Villario  ·  a trading name of Cyridium Ltd  ·  Last updated: 25 July 2026  ·  ICO registration: ZC135949

This Privacy Policy explains how Villario, operated by Cyridium Ltd (registered in England and Wales; registered office 19 Brambles Crescent, Blythe Valley, Solihull, B90 8DJ), collects, uses, and protects personal data when you use Villario to search, book, list, or manage accommodation. We process data in accordance with UK GDPR and the Data Protection Act 2018.

Two roles, in one document. For most of the data described below — your account, bookings, payments, messages, and reviews — Villario is the Data Controller: we decide why and how that data is processed, because Villario itself operates the marketplace you're transacting on. For one specific category — guest identity documents collected because a Host's jurisdiction requires it — Villario acts as Data Processor on behalf of the Host, who is the Controller for that data. Section 6 explains this distinction and what it means for you in practice.

1. Who we are

Cyridium Ltd, trading as Villario
Registered office: 19 Brambles Crescent, Blythe Valley, Solihull, B90 8DJ
Email: legal@villario.co.uk
ICO registration: ZC135949

2. Data we collect and why

3. Who we share data with

We do not sell personal data. We share it only as needed to run the Service:

We may also disclose data where required by law, to a relevant regulator or law-enforcement authority, or to protect the rights, safety, or property of Villario, our users, or others.

Guest violation records. Where a dispute you were party to as a Guest results in a formal violation record (see our Acceptable Use Policy, Section 6), a Host reviewing your future Booking requests can see that a violation exists and the reason recorded for it — not the underlying dispute messages or evidence. This is disclosed so a Host can make an informed decision about accepting your Booking; it is never used to automatically block a Booking (see Section 9 for how to appeal a record).

4. International transfers

Where personal data is transferred outside the UK to a Sub-Processor in a third country (for example, the United States), we rely on an appropriate safeguard — typically the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

5. How long we keep data

6. Guest identity verification — how it works, and why Villario is a Processor here

Some countries legally require accommodation providers to collect and retain identification details from every guest. Where this applies to a Property you've booked, we email you a secure, one-time link — valid for 30 days — where you submit the required fields and, if needed, a scan of your document directly to Villario. We never ask you to send this information by ordinary message or email, and the link cannot be reused once you've submitted your details.

• Encryption: Submitted data is encrypted at rest (AES-256-GCM); document scans are stored in access-controlled storage and are never returned to the Host.

• What the Host can see: Only your first name, last name, date of birth, and nationality are ever made visible to the Host — and only for a limited operational window after your checkout date (typically 14 days), after which the Host's view is withdrawn entirely. Your document number, expiry date, issuing country, address, place of birth, and the document scan itself are never shown to the Host under any circumstances; they are accessible only to Villario platform administrators, and only for the purpose of responding to a lawful authority request.

• Audit trail: Every access to your stored identity data — whether granted or denied — is logged, including denials caused by an expired host-access window or a record that has already been purged.

• Retention and deletion: Your data is automatically and permanently purged once the statutory retention period for the Property's jurisdiction has passed, independently of (and regardless of) the earlier host-access window described above.

• Why Villario is the Processor, not the Controller, for this data: the legal duty to collect and retain this information belongs to the Host (as the accommodation provider registered in that jurisdiction), not to Villario. We process it strictly on the Host's documented instructions, under a Data Processing Agreement the Host must accept before collection can be enabled — see our Guest ID Data Processing Agreement. If you have a query about how your identity data specifically will be used by a Host, the Host is the correct point of contact as Controller; Villario remains available to assist as set out in that Agreement.

7. Host/trader verification data — the Digital Services Act

This section is a draft pending legal review and may change before the marketplace features it describes are enabled. We will update the date at the top of this page and notify Hosts of any material change.

The EU Digital Services Act (Article 30) requires online marketplaces like Villario to collect and, where our own reasonable efforts indicate it's accurate, verify certain identifying information about Hosts who are "traders" (broadly, Hosts operating as a business rather than a private individual) — and, for some of that information, to make it visible on the Host's public profile. This obligation exists independently of, and in addition to, the payment-processing relationship Stripe already has with a Host.

• What we collect it from: Stripe's account-onboarding process ("Connect") already asks Hosts for identity and, for business Hosts, company information as part of setting up payouts. Rather than asking Hosts to submit this a second time, we read a narrow subset of it back from Stripe — name/business name, address, phone, email, and trade-register details where applicable. We do not obtain card or bank account numbers, or copies of identity documents, from Stripe for this purpose.

• Reusing Stripe's data for this purpose requires your consent. Stripe's own terms treat using this onboarding data for anything beyond payment processing as a separate purpose requiring your notice and agreement. Hosts are asked to explicitly agree to this additional use during Stripe Connect setup, separately from agreeing to Stripe's own terms; we do not reuse this data for this purpose without that agreement on file.

• Verification and correction. We make reasonable efforts to check the plausibility of the information described above (for example, cross-checking a stated trade-register number). If we identify data that appears missing, inaccurate, or outdated, we will ask the Host to correct it, and may restrict certain Host functionality until they do.

• Public disclosure. For Hosts we've classified as traders, a subset of this information (name/business name, trade-register number where applicable, and confirmation the Host has certified compliance with applicable product/service-safety law) is intended to be shown publicly on that Host's profile, as Article 30 requires. Address, phone, and email are not made public.

• Retention. Where required by Article 30, we retain this data for up to 6 months after a Host's relationship with the platform ends, even if the Host's Stripe account is separately closed or disconnected in that time.

8. Cookies

Villario uses cookies for authentication, security, and (where you consent) analytics. See our Cookie Policy for full details and how to manage your preferences.

9. Your rights

Under UK GDPR, you have the right to:

• Access a copy of the personal data we hold about you;

• Rectification of inaccurate data;

• Erasure of your data in certain circumstances (note: identity documents subject to a statutory retention period cannot be erased early, and completed Booking/payment records may be retained to meet accounting obligations);

• Restriction of how we use your data;

• Portability of data you provided under a contract or consent, in a machine-readable format;

• Object to processing based on legitimate interests;

• Withdraw consent at any time where we rely on it, without affecting processing already carried out.

To exercise these rights, email legal@villario.co.uk. We aim to respond within one month and may need to verify your identity first. Where a request relates to guest identity data for which a Host is the Controller (Section 6), we will forward it to the relevant Host without undue delay.

Guest violation records. A violation record (Section 3) is always a decision made by a human reviewer — we do not use automated decision-making or profiling to create one, and Article 22 UK GDPR's protections against solely-automated decisions with legal or similarly significant effects are not engaged by this process for that reason. You may appeal a violation record at any time by emailing legal@villario.co.uk; an upheld appeal clears the record.

10. Children

Villario accounts are for people aged 18 and over. We do not knowingly collect personal data from children. Children may of course appear as guests on a Booking (e.g. as part of the guest count) — that limited data (age category, not identity) is handled as part of the Booking record described in Section 2.

11. Complaints

If you're unhappy with how we've handled your personal data, contact us first at legal@villario.co.uk. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk

• Helpline: 0303 123 1113

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified by email or an in-product notice. The date at the top of this page reflects the last revision.

13. Contact

Cyridium Ltd, trading as Villario
19 Brambles Crescent, Blythe Valley, Solihull, B90 8DJ
Email: legal@villario.co,uk
ICO registration: ZC135949