ENFRNL
Book now

Privacy Policy

We process personal data only to manage your reservation, meet legal obligations and protect the apartment. We never sell your data and never use it for advertising.

Last updated: 9 October 2026
Applies to all stays at Five Star Escape
Five Star Escape, Galaxy Residence / Doret El Menzah 9C, Tunis, Tunisia

1. Who is responsible

Five Star Escape is operated by Adoudi, a sole proprietorship (eenmanszaak) registered with the Netherlands Chamber of Commerce (KvK) under number 75097346 and established in Dordrecht, the Netherlands. Adoudi is the controller for the personal data described in this policy. The apartment we let is at Galaxy Residence / Doret El Menzah 9C, Tunis, Tunisia. You can reach us at info@fivestarescape.org.

This policy covers the personal data we process through fivestarescape.org, through the guest portal you use before your arrival, and in the administration of your stay — including reservations that reach us through Booking.com, Airbnb or another booking platform.

2. Booking data

To create and manage your reservation we process your name, contact details, stay dates, number of guests, chosen extras and payment status. In practice that means:

  • your name and the contact details you give us: your e-mail address and, where you provide one, your phone or WhatsApp number;
  • the language you prefer to be helped in;
  • your arrival and departure dates, the number of nights and the number of guests;
  • the extras and services you choose, and any note you add to your booking;
  • the total amount, the payment status of the reservation and the short booking reference (FSE-YYYY-NNNN) that we use in e-mails and on the payment page;
  • the booking platform your reservation came from, together with its own reservation number where the platform provides one.

We need these details to perform the reservation agreement with you: to confirm your dates, to send you the payment request and the check-in information, and to answer your questions about the stay.

When you use the guest portal, we record when it was first and last opened, how many times it was opened, when the access details for the apartment first came into view and when the Welcome Book was downloaded. We use this only to know whether your arrival information has reached you, so that we can reach you in another way if it has not. We do not record your IP address or details about your device for this purpose. These moments are kept with your reservation and are deleted together with your other personal data.

A reservation that comes to us through a booking platform is sometimes taken over into our own administration from a screenshot of that platform's reservation page. Your host uploads the screenshot and an AI service reads the fields from it: the guest name, the e-mail address and the phone number as the platform shows them, the number of guests, the stay dates, the amount, and any other text that is legible on the image. The screenshot itself is not stored — only the text read from it, so that your host can check the result before it becomes a reservation.

This is a tool your host uses to avoid retyping a booking; you never start it yourself, and it runs only where we have configured it. The other way of reading such a screenshot, plain text recognition, runs entirely inside your host's browser and sends nothing anywhere.

3. Identity documents

Guest registration is a legal requirement for short stays in Tunisia. Identity or passport documents are uploaded through a secured portal and kept in shielded storage that is not publicly reachable; our storage provider encrypts the files at rest. They are automatically deleted 30 days after your stay.

We ask for one passport or identity document per overnight guest and for nothing beyond that. The uploads are visible to your host and to the colleagues we have expressly authorised to review them, and we use them for no purpose other than the registration that the law requires.

4. Payment data

Payments run through Stripe. We never see or store your card number: Stripe handles the payment and returns only a reference to it — a Stripe customer and payment-method reference — together with the card brand and the last four digits, so that you and we can recognise the registered card.

Where a card is registered for the damage policy, that Stripe reference is detached within 30 days after check-out. If a documented damage claim is still running at that moment, the reference is kept until that claim has been settled and is detached afterwards.

Not every payment runs through Stripe. Where you pay us in another way — by bank transfer, for instance — we record with your reservation that the amount was received manually, together with the amount and the date. No card data is involved in that case.

5. Proof of acceptance

When you accept our Terms & Conditions we record which version you accepted, the moment of acceptance, the language shown to you and the page you accepted them on. We do not record your IP address for this purpose.

This record stays with your reservation so that we can show afterwards which version of the Terms applied to your stay. The separate acceptance of the damage policy is recorded in the same way, including where it was given.

