We do not share customers' personal data. All information will be processed in accordance with legal terms and in compliance with the personal data protection law. The SerenaVillage.NET site does not sell or transfer customers' personal data to third parties. When making a reservation, the customer only needs to provide 5 essential details: 1 - Check-in Date (Check-in Date). 2 - Number of Guests (Number of people). 3 - Full Name (Name and Surname of the reservation holder). 4 - E-Mail (Email address where the server automatically sends your reservation confirmation). 5 - Phone (Phone Number where our staff can contact to communicate with the reservation holder). The SerenaVillage.NET site server only collects these 5 essential details to process reservations, and does not collect any more customer data. In accordance with applicable laws regarding the processing of personal data privacy, personal data will be managed exclusively by the SerenaVillage.NET site with the exception of payments and Third-Party Cookies (Read Third-Party Cookie Policy). All payments will be made through PayPal. Only PayPal knows the customers' card details. The SerenaVillage.NET Site does not know the customers' Credit and Debit Card details. Our secure online reservation system sends all reservations to the PayPal site for validation. All payments will be processed by PayPal, a global leader in secure Credit and Debit Card payments.
Website's Own Cookie Policy:
The SerenaVillage.NET Site does not collect personal cookies, only 1 cookie is used that allows the server's reservation system to add your service, so you can book the same service you have selected. When submitting a reservation, the system automatically cancels the reservation cookie and guarantees maximum privacy to all customers. Please note that it is mandatory to read the Reservation Terms carefully before booking. By accessing, browsing, using the site, and making a reservation, all customers accept that they have read, understood, and agreed to the Reservation Terms.
Key Aspects of the Cookie Policy:
Limiting the duration of cookies and only using first-party cookies that are deleted after the reservation is a highly recommended practice to reinforce user privacy and security by using path=/;max-age=1440;SameSite=Strict;Secure.
path=/: This ensures that the cookie is valid for all paths within the SerenaVillage.NET domain. SameSite=Strict: This attribute is the MAXIMUM SECURITY OPTION available and guarantees the best protection against Cross-Site Request Forgery (CSRF) attacks. A cookie with Strict NEVER is sent if the user accesses our site from a link or request originated from an external site. It is only sent in requests that originate from the same website.
Secure: The Secure attribute is a critical security measure. When present, it instructs the browser that the cookie should only be sent over secure connections encrypted with (HTTPS). What does it do?: It prevents the cookie from being accidentally sent over an unencrypted HTTP connection (in plain text). Why is it important?: If an attacker is intercepting traffic on a public Wi-Fi network, for example, and the site attempts to load a resource via HTTP, with Secure the browser will not deliver the cookie, protecting it from being stolen through a "Man-in-the-Middle" attack.
🛡️ UNBREAKABLE SECURITY 🛡️: By implementing Strict, we eliminate any window of opportunity for a session to be potentially hijacked or used by a third party, even if the attacker tricks the user into clicking a malicious link. max-age=1440: Setting the maximum cookie lifespan to 1440 seconds (24 minutes) is an excellent security and privacy practice. This limits the time a cookie can be used, reducing the window of opportunity for its exploitation in case of a security breach or unauthorized access. Exclusive use of first-party cookies: By using only cookies generated and managed directly by the SerenaVillage.NET domain, the risk associated with third-party cookies, which are often used for cross-site tracking and can raise privacy concerns, is significantly reduced. Cookie cancellation after reservation: This is a proactive privacy measure. Once the reservation is complete and the information is no longer needed in a cookie, deleting it minimizes unnecessary retention of personal data, which is fundamental for user privacy.
In summary, the cookie policy implemented by SerenaVillage.NETdemonstrates a strong commitment to user privacy and security through the following recommended practices: - Appropriate cookie scope (path=/). - Protection against CSRF (SameSite=Strict). - Protection against "Man-in-the-Middle" attack (Cookie Secure). - Limited cookie lifespan of 24 minutes (max-age=1440). - Minimization of third-party cookie usage. - Proactive deletion of cookies after reservation and their necessary use.
These measures complement HTTP header security policies and contribute to creating a safer and more privacy-respecting online environment for users of SerenaVillage.NET. It is an excellent strategy for building trust among website visitors.
Third-Party Cookie Policy:
Service providers, such as Google, Bing, Facebook, Instagram, Yahoo, and others, use cookies to display relevant ads based on a user's previous visits to their website or other websites. The use of advertising cookies allows Bing, Facebook, Instagram, Yahoo, Google and their partners to display ads based on the visits made by users to their websites or other Internet websites. Users can disable personalized advertising. To do this, they must access Ad Preferences in their browser.
