Skip to content

Privacy Policy

As of: October 2026

We are pleased that you are visiting sonmanera.com and are interested in our retreats. Protecting your personal data is important to us. Below, we inform you about which data we process when you visit this website and when you make an inquiry or booking, for what purpose, and on what legal basis.

1. Controller

The controller within the meaning of Art. 4 No. 7 GDPR for data processing on this website is:

Indigourlaub GmbH Ecklweg 4, A-4040 Linz, Austria Commercial register number: FN 412554 y · Commercial register court: Landesgericht Linz Email: office@indigourlaub.com Website: www.indigourlaub.com

Indigourlaub GmbH acts as the tour operator and handles inquiries and bookings for the Son Manera Retreat Finca. The operator of the location “Son Manera Retreat Finca” is Retreat Finca Son Manera SLU (Carretera Montuiri-Lloret 0.3km, 07230 Montuiri, Spain), which is named as the media owner in the legal notice of this website. However, the responsibility under data protection law for processing your data lies with Indigourlaub GmbH, as it decides on the purposes and means of processing. The website and the processing of data triggered by this website are carried out exclusively by employees of Indigourlaub GmbH.

If you have any questions about data protection or wish to exercise your rights, you can reach us at office@indigourlaub.com.

Data Protection Officer

We have appointed a data protection officer for our company. You can reach him at:

Mr. Samuel Miko, Indigourlaub GmbH, Ecklweg 4, A-4040 Linz Email: samuel.miko@indigourlaub.com

2. Website Access and Hosting

When you simply visit this website, only the data that is technically necessary to display the website to you and to ensure its stability and security is initially processed. Our web hosting service provider processes, on our behalf, in particular the IP address, date and time of access, page accessed, amount of data transferred, and browser and operating system information (server log files).

The legal basis is our legitimate interest in a secure and functional web presence (Art. 6 para. 1 lit. f GDPR). The website was created with WordPress and is hosted and technically supported by LEMONTEC GmbH (Weingartenstraße 14a, 4100 Ottensheim, Austria). The servers are located in a data center of Hetzner Online GmbH in Germany, i.e., within the European Union.

3. Cookies and Consent Management

Cookies are small text files that are stored on your device when you visit a website. In addition to cookies, individual services use similar technologies: entries in your browser’s memory (Local Storage, Session Storage, IndexedDB) as well as so-called pixels, which are small image requests used to transmit information to a server. The following rules apply equally to these technologies. We distinguish between technically necessary cookies and non-necessary cookies (statistics and marketing).

Before you give your consent, we only set technically necessary cookies and the cookie for our consent tool. All non-necessary cookies and the associated services (see sections 7 to 11) are only activated once you have actively given your consent in the cookie banner. The legal basis for non-necessary cookies is your consent according to Art. 6 para. 1 lit. a GDPR in conjunction with § 165 para. 3 TKG 2021; for technically necessary cookies, it is our legitimate interest in a functional offering (Art. 6 para. 1 lit. f GDPR).

To manage your consents, we use the consent management tool Cookiebot (Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark). A technically necessary cookie (“CookieConsent”) is set, which stores your consent status (storage period up to 1 year). The associated data is processed within the EU (Ireland).

A complete, constantly updated list of all cookies used, including provider, purpose, and storage period, can be found in the cookie declaration at the end of this page.

You can withdraw or adjust your consent at any time with effect for the future. A small, circular symbol is available at the bottom of the screen for this purpose, through which you can call up the cookie banner again.

Regardless of this, you can also manage or delete cookies via your browser settings. If you deactivate non-necessary cookies, individual functions of the website may be restricted, such as the display of videos or the 360° tour.

4. Language Settings (WPML)

We use the WordPress plugin WPML to manage the language versions. It stores the language you use in the “wp-wpml_current_language” cookie so that the pages are displayed to you in that language. The cookie is deleted when the browser is closed (session cookie). The data remains on our server in the EU; it is not transmitted to third parties.

The cookie is technically necessary to display the website to you in the selected language. The legal basis is our legitimate interest in a functional website (Art. 6 para. 1 lit. f GDPR in conjunction with § 165 para. 3 TKG 2021).

5. Inquiry and Booking Form

On this website, you can make a non-binding inquiry via an inquiry form or book a stay via a booking form. To implement the forms, we use the WordPress plugin Gravity Forms. The data you enter (e.g., name, email address, phone number, requested period, your message) is transmitted exclusively to Indigourlaub GmbH and forwarded there to the address office@indigourlaub.com. A copy of the form entries is also stored in the WordPress database on our server (EU).