6. Damage documentation

If we find damage or exceptional costs after your stay, we document the claim before anything is charged: photographs, the inspection record of the cleaning team, contractor assessments, repair quotations and invoices.

You always receive that documentation by e-mail first and have 48 hours to respond before any documented amount may be charged. The documentation is kept with your reservation as part of the reservation administration.

7. Security camera at the entrance

Five Star Escape may use a disclosed exterior doorbell or security camera (Ring) monitoring the apartment entrance and the access area directly around it, for access verification, safety, incident investigation and property protection. No Five Star Escape camera monitors private interior living or sleeping areas. Footage is only reviewed when there is a concrete safety or incident reason and is not retained longer than necessary.

Article 17 of our Terms & Conditions sets out the same rule; article 9 lists doorbell-camera footage among the evidence that may be used when an incident is investigated.

8. Your requests and messages

Everything you send us yourself is filed with your reservation: a concierge or service request from the guest portal, with the date, time, number of guests and options you choose and the note you add to it, and any extra you order there.

Correspondence about your stay, by e-mail or WhatsApp, is stored with the same reservation so that everyone who helps you sees one history instead of scattered messages. The guest portal does not ask you to upload photographs; the only document you upload there is the identity document described in section 3.

9. Messages through WhatsApp

We contact you through WhatsApp only about your stay, at the WhatsApp number you gave us or that your booking platform passed on to us. Our messages come from our business number +31 6 85237840, which we use in the WhatsApp Business app, and their text is stored with your reservation as described in section 8.

We may also connect that business number to the WhatsApp Business Platform of Meta (WhatsApp Ireland Limited), so that our reservation system can send messages about your stay — such as your check-in information or a payment reminder — from that same number. Messages that our reservation system sends this way go only to guests who have agreed to receive messages from Five Star Escape on WhatsApp, for instance by messaging us there first or by confirming it when they book. While the connection is active, Meta processes on our behalf, for all messages between you and our business number, your WhatsApp number, your WhatsApp profile name, the content of the messages and their delivery status. Your use of WhatsApp itself remains subject to WhatsApp's own terms and privacy policy.

While that connection is active, Meta also sends our website a notification for every event on our business number — for instance that a message was delivered or read, that you sent us a message, or a copy of a message we typed in the WhatsApp Business app — and such a notification contains the message itself and the names and phone numbers concerned. When the number is first connected, Meta sends once the existing chats and contacts of the WhatsApp Business app, because Meta requires this to connect the number, and after that any change to those contacts. Our website checks that every notification really comes from Meta and keeps, in its logs and audit trail, only a short summary — the kind of notification, counts, delivery statuses, error codes and the identifiers of our own business account; it does not store the content of messages, names or phone numbers from these notifications.

To connect a business number, our app "FSE Property Tool" uses Meta's signup window. During that step it receives from Meta a temporary access token, which is used only during the connection and is never stored, together with the identifiers of the WhatsApp business account and of the phone number, the displayed number, the verified business name and whether the number is used in the WhatsApp Business app. In our audit trail we keep only the account and number identifiers, the kind of number and the outcome of the connection, to record that and when the number was connected, and we use this data for nothing else.

We send you messages about your stay because they are needed to carry out your reservation (Article 6(1)(b) GDPR). Using WhatsApp as the channel for those messages, connecting our number to the WhatsApp Business Platform and the one-time transfer of existing chats and contacts when the number is connected rest on our legitimate interest in handling guest communication from a single business number (Article 6(1)(f) GDPR); you can object to this at any time in the way described below.

If you would rather not receive messages through WhatsApp, tell us — by replying in WhatsApp or by writing to info@fivestarescape.org — and we will contact you by e-mail instead.

10. Service requests without a reservation

You can ask us for a concierge service without having booked with us — for instance when you are staying at the apartment through Booking.com or Airbnb. For such a request we process your name, your e-mail address and, where you give one, your phone number, together with the booking reference and the stay dates you enter, the service and the options you select, and the free text you add to it.

