1. Introduction

This Privacy Notice applies to the Processing of Personal Data of individuals who visit or use this website www.baronholidayhomes.com (the "Website") operated by BaronGroup (the "Controller", "We", "Us" or "Our"). It informs those visiting and using the Website (each individually a "Data Subject", "You", or "Your") about the personal data that the Controller processes in relation to their experience when visiting the Website, for what purpose it is held and for how long it is expected to be used.

We want you to feel confident about the privacy and security of Your Personal Data. Please read this Notice carefully so that You are aware of how and why We are using Your Personal Data and what Your rights are under the Applicable Laws.

2. Definitions

In this Privacy Notice, the following terms shall have the meanings set out below:

"Applicable Laws" means the GDPR and the DP Act;
"Consent" means any freely given, specific, informed and unambiguous indication of Your wishes by which You (by a statement or by a clear affirmative action) signify agreement to the Processing of Your Personal Data;
"Controller" means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing of your Personal Data;
"Data Subject" means any identified or identifiable natural person to whom Personal Data relates;
"DP Act" means Chapter 586 of the Laws of Malta (the Data Protection Act) and the subsidiary legislation thereunder, as may be amended from time to time;
"GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);
"Personal Data" means any information relating to an identified or identifiable natural person. It does not include data from or through which the person's identity cannot be determined (anonymous data);
"Processing" means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; and
"Processor" means the natural or legal person, public authority, agency or other body which processes Personal Data on behalf of the Controller.

3. Who We Are

BaronGroup is a trading name under which the Controller operates this Website and provides short-let holiday accommodation booking services in Gozo.

Should You wish to contact Us for any reason with respect to Our Processing of Your Personal Data, You may do so using the below details:

Trading name: Baron Holiday Homes
Business address: Baron Group of Companies, Triq Karlu Galea, Victoria, Gozo, Malta VCT2106
Email address: dpo@baronholidayhomes.com
Telephone number: +35620105660

4. Complaints

You have the right to make a complaint with respect to the Processing of Your Personal Data at any time to any supervisory authority. The supervisory authority in Malta is the Office of the Information and Data Protection Commissioner (the "IDPC"), the contact details of which are as follows:

Name: Information and Data Protection Commissioner
Address: Floor 2, Airways House, Triq il-Kbira, Tas-Sliema SLM 1549, Malta
Email: idpc.info@idpc.org.mt
Landline: +356 2328 7100

The Controller would appreciate the chance to deal with Your concerns before You approach the IDPC, so please contact the Controller in the first instance.

5. Amendments to This Privacy Notice

We can make changes to this Privacy Notice from time to time. We will identify the changes we have made on this page. In circumstances where a change will materially change the way in which We collect or use Your Personal Data, We will send a notice of this change to You and You shall have the right to object to any such update and/or amendment or withdraw Your consent.

During Your relationship with Us, We strive to see that Your Personal Data is correct and up-to-date. We thus urge You to keep Us informed of any changes in or to Your Personal Data.

6. The Personal Data We Collect About You

In the context of this Privacy Notice, We may process different kinds of Personal Data about You, which We have grouped together below:

Identity Data includes Your full first name and last name.
Contact Data includes Your email address and mobile number.
Location Data includes Your home address and country of residence. This field is optional. You are not required to provide this information in order to make a booking.
Booking Data includes Your intended check-in and check-out dates, the number of guests in Your party, and, where children are included in Your party, the age of each child. Children's ages are collected strictly to determine the applicable pricing for Your booking: children under 3 years of age stay free of charge, and children aged 3 to 17 (inclusive) are subject to a reduced rate. No other information about children is collected.
Communications Data includes the content of any message You submit to Us via the contact form on the Website, including any free-text enquiry or request You choose to include. This data is collected only when You voluntarily submit the contact form and is used solely to respond to Your enquiry.
Marketing Preferences Data includes Your email address (where separately provided or confirmed for marketing purposes) and Your record of consent to receive marketing communications from Us. This data is only collected if You actively opt in to receiving marketing emails from Us.

7. How Is Your Personal Data Collected?

We collect Personal Data from and about You through the following method:

Direct interactions: You provide Us with Your Personal Data directly when You make or enquire about a booking on Our Website, by completing the booking form or any other form available on the Website, or by corresponding with Us by email, telephone, or otherwise. Where You choose to opt in to receiving marketing emails from Us, We will also collect Your Marketing Preferences Data directly from You at the point at which You provide Your consent, via the opt-in mechanism on Our Website.

8. Purposes and Lawful Bases for the Processing of Your Personal Data

We have set out below a description of all the ways We plan to use Your Personal Data, and which of the legal bases (in terms of the Applicable Laws) We rely on to do so. We have also identified what Our legitimate interests are, where appropriate.

Note that We may process Your Personal Data on more than one lawful basis, depending on the specific purpose for and context in which We are using Your Personal Data. Please contact Us if You need details about the specific legal basis We are relying on to Process Your Personal Data where more than one legal basis has been set out in the table below.