Modify personal data:
The customer will have the possibility to modify their personal data at any time, only after accessing their personal area, and only for customers with a confirmed reservation. If the customer does not have a confirmed reservation number, they will not be able to access their personal area, as the server will not create an account for unvalidated reservations, since the access data to the customer's personal area will be automatically created on our server when making the reservation, through the Payment Validation system. In this way, only the Reservation Holder can access their confidential data.
SerenaVillage.NET is a Secure website and has been online since 2017. You can verify the reliability of SerenaVillage.NET through the Google Safe Browsing system. Google is a World Leader company on the Internet. Click to verify security on Google. SerenaVillage.NET is committed to observing the necessary precautions to ensure the safety of all customers. Maximum level of security for all SerenaVillage.NET customers Book in complete security on the SerenaVillage.NET website.
SerenaVillage.NET adopts a high-tech system and secure connections with the new system TLS 1.3, HSTS, DNSSEC, HTTP 3.0 and SSL Full (Strict). For issues related to the security of the SerenaVillage.NET site, you can read our Privacy Policy page. We also adopt all the latest extreme security techniques to protect customer data in forms, using the latest and most secure CSP nonce system, applying the following extreme security CSP in all server security headers: default-src 'none'; style-src 'self' 'nonce-'; style-src-attr 'none'; script-src 'self' 'nonce-'; and also require-trusted-types-for 'script'. As shown in the image below, you can see the Security Certification Grade A+ for our SerenaVillage.NET server headers.
Absolute Block by Default:
This is the fundamental directive of extreme security through CSP default-src 'none'. It establishes that no resource (images, scripts, styles, fonts, etc.) can be loaded unless explicitly allowed by another more specific directive. Security Purpose: It forces the developer to strictly whitelist absolutely everything. If an attacker manages to inject a tag like img src= or script src=, these requests will automatically fail because they are not allowed.
Secure Loading of Styles and Scripts:
These directives allow the loading of: Resources that come from the same origin as the page ('self'). Inline styles and scripts (within the style or script tags) or files that contain a nonce attribute that matches a randomly generated and single-use value that the server includes in the HTTP header and in the HTML tags.
Extreme Security Purpose (Noncing): The use of the latest and most secure CSP nonce system prevents almost all XSS. An attacker who injects malicious code does not know the secret nonce value for the current request, so their injected script will simply be blocked by the browser. This is much safer than using hashes or simply allowing inline scripts ('unsafe-inline').
Block of Styles in Attributes:
Description (style-src-attr 'none'): This directive prohibits the use of CSS in HTML attributes, such as style="...CSS styles. Security Purpose: Avoids a common and subtle form of XSS code injection or CSP bypass where an attacker could manipulate the appearance of the page or attempt to execute code through vulnerable CSS properties.
Required Trusted Types:
Description (require-trusted-types-for 'script'): This is a cutting-edge security feature (Trusted Types). It demands that DOM functions that handle text strings as code (for example, innerHTML, document.write) only accept a special object called "Trusted Type" and not a simple text string. Extreme Security Purpose: Completely blocks the last line of defense against XSS attacks. Even if the attacker manages to inject a text string into one of these DOM functions, the browser will reject it because it is not a Trusted Type object. It is the highest security standard for preventing client-side code injection.
🔑 What It Serves - Final CSP Objective:
The main objective of this extreme security CSP is to protect customer data in forms by: - Preventing malicious code execution (XSS): An attacker cannot inject scripts into the page to steal session cookies, authentication tokens, or form credentials. - Guaranteeing content integrity: Ensures that only resources (scripts, styles) authorized and verified by the server are executed, preventing the page from loading code from external or untrusted sources. - Reinforcing XSS mitigation (Defense in Depth): By using nonce and require-trusted-types-for 'script', multiple layers of protection are created, ensuring that even minor input validation failures do not result in a critical vulnerability. In summary, this CSP configuration is an advanced shield that ensures the web application only loads the resources the developer intended, neutralizing code injection attempts and elevating security to a level far superior to the average. These measures complement HTTP header security policies and contribute to creating a safer and more privacy-respecting online environment for users of SerenaVillage.NET. It is an excellent strategy for building trust among website visitors.
The SerenaVillage.NET Site does not know the customers' Credit and Debit Card details. Our secure online reservation system sends all reservations to the PayPal site for validation. All payments will be processed by PayPal, a global leader in secure Credit and Debit Card payments. Only PayPal knows the customers' card details. Through PayPal, you can pay with all Visa, MasterCard, American Express, Diners Credit and Debit Cards, without needing to have a PayPal account. The SerenaVillage.NET Site does Not require customers' card details. If you wish to pay with your card, you can only pay through PayPal, where you can pay with all Visa, MasterCard, American Express, Diners Credit and Debit Cards, only through PayPal without needing to have a PayPal account, thanks to our Express payment agreements with PayPal. You can pay with your card through PayPal from Anywhere in the World. SerenaVillage.NET does not know the customers' card details.
