Privacy Policy
Updated: 2026-10-08
1. Data controller
The data controller is Rančo Gobas SIA, reg. no. 40203253729, Gobas, Ģibuļu pagasts, Talsu novads, LV-3297, Latvija. Data contact: Kirill.luks@yahoo.com.
2. What data we collect
When booking: name, e-mail, phone, dates, number of guests and pets, selected services. Messaging: messages and phone number when you write to us or we send arrival instructions via WhatsApp. When paying, card data is handled by the payment provider — we do NOT receive or store the card number, CVV or PIN. Server logs: IP address, user agent, request times. With your consent — site-visit data from analytics and advertising cookies (see section 7).
3. Purposes and legal bases
Concluding and performing the contract, including contacting the guest by e-mail and WhatsApp (GDPR Art. 6(1)(b)); accounting and tax reporting (6(1)(c)); service security and fraud prevention (6(1)(f)); visit analytics and advertising measurement — only with your consent (6(1)(a)); marketing messages — only with explicit consent (6(1)(a)).
4. Recipients
Payment providers: Stripe Payments Europe Ltd. (Ireland), AS Swedbank (Latvia) and EveryPay AS (Estonia). Database and file storage: Supabase Inc. (EU region). Website server: VPS hosting. E-mail notifications: Resend Inc. Booking calendar sync with channels (Booking.com etc.): Lodgify. Messaging: WhatsApp (Meta Platforms Ireland Ltd.). Only with your consent: Google Analytics / Google Ads (Google Ireland Ltd.) and Meta Pixel (Meta Platforms Ireland Ltd.). Some of these companies may transfer data to the USA under the EU–US Data Privacy Framework or the EU standard contractual clauses.
5. Retention period
Booking and payment data are kept for 5 years after the service (Accounting Act). Consents — until withdrawn. Server logs — up to 90 days.
6. Your rights
You have the right to: get a copy of your data, correct it, delete it (where no other legal basis applies), restrict processing, port your data, withdraw consent at any time, and lodge a complaint with the Latvian State Data Inspectorate (Datu valsts inspekcija). Requests — to Kirill.luks@yahoo.com, reply within 30 days.
7. Cookies
Necessary: login session, language and your choice in the cookie banner — always on. Analytics and advertising: Google Analytics / Google Ads and Meta Pixel. Until you click "Accept", Google tags run in consent mode without setting analytics or advertising cookies, and Meta Pixel is not loaded at all. You can change your choice at any time via the "Cookie settings" link at the bottom of the page.
8. Security
Connections are encrypted with TLS, passwords are stored as hashes, access follows least privilege, audit logs are kept.