you visit the website: technical data such as your IP address and browser, and cookies (section 10).

3. Why we use it

To handle your booking, payments and stay: needed for our agreement with you (GDPR article 6(1)(b)). To keep our accounts and meet tax rules: a legal obligation (article 6(1)(c)). To answer your questions, prevent fraud, keep the website secure and handle disputes: our legitimate interest (article 6(1)(f)). After your stay we email you once to ask for a review, also our legitimate interest; tell us if you would rather not receive it. We do not use your details for other marketing and we do not sell them.

4. Who receives it

Hostaway (Hostaway Opco Oy, Finland): the software that runs this website, our bookings and our messages. It processes data on our behalf, with service providers for the website, hosting, communication, analytics and AI features, some of them in the United States, and uses booking data for its own compliance checks.

Stripe: our payment provider. It processes payments on our behalf and is itself responsible for its fraud checks and legal duties (stripe.com/privacy).

Chrissi's Curaçao: our team on Curaçao, for check-in, contact during your stay and cleaning. They see your booking without the amounts (name, contact details, dates, number of guests, arrival time) and the messages about your stay.

Google: the reCAPTCHA check that protects the booking pages against misuse (policies.google.com/privacy).

The tax authorities, where the law requires it.

5. Outside the European Union

Curaçao is outside the European Union and has no EU adequacy decision. We pass your details to Chrissi's Curaçao because that is needed to provide the stay you booked (GDPR article 49(1)(b)). Stripe transfers data to the United States under the EU-U.S. Data Privacy Framework and standard contractual clauses. Hostaway states that it uses an appropriate transfer mechanism for its service providers outside the EU. Google may process the reCAPTCHA data in the United States.

6. How long we keep it

Booking, invoice and payment records: 7 years, as Dutch tax law requires (article 52 of the Algemene wet inzake rijksbelastingen). Other details, such as messages: as long as needed for your stay and any questions or claims afterwards, at most 2 years after your stay. Messages that did not lead to a booking: at most 1 year.

7. Your rights

You can ask to see, correct or delete your data, to restrict its use, and to receive it in a portable form. Email booking@tentalariacuracao.com; we answer within one month. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or the authority in your own country.

Right to object: where we rely on our legitimate interest (section 3), you can object at any time. We then stop, unless we have compelling grounds or need the data for a legal claim.

8. What we need from you

We need your name, email address and payment to make a booking; without them we cannot book your stay.

9. Automated decisions

We make no automated decisions about you. Stripe checks payments for fraud under its own responsibility.

10. Cookies

The website uses cookies it needs to work: for the booking steps, for remembering your cookie choice and for the reCAPTCHA check. We have switched on no analytics or advertising cookies; if we ever do, we ask your consent first in the cookie banner. Stripe's payment page sets its own cookies (stripe.com/cookie-settings).

11. Changes

We may update this policy; the version date is at the top. If we want to use your data for a new purpose, we tell you first.