Customer Data:
The SerenaVillage.NET site is the owner of the personal data communicated by the customer at the time of booking and therefore undertakes to treat said data with maximum confidentiality and not to disclose, copy or transfer said documentation to third parties. The SerenaVillage.NET Site only sends communications related to the current reservation to the email address provided by the customer. If the customer wishes to receive promotional material via email, they need to check the corresponding box on the reservation submission form or our Live Chat, in order to give their consent to receive the SerenaVillage.NET site's offers Newsletter. In the absence of consent, SerenaVillage.NET undertakes not to send advertising by email to customers. The customer will have the possibility to access and modify their personal data at any time through our Telephone Exchange. To always stay updated on the processing of personal data by the SerenaVillage.NET website, we invite you to periodically visit this Privacy Policy page.
Privacy Policy Objective:
This Policy sets out the essential information regarding personal data and the relationship with the SerenaVillage.NET site. This Policy applies to all services on the SerenaVillage.NET site and any associated services (hereinafter, the Service). The conditions governing your use of the Service offered on the SerenaVillage.NET website are contained in our Reservation Terms (hereinafter, the Terms). We may periodically develop new or supplementary services. If the launch of these new or supplementary services were to cause significant changes in the way we collect or process your personal data, we will provide you with more information or additional policies or conditions. These new or supplementary services will be subject to this Policy, unless we indicate otherwise upon their launch.
The objective of this Policy is:
To ensure you understand what personal data we collect about you, the reasons why we collect and use it, and with whom we share that data. To explain how we use the personal data you provide us so that you can enjoy an excellent experience when using the SerenaVillage.NET site Service, and to explain your rights and options regarding the personal data we collect and process about you, as well as how we will protect your privacy. In this way, we trust in helping you understand the privacy commitments we assume towards you. For information on how to contact us with questions or concerns, please consult the Customer Service Contacts page. Conversely, if you do not agree with the content of this Policy, remember that it is you who decides whether you wish to use the Services of the SerenaVillage.NET site and you can choose not to book and not to continue browsing the website. By accessing, browsing, using the SerenaVillage.NET website and making a reservation, you agree to have read, understood and agreed to the site's Reservation Terms, and the Privacy Policy, and you cannot plead ignorance in case of not reading or not respecting the Reservation Terms.
Your rights and preferences:
We offer you choices and control. The General Data Protection Regulation (GDPR) grants certain rights to natural persons regarding their personal data. Consequently, we are pleased to offer access and transparency controls to help users benefit from these rights. The rights conferred on natural persons, without prejudice to the limitations provided for in the applicable legislation, are the following: Right of access: the right to be informed and request access to the personal data we process about you. Right to rectification: the right to request the correction or updating of your personal data when it is inaccurate or incomplete. Right to erasure: the right to request the deletion of your personal data. Right to restriction of processing: the right to request the temporary or definitive suspension of the processing of all or part of your personal data. Right to object: the right to object, at any time, to our processing of your personal data for reasons related to your particular situation and the right to object to the processing of your personal data for direct marketing purposes. Right to data portability: the right to request a copy of your personal data in electronic format and the right to transfer said personal data for use in another third-party service. Right not to be subject to decisions based on automated processing: the right not to be subject to decisions based solely on automated processing, including profiling, when such decisions produce legal effects concerning you or significantly affect you in a similar way.
In order for you to obtain more information about these rights, exercise them easily and register your preferences about how SerenaVillage.NET uses your personal data, we offer you the following Privacy Policy resources: this information section where you can find more information regarding how SerenaVillage.NET uses your personal data, your rights over personal data and how to exercise such rights. Please note that SerenaVillage.NET marketing email messages include an opt-out system in the message itself (for example, a link so you can cancel the sending of emails). If you click on the link in the email, you will cancel the sending of future messages of that same category (e.g., Offer Updates).
Customer support resources:
On our website, several pages offer more information on data protection issues. A fundamental source of information is the FAQ page, which contains answers to the Frequently Asked Questions about the SerenaVillage.NET website Service. If you are a customer with a confirmed reservation, and you have any questions about privacy, about your rights or about how to exercise them, you can contact our Data Protection Officer using Our Telephone Exchange +1 829-341-4713. If you have doubts about how we process your personal data, we trust in continuing to work together to resolve them. If you do not have a Confirmed Reservation, the customer can only receive assistance through the Live Chat Support and WhatsApp or alternatively by visiting the Serena Village Frequently Asked Questions page and the SerenaVillage.NET Assistance page.
It is mandatory to read the Reservation Terms carefully before booking. By accessing, browsing, using the site and making a reservation, all customers accept having read, understood and agreed to the Terms.
