Privacy policy

This website (netanyastay.com, presented as “Netanya Apartments”) is run by NetanyaStay, a business operated by Liad Ohayon in Netanya, Israel. We collect only what we need to answer your request and host your stay, and we do not sell or trade personal data. This page says what we hold, why, who touches it, how long we keep it and how to exercise your rights. It is written to meet the Israeli Protection of Privacy Law, 5741-1981 (including the notice duties of section 11), and — for visitors from the European Economic Area, the United Kingdom and Switzerland — the GDPR and its UK and Swiss equivalents.

Who is responsible

The data controller (in Israeli terms, the owner of the database) is:

Operated by

NetanyaStay · Liad Ohayon

Business registration no.

311311120

Address

Netanya, Israel

Email

liad142@gmail.com

Phone

+972 52 660 2644

Website

netanyastay.com

What we collect, and why

• Booking request: your name, phone number, email address (optional), the apartment, check-in and check-out dates, number of guests, the language you were using, anything you wrote in the notes field, the price calculated for the dates, and the time you accepted our terms. Purpose: to answer you, confirm availability and price, and prepare the stay. Legal basis (GDPR): steps before entering a contract with you.
• “Leave your details” form: your name, a phone number or an email address, your message, the page you sent it from and the time you accepted the privacy policy. Purpose: to reply to you. Legal basis: steps before a contract, at your request.
• Correspondence on WhatsApp, by phone or by email: the content of the conversation and your contact details, as with any correspondence.
• Confirmed booking: the details needed for payment, your arrival time and, where required, an identity document of the lead guest. Card details are entered on the payment provider’s page and are never seen or stored by us. Legal basis: performing the contract, and legal obligations (bookkeeping, tax, guest registration where it applies).
• Browsing the site: anonymous, cookieless usage statistics — page views, country, device type, and events such as “booking request sent” without any personal details — via Vercel Web Analytics. In the European Economic Area, the United Kingdom and Switzerland these run only after you accept them in the cookie banner (legal basis: consent); elsewhere they run on the basis of our legitimate interest in knowing how the site is used, and you can switch them off on the cookie page.
• Technical data: your IP address and browser details are processed for a short time to deliver the site, to keep it secure and to stop the forms being abused (rate limiting). They are not saved alongside your request; a blocked or suspicious attempt may be noted in server logs for a limited time. Legal basis: legitimate interest in security.

You are not legally obliged to give us any of this information, and giving it is up to you. Without a name and one way to reach you, though, we cannot answer a request; without the details a confirmed booking needs, we cannot host you. We do not make automated decisions about you and we do not build profiles.

What we do not do

• We do not send marketing newsletters. If that ever changes we will ask for your consent first, and every email will carry an unsubscribe link.
• We do not sell, rent or trade personal data, and we do not share it with advertisers.
• We do not run advertising or cross-site tracking on this site.

Who receives the data

A few service providers keep the site running. Each processes data on our behalf, under its own contractual data-protection commitments, and only for the purpose named here:

• Supabase (database and photo storage; servers hosted on Amazon Web Services in the United States) — stores booking requests, leads and the apartment photos, over encrypted connections. Reachable only from the owner’s password-protected admin area.
• Vercel (hosting and analytics; United States and global edge network) — serves the website and provides the cookieless statistics described above.
• Web3Forms (form-to-email relay) — when you send a form, your browser also sends the same details to Web3Forms, which delivers them to our inbox as an email alert. Web3Forms sees the name, contact details and message you typed.
• Resend (email delivery) — sends our emails to you, for example a confirmation of your request, when you have given an email address.
• WhatsApp (Meta) — if you choose to carry on in WhatsApp, that conversation happens there under WhatsApp’s own privacy policy. The site only opens a pre-filled message; it sends nothing to WhatsApp by itself.
• OpenStreetMap (map of the neighbourhood on each apartment page) — when the map is shown, your browser fetches it from openstreetmap.org, which receives your IP address and the map area requested. In Europe the map is shown only after you accept it.
• Airbnb and Booking.com calendars — we synchronise availability, dates only, so the calendar here is accurate. No guest details are exchanged.
• The owner of the apartment you booked, where the apartment belongs to a private owner — the dates, the number of guests and the lead guest’s name, and a phone number if a repair or an emergency makes it necessary. Cleaning and maintenance staff receive the dates only.
• Our accountant, and authorities where the law requires it — for bookkeeping, tax and legal obligations.

Where the data is stored

Our records are kept in Israel (our devices and correspondence) and with providers in the United States: the database (Supabase, on Amazon Web Services), the hosting and analytics (Vercel) and the form relay (Web3Forms). Transfers from the EEA to Israel are covered by the European Commission’s adequacy decision for Israel; transfers to the United States rely on the providers’ data processing agreements with the EU standard contractual clauses or their certification under the EU-US Data Privacy Framework. You can ask us for details of the safeguards used.

Cookies and similar storage

This site uses no advertising and no tracking cookies. The only things it stores in your browser are your cookie choice itself and, for the site owner only, the session cookie of the admin area. The full list, and the way to change your choice, is on the cookie page.

How long we keep it

• Booking requests and leads that never became a booking: 12 months from the request, so we can pick up a follow-up question, then deleted automatically.
• Confirmed bookings: as long as bookkeeping and tax obligations in Israel require, generally up to seven years from the stay, then deleted.
• Copies of identity documents, where we took one: deleted within 30 days after check-out, unless a specific legal obligation requires longer.
• WhatsApp and email correspondence: as long as the conversation is useful for hosting you. You can ask us to delete it at any time.
• Records of your consent (which version of the terms you accepted, and when): for as long as the related request or booking is kept.

Your rights

Under Israeli law you may ask to see the personal data we hold about you (section 13 of the Protection of Privacy Law), to correct it or delete it if it is inaccurate, incomplete or out of date (section 14), and to object to its use for direct marketing. Under the GDPR you may in addition ask for erasure, restriction, portability, and object to processing based on legitimate interest; where processing relies on your consent, you may withdraw it at any time without affecting what was done before. To use any of these rights, email liad142@gmail.com from the address you used with us, or write on WhatsApp. We answer within 30 days and usually far sooner, and may ask you to confirm your identity first. You can also complain to the Israeli Privacy Protection Authority (gov.il/en/departments/the_privacy_protection_authority) or, in the EEA, the United Kingdom or Switzerland, to your local data protection authority.

Security

Connections to the site are encrypted (HTTPS). The database accepts no direct public access, the forms are protected against automated abuse, and stored requests can be read only by the owner, behind a password-protected admin area. Our devices are locked and updated. No system is perfectly secure, so we keep what we store to a minimum, and we would tell you and the authority without undue delay if a breach affected your data.

Children

The site is for adults making a booking. We process details about a child — an age for a cot, say — only when a parent or guardian gives them to us as part of a booking.

Contact and changes

Questions about this policy or your data: liad142@gmail.com · +972 52 660 2644 · NetanyaStay, Netanya, Israel. We may update this policy; the date at the top of the page tells you when it last changed, and a material change is announced on the site before it takes effect.