Privacy Policy
Stand: 01. September 2026
1. Data controller
The person responsible for processing personal data on this website and in connection with rental enquiries is:
Marie-Luise Salaorni
Augartenstrasse 27
9402 Mörschwil
Switzerland
E-Mail: ml@salaorni.ch
Holiday accommodation:
Casa Vista al Mar
Camino de Carraspite 10
29752 Sayalonga (Málaga)
Spain
2. Scope of this Privacy Policy
This Privacy Policy applies when you visit this website, submit an availability or contact enquiry, or communicate with us afterwards. It explains which personal data we process, why we use it, and what rights you have.
We process personal data in accordance with the Swiss Federal Act on Data Protection and, where applicable, the European Union’s General Data Protection Regulation.
3. Hosting by Squarespace
This website is hosted on Squarespace. The service is provided by Squarespace, Inc. and its affiliated companies.
When you access the website, Squarespace processes technical data. This may include:
IP-Adresse
Date and time of access
Pages and files accessed
Previously visited page
Browser, operating system, and device type
Language and approximate location
Error, security, and diagnostic data
Squarespace processes this data to deliver the website, detect attacks and misuse, and maintain the stability and security of the service. The legal basis is our legitimate interest in operating a secure and functional website pursuant to Article 6(1)(f) GDPR.
Squarespace may process data in the United States and other countries. Further information is available in the Squarespace Privacy Policy and Squarespace Data Processing Addendum.
4. Cookies and similar technologies
Squarespace uses strictly necessary cookies and similar storage technologies to keep the website secure and functional. These technologies may store language preferences, security settings, and cookie choices.
We do not use our own advertising, remarketing, or profiling cookies. Non-essential analytics and performance cookies are only set after a visitor has given consent through the cookie banner.
The cookie banner provides the options “Accept all”, “Reject all”, and “Manage preferences”. You can change or withdraw your consent at any time through the “Cookie settings” link in the footer. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
The legal basis for strictly necessary technologies is our legitimate interest in operating a secure and functional website. The legal basis for optional technologies is consent pursuant to Article 6(1)(a) GDPR. Information about the Squarespace cookies in use, their purposes, and their storage periods is available in the Squarespace cookie overview.
5. Contact and availability enquiries
The enquiry form may collect the following data:
Name
Email address
Requested arrival and departure dates
Number of guests
Telephone number, if provided voluntarily
Message and other information provided voluntarily
We use this data to check availability, respond to your enquiry, and, where applicable, prepare a rental agreement. The legal basis is Article 6(1)(b) GDPR. For general enquiries, the legal basis is our legitimate interest in responding to your request pursuant to Article 6(1)(f) GDPR.
Your name, email address, travel dates, and number of guests are required to process an availability enquiry. We cannot check your enquiry without this information. Providing a telephone number and free-text message is optional.
Please do not include identification numbers, health information, or other confidential information in the free-text field. We do not require the names or dates of birth of accompanying children for an initial availability enquiry.
Squarespace processes and transmits the form data on a technical level. The enquiry is then sent to our email inbox at ml@salaorni.ch. The inbox is provided by Hostpoint AG, Neue Jonastrasse 60, 8640 Rapperswil-Jona, Switzerland. We use Microsoft Outlook to retrieve and process emails.
If no rental agreement is concluded, we delete the enquiry no later than twelve months after the last communication. We retain it for longer if necessary to establish, exercise, or defend specific legal claims.
7. Email communication and rental relationship
If you contact us by email, we process the sender and recipient details, time, subject, content, and technical metadata of the message. We use this data to communicate with you and handle your enquiry.
If a rental agreement is concluded, we process the contact, booking, stay, and payment details required for the agreement. We use this data to perform the rental agreement and comply with legal obligations. The legal bases are Article 6(1)(b) and (c) GDPR.
We retain documents relating to contracts and billing for the applicable statutory retention and limitation periods. We then delete or anonymise the data. We only retain it for longer if required due to legal proceedings or an order from a public authority.
8. Availability calendar
The public calendar only shows whether a period is available or booked. It does not display names, contact details, booking numbers, or booking platforms.