Purpose and legal basis:

  • In the case of an inquiry, we process your data to answer your inquiry and provide you with a suitable offer. The legal basis is the performance of pre-contractual measures at your request (Art. 6 para. 1 lit. b GDPR).
  • In the case of a booking, we process your data to prepare and handle your stay. The legal basis is the fulfillment of the contract or the performance of pre-contractual measures (Art. 6 para. 1 lit. b GDPR).

Storage period: We automatically anonymize the copy of your form entries stored in the WordPress database 60 days after receipt; in particular, your name, your email address, and your free text are removed so that there is no longer any personal reference.

The data transmitted to Indigourlaub GmbH for processing will be stored there as long as necessary to process your inquiry or concern. Data from a booking, in particular invoices and payment receipts, are also subject to statutory retention obligations (generally seven years according to § 132 BAO) and will be deleted after they expire.

No payments are processed via this form; an online payment option is not integrated into this website.

To protect against automated spam entries, we use the “Gravity Forms Zero Spam” extension. It works exclusively on our server, does not set any cookies, and does not transmit any data to third parties (Art. 6 para. 1 lit. f GDPR).

6. Free Text Field and Special Categories of Personal Data

Our forms do not request health data, religious beliefs, or other special categories of personal data within the meaning of Art. 9 GDPR. However, the inquiry/booking form contains a free text field for your message.

We ask you not to provide any special categories of personal data (such as information on health, diet for religious reasons, or philosophical beliefs) in this text field. Health-related information required for your stay or individual treatments will be clarified with you separately before your arrival if necessary.

Should you nevertheless voluntarily enter such data in the text field, we will process it exclusively to handle your inquiry or booking. In this case, the legal basis is your explicit consent, which you provide with the voluntary disclosure (Art. 9 para. 2 lit. a GDPR). You can withdraw this consent at any time with effect for the future.

7. Google Analytics 4

If you have given your consent, this website uses Google Analytics 4, a web analysis service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google Analytics uses cookies (including _ga, _ga_#, storage period up to 2 years) that enable an analysis of your use of the website. We use Google Analytics to statistically evaluate the use of our website and to improve our offering.

The legal basis is your consent (Art. 6 para. 1 lit. a GDPR), which you provide via the cookie banner. For data transfers to the USA, see section 13.

8. Google Ads – Conversion Tracking and Remarketing

If you have given your consent, we use Google Ads services (Google Ireland Limited) to measure the success of our advertising (conversion tracking) and for remarketing. This allows us to track whether users take certain actions after clicking on an ad and to show you interest-based advertising on other websites. The following cookies and similar technologies are used:

  • “_gcl_au” (cookie, 3 months) and “_gcl_ls” (local storage, permanent until deleted): store information about ad clicks to attribute conversions;
  • “IDE” (cookie from doubleclick.net, up to 13 months): re-associates your browser for remarketing and ad measurement;
  • “test_cookie” (cookie from doubleclick.net, 1 day): checks whether your browser allows cookies;
  • Pixel requests to googleadservices.com (“ccm/conversion”) and google.com (“pagead/1p-user-list”): report a conversion or membership in a remarketing list to Google.

The legal basis is your consent (Art. 6 para. 1 lit. a GDPR). For data transfers to the USA, see section 13.

9. Google Tag Manager

We use the Google Tag Manager (Google Ireland Limited) to manage the tags and services used on this website. The Tag Manager itself does not set any cookies. It is only loaded once you have consented to the “Statistics” or “Marketing” category; no data is transmitted to Google before then.

We also use Google’s consent mode. Cookiebot informs the Google services which categories you have agreed to. Google Analytics and Google Ads only set their cookies if you have agreed to the respective category.

10. YouTube Videos

We embed videos from the YouTube platform (Google Ireland Limited) on several subpages. We use the enhanced data protection mode (embedding via youtube-nocookie.com). The videos are only loaded once you have consented to the “Marketing” category. From then on, YouTube processes information about your interaction with the video and stores the following entries on your device:

  • “LAST_RESULT_ENTRY_KEY” (cookie, session) and “TESTCOOKIESENABLED” (cookie, 1 day);
  • “ytidb::LAST_RESULT_ENTRY_KEY” and “yt-icons-last-purged” (local storage, permanent until deleted);
  • “YtIdbMeta#databases” (IndexedDB, permanent until deleted).