Purpose / Activity	Lawful Basis for Processing
Processing and confirming Your booking	Necessity for the performance of a contract between You and Us (Article 6(1)(b) GDPR)
Client communications regarding Your stay	Necessity for the performance of a contract between You and Us (Article 6(1)(b) GDPR)
Compliance with legal and tax obligations	Compliance with a legal obligation to which We are subject (Article 6(1)(c) GDPR)
Sending You marketing emails about Our accommodation and availability	Your Consent (Article 6(1)(a) GDPR)
Delivery of form submission notifications	Necessity for the performance of a contract or to take steps at Your request (Article 6(1)(b) GDPR) and Our legitimate interests in operating Our business (Article 6(1)(f) GDPR)

9. Children's Data

This Website is intended for use by adults only. Bookings must be made by an adult aged 18 or over. We do not knowingly permit children to use this Website directly or to submit bookings through it.

We do not use children's Personal Data for marketing or profiling purposes.

Where children are included as guests in a booking made by an adult, We collect only the age of each child guest. Children's ages are collected for one purpose only: to calculate the applicable accommodation rate. No other information about children is collected.

10. Payment Processing and Stripe

All payment transactions made through Our Website are processed by Stripe, a third-party payment service provider. When You submit payment details on Our Website, those details are transmitted directly and securely to Stripe. We do not receive, store, or retain any payment card numbers, bank account details, or other sensitive payment data.

Stripe acts as an independent Controller in respect of the payment data You provide to it and its processing of that data is governed by Stripe's own privacy policy, which We encourage You to review. Stripe's privacy policy is available at https://stripe.com/gb/privacy.

11. Disclosures of Your Personal Data

In the course of the Controller's business, the Controller works with third parties, typically service providers or subcontractors, who may also be the Controller's Processors, though some third-party recipients, such as Stripe, act as independent Controllers in respect of the Personal Data they receive. In particular, the Controller may have to share Your Personal Data with the third parties set out below:

Avantio
Stripe
We also partner with Booking.com, Airbnb, Expedia and their affiliates
Tax and Regulatory Authorities
IT Service Providers
Professional Advisors
Regulators, courts, law enforcement and other authorities

12. International Transfers

We may transfer Your Personal Data to persons or entities outside the EU and the European Economic Area (the "EEA") for the following purposes: (a) receiving IT support; (b) adherence with Our legal and/or regulatory obligations; and/or (c) any other reason where any such transfer would be permitted in terms of law.

13. Data Retention

We retain Your Personal Data only for as long as necessary to fulfil the purposes for which it was collected and to comply with any applicable legal, accounting, or reporting obligations, and in any event for no longer than 5 years from the date of Your stay or, if no stay takes place, from the date of Your enquiry or cancellation.

Booking Data retained for the purposes of compliance with tax and regulatory reporting obligations is retained for 10 years from the end of the relevant tax period in accordance with applicable Maltese tax legislation; Marketing Preferences Data is retained until You withdraw Your consent to receive marketing emails from Us. Communications Data submitted via the contact form is retained for no longer than 5 years from the date of submission or, where a booking results from the enquiry, from the date of the stay, after which it is securely deleted.

14. Automated Decision-Making and Profiling

We do not use Your Personal Data in order to carry out any automated decision-making or profiling. In the event that We decide to carry out any such automated decision-making or profiling in the future, You shall be informed prior to Your Personal Data being used in such a manner.

15. Your Legal Rights

Under the Applicable Laws and where applicable, You have the following rights in relation to Your Personal Data for as long as We hold it:

Access Your Personal Data.
Rectify the Personal Data that We hold about You.
Be forgotten (erasure of Your Personal Data).
Restrict the Processing of Your Personal Data.
Request the transfer of Your Personal Data.
Object to the Processing of Your Personal Data.
Withdraw Your Consent at any time.
Object to any decision taken solely on the basis of automated Processing.
Lodge a complaint with the Information and Data Protection Commissioner (IDPC).

16. Change of Purpose

We will only use Your Personal Data for the purposes for which We collected it, unless We reasonably consider that We need to use it for another reason and that reason is compatible with the original purpose. If You wish to receive an explanation as to how the Processing for the new purpose is compatible with the original purpose, please contact Us.

17. Cookies and Analytics

This Website uses cookies and similar tracking technologies to operate effectively, analyse visitor behaviour, and improve the user experience.

We use Google Analytics to collect statistical and behavioural data about how visitors interact with Our Website. We have enabled IP anonymisation within Google Analytics.

18. Governing Law

This Privacy Notice is governed by and construed in accordance with the laws of Malta and relevant EU legislation. In particular, this Privacy Notice is made in compliance with the GDPR and the DP Act (Chapter 586 of the Laws of Malta), as may be amended from time to time.