The calendar is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Its parent company is Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA. When the calendar loads, your browser connects to Google’s servers. Data sent to Google may include your IP address, browser and device data, the time of access, the previously visited page, and cookie data. Further information is available in the Google Privacy Policy.
The calendar only loads after you have given consent through the cookie banner or placeholder. The legal basis is Article 6(1)(a) GDPR. You can withdraw your consent at any time through “Cookie settings”.
9. Protection of the enquiry form
Squarespace may use Google reCAPTCHA to detect automated and abusive form submissions. The service is provided by Google Ireland Limited and Google LLC.
The data processed may include your IP address, browser and device data, mouse and keyboard activity, referring page, time of access, and existing Google cookies. Google may process data in the United States and other countries.
We use reCAPTCHA to protect the form and the website. The legal basis is our legitimate interest in preventing spam and misuse pursuant to Article 6(1)(f) GDPR. Where consent is required for cookies or similar access, the website only loads reCAPTCHA after consent has been given.
Further information is available in the Google Privacy Policy.
10. Google Maps and external links
This website does not embed Google Maps directly. It only contains a link to Google Maps. Your browser connects to Google only after you open the link. Google is responsible for any subsequent data processing under its own privacy terms.
The same applies to links to Airbnb, Booking.com, FeWo-direkt, and other external websites. Simply visiting our website does not transmit data to the linked websites through these links.
11. Recipients
We may share personal data with the following recipients where necessary for the purposes described above:
Squarespace as our hosting, website, and form service provider
Our email provider
The provider of the availability calendar
People responsible for the technical administration of this website
Tax advisers, legal advisers, and other professional advisers where necessary
Public authorities and courts where required by law or a binding order
Airbnb, Booking.com, or FeWo-direkt, but only where necessary for a specific enquiry or booking and where this is apparent to the person concerned
We do not sell personal data.
12. Processing outside Switzerland and the European Union
We mainly process data in Switzerland and the European Union. Squarespace, Google, and some subprocessors may also process data in the United States or other countries.
When transferring data to a country that is not recognised as providing an adequate level of data protection, we use a permitted transfer mechanism. These mechanisms include recognised standard contractual clauses and, for appropriately certified US companies, the Swiss-U.S. or EU-U.S. Data Privacy Framework. We assess the mechanism used by each service provider.
You may request a copy of the applicable safeguards by emailing ml@salaorni.ch. Statutory restrictions and the protection of trade secrets remain reserved.
13. Retention and deletion
We retain personal data only for as long as required for its intended purpose, compliance with a legal obligation, or the establishment, exercise, or defence of legal claims.
The following criteria apply to the main categories of data:
Unsuccessful contact and availability enquiries are deleted no later than twelve months after the last communication.
Contract and billing documents are retained until the applicable statutory periods expire.
Records of consent are retained while the consent remains valid and afterwards only for as long as proof of consent is required.
Security data is retained only for as long as necessary to investigate and respond to an incident.
Backups are overwritten according to the applicable backup and rotation schedule.
14. Your rights
Subject to applicable law, you have the following rights:
Access to the personal data being processed
Correction of inaccurate data
Deletion or destruction of data
Restriction or cessation of processing
Objection to processing based on legitimate interests
Provision or transfer of certain data
Withdrawal of consent with effect for the future
Submission of a complaint to a competent data protection authority
To exercise your rights, email ml@salaorni.ch. We may ask for reasonable proof of your identity to prevent personal data from being disclosed to unauthorised persons.
In Switzerland, you may contact the Federal Data Protection and Information Commissioner. In Spain, you may contact the Agencia Española de Protección de Datos. People in the European Union may also contact the data protection authority in the place where they live or work.
15. No automated decision-making
We do not use automated individual decision-making or create personality or usage profiles.
16. Children’s data
This website is not intended for children. Availability enquiries should be submitted by adults. Please do not send us unnecessary personal data about children.
17. Data security
We take appropriate technical and organisational measures to protect personal data. These measures include encrypted data transmission, restricted access rights, individual user accounts, and multi-factor authentication for administrative access.
Despite these measures, transmitting data over the internet may involve security risks. Please do not send particularly sensitive information through the general enquiry form.
18. Changes to this Privacy Policy
We update this Privacy Policy when the website, the services we use, or the applicable law changes. The version published on this website applies.