Data controller
Visitar Ltd
Legal name: Visitar Ltd
Company number: 17392313
Trading name: Visitar.com
Country of establishment: England
Registered office: Lensbury Avenue, London, SW6, England
Email: info@visitar.com
Visitar.com decides how and why personal data is used to run the directory, the enquiry and booking system, and customer support.
What we process
The information needed to provide the service.
- Stay details: property, dates, rooms, adults, children and children’s ages.
- Contact details: name, email address and optional telephone number. For an enquiry we relay replies without revealing these details; after the deposit is paid and a booking confirmed, we share what the property needs to manage the stay.
- Request details: reference, status, times, optional preference for similar properties and action history.
- Conversation data: messages, dates, times and protected private-access identifiers.
- Limited payment data: Stripe identifiers and authorisation status. Visitar.com does not receive or store the full card number or security code.
- Technical and security data: shortened or pseudonymised IP address, browser type and version, technical references and logs needed to prevent abuse and diagnose errors.
- New-destination notices: email address, requested destination and browser language.
- Destination searches: the search, result, date, source page, browser type and language. These logs do not include your email address and are deleted after 180 days.
When an adult gives a child’s age, we use it only to check suitability and transmit the request. We do not ask for a child’s name.
Purposes and legal bases
Every use has a specific reason.
- Pre-contract steps and contract: check availability, hold a room briefly, create and track a booking or request, process payment or authorisation, report status and provide support.
- Legitimate interests: protect the service from fraud and abuse, retain audit records, resolve incidents and defend claims.
- Consent: use Google Analytics, ask similar properties when you expressly choose that option, and send a destination notice you requested. You can withdraw consent at any time.
- Legal obligation: retain or disclose information where required by law, a competent authority or accounting duties.
We do not use request data for automated decisions with legal or similarly significant effects. Automated security checks may block a submission; you can ask us to review that decision.
Recipients
We share only what is needed.
- The selected property. For an enquiry or unconfirmed request it receives the content and first name only, replying through Visitar.com. After deposit payment and confirmation it receives the stay details, name, email address and optional telephone number needed to manage the stay.
- Similar participating properties, only when you choose that option and the alternative search is available.
- Stripe, to process the authorisation and deposit without exposing complete card details to Visitar.com.
- Technical suppliers for hosting, databases, email and messaging, subject to their roles and data-protection duties.
- Google Analytics, only after analytics consent, to create usage statistics.
- Your chosen digital assistant or reply channel, when you start the request there and authorise that channel.
- Competent authorities, where a valid legal duty applies.
Visitar.com is established in the United Kingdom and serves guests and properties in the European Economic Area. Applicable adequacy decisions cover transfers between the EEA and the UK. We use the safeguards required by law for other destinations.
Retention and security
We do not retain data without a purpose.
We retain data while it is needed to complete and support a request, meet accounting or legal duties, prevent fraud and answer claims. When the purpose ends and no retention duty remains, we delete or anonymise it. The exact period depends on the request status, whether a transaction occurred and the applicable legal limits.
Destination-search logs are deleted after 180 days. We retain an email address supplied for an alert until we send it, you withdraw consent, or it is no longer needed for that purpose.
Our safeguards include encrypted connections, access controls, protected sessions, data minimisation and audit logs. No system can remove every risk.
Cookies
The choice is yours.
We use “visitar_consent” for 180 days to remember your choice and “visitar_request” for the session to protect forms against fraudulent submissions. These cookies are strictly necessary and are not used for advertising.
Google Analytics stays blocked until you consent to analytics. If accepted, it may create “_ga” and “_ga_<identifier>” cookies, with a default lifetime of up to two years. You can withdraw consent through “Cookie preferences” in the footer; Visitar.com will stop future measurement and delete accessible analytics cookies.
We do not use advertising cookies. Read how Google uses data from sites that use its services.
Choices and complaints
You can ask to access, correct, restrict or erase data.
Depending on the context and legal basis, you may request access, rectification, erasure, restriction or portability, or object to processing. Where processing relies on consent, you may withdraw it without affecting earlier processing.
Send a request or data-protection complaint to info@visitar.com. We will acknowledge a complaint within 30 days and tell you the result of our review.
You can also complain to the Information Commissioner’s Office (ICO) or, where EU GDPR applies, the Comissão Nacional de Proteção de Dados (CNPD).
We update this page when our practices or applicable duties change. The date at the top identifies the current version.