The legal basis is your consent (Art. 6 para. 1 lit. a GDPR). For data transfers to the USA, see section 13.

11. 360° Tour (Kuula)

On the “Finca” and “Gallery” pages, we show a virtual 360° tour of the finca. For this, we use the service of Kuula Inc. (USA, contact@kuula.co). The tour is only loaded once you have consented to the “Marketing” category. Your IP address and technical information about your browser and device are transmitted to Kuula; Kuula stores this data in server logs for a maximum of 30 days. According to its own information, Kuula does not use cookies for advertising or analysis purposes.

The following entries are set:

  • “AWSALB” and “AWSALBCORS” (cookies, 7 days): distribute requests across the provider’s servers (load balancing);
  • “kuulaembed” (session storage, deleted at the end of the browser session): required for the display of the embedded tour.

The legal basis is your consent (Art. 6 para. 1 lit. a GDPR). For data transfers to the USA, see section 13.

12. Google Reviews (Trustindex)

On our website, we display reviews from our guests from our Google Business Profile. For this, we use the WordPress plugin from Trustindex Ltd. (Hungary). The review texts are stored on our server. However, your browser loads graphics (stars, logos) from the Trustindex server (cdn.trustindex.io) and the profile pictures of the reviewers directly from Google (googleusercontent.com). Your IP address and technical browser data are transmitted to Trustindex or Google. No cookies are set in the process.

The legal basis is our legitimate interest in showing prospective customers genuine guest reviews (Art. 6 para. 1 lit. f GDPR). For data transfers to the USA, see section 13.

13. Data Transfer to the USA

The Google services mentioned in sections 7 to 10 and 12 may lead to data being transmitted to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework (DPF). For transfers to US companies certified under the DPF, there is an adequacy decision by the European Commission (Art. 45 GDPR); in addition, Google bases these transfers on standard contractual clauses (Art. 46 GDPR).

Data is also transmitted to Kuula Inc. in the USA during the 360° tour (section 11). Kuula is not certified under the EU-US Data Privacy Framework; the transfer takes place on the basis of the standard contractual clauses of the European Commission (Art. 46 para. 2 lit. c GDPR).

We point out that the EU-US Data Privacy Framework is currently subject to legal review and the legal situation may change in the future. In the event of a data transfer to the USA, there is a residual risk that US authorities may access the data despite these guarantees. You can completely avoid consent-based transfers by not consenting to the corresponding cookies or by withdrawing your consent.

14. Recipients of Your Data

Your data will be treated confidentially. Recipients are:

  • Employees of Indigourlaub GmbH, insofar as they are involved in processing your inquiry or booking;
  • our IT service providers (in particular the web hosting provider and the tool providers mentioned in this declaration) who act as processors for us;
  • authorities and courts, insofar as we are legally obliged to pass on the information.

No further disclosure of your data to third parties takes place.

15. Your Rights

Under the GDPR, you have the following rights:

  • Access (Art. 15 GDPR) to the data stored about you;
  • Rectification of incorrect data (Art. 16 GDPR);
  • Erasure of your data (Art. 17 GDPR), provided that no statutory retention obligation or other legal reason stands in the way;
  • Restriction of processing (Art. 18 GDPR);
  • Data portability (Art. 20 GDPR);
  • Objection to processing based on a legitimate interest, as well as at any time against processing for the purpose of direct marketing (Art. 21 GDPR);
  • Withdrawal of consent with effect for the future (Art. 7 para. 3 GDPR); the lawfulness of the processing carried out until the withdrawal remains unaffected.

To exercise your rights, an informal notification to office@indigourlaub.com is sufficient. If there are justified doubts about your identity in individual cases, we may request additional information to confirm your identity (Art. 12 para. 6 GDPR).

16. Right to Lodge a Complaint

If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority. The supervisory authority responsible for us is:

Austrian Data Protection Authority Barichgasse 40–42, 1030 Vienna Email: dsb@dsb.gv.at · Web: www.dsb.gv.at

17. Data Security

For security reasons, this website uses SSL/TLS encryption. You can recognize an encrypted connection by the fact that “https://” is displayed in the address line of your browser and a lock symbol appears. This means that the data you transmit to us cannot be easily read by third parties.

18. Validity and Changes to This Privacy Policy

This privacy policy is currently valid (see status above). Due to the further development of our website or due to changed legal requirements, it may become necessary to adjust this declaration. You can always find the current version on this page.

Overview of all cookies