We use those details to answer the request and, where you want the service, to arrange and deliver it. The form carries a separate box, never ticked in advance, for news and offers; whether you tick it changes nothing about the request itself, and you can withdraw that permission at any time. Requests that stay unconnected to a reservation are deleted on the schedule set out below.

11. Guest reviews

After your stay we may invite you to write a review. The form asks for your country, a title and the text of your review, an overall score and separate scores for cleanliness, comfort, location, communication and value. It does not ask for your name; reviews that we take over from a booking platform carry the name that platform displays.

A review is published only where you tick the box that permits it, and it does not appear straight away: every review first comes to us for approval. Publication is public in the full sense — the country you entered and the text you wrote become visible to every visitor of the website, so write them with that in mind. The link between a review and your reservation stays internal and is never shown. Tell us and we take a published review offline again.

12. Newsletter

If you sign up for our newsletter we store your e-mail address, the language you signed up in, the page the sign-up came from, the version of the consent text you agreed to and the moment you agreed to it, and afterwards the moment you confirmed and the moment you unsubscribed. Once you confirm, a personal discount code is created and kept with your subscription.

Signing up is double opt-in: the form sends you an e-mail with a confirmation link, and you receive nothing else from us until you have clicked it. A sign-up that is never confirmed expires by itself. Every newsletter carries an unsubscribe link and you can unsubscribe at any moment; we keep the record that you unsubscribed so that you are not mailed again.

13. Visitor statistics

For visitor statistics on the public website we use Vercel Web Analytics, from Vercel, the company that hosts the website. It counts page views — the page, the site you came from, your approximate location (country, region and city), the type of device, and the browser and the operating system with their versions — without placing cookies and without recording data that identifies you. A visitor is recognised only by a short-lived value derived from the request itself, which is discarded after 24 hours, and we see aggregated figures only. Because of that it does not ask for your consent, and there is nothing about it to switch off in the cookie banner. It is not used in the guest portal.

Microsoft Clarity shows us how visitors use the public website, through heatmaps and session recordings. It runs only after you have explicitly accepted it in the cookie banner, and only then are cookies placed. Declining places no cookies and changes nothing about your booking.

You can change your choice at any time through the cookie preferences link in the footer. Withdrawing your consent stops that measurement and removes our own Clarity cookies; Microsoft's own cookies (clarity.ms) can be removed through your browser settings.

14. How long we keep your data

We do not keep personal data longer than we need it for the purpose it was collected for.

  • the reservation administration — your booking details, the payments and the proof of acceptance — for as long as we are legally required to keep it;
  • identity and passport documents: automatically deleted 30 days after your stay;
  • the moments at which you opened the guest portal, saw the access details and downloaded the Welcome Book (section 2): kept with your reservation and deleted together with the other personal data in it, at any time on request;
  • WhatsApp messages (section 9): kept with your reservation and deleted together with the other personal data in it; the chat and your contact in our WhatsApp Business app for as long as we need them for questions about your stay, and deleted on request; messages that pass through the WhatsApp Business Platform are kept by Meta only to deliver them, for no more than 30 days;
  • the Stripe reference to a registered card: detached within 30 days after check-out, unless a documented damage claim is still running;
  • service requests made from the website without a reservation: deleted after 90 days, and after 30 days once they have been matched to a reservation, declined or marked as spam;
  • a newsletter subscription: for as long as it lasts; after you unsubscribe we keep your address together with the record of that unsubscribe, so that you are not mailed again;
  • a review: for as long as it is shown on the website, and we take it offline as soon as you ask us to.

15. Who receives your data

We never sell your personal data and we never share it for advertising. We share only what is necessary, with:

  • Stripe, which processes the payments and holds the card data itself;
  • Vercel, our hosting provider, which runs the website and the guest portal and, through Vercel Web Analytics, counts visits to the public website without cookies;
  • our e-mail provider, which delivers the confirmations, payment requests, newsletter messages and service messages;
  • Meta (WhatsApp Ireland Limited), while our business number is connected to the WhatsApp Business Platform, which processes your WhatsApp number and the messages exchanged with that number — including the messages we send from the WhatsApp Business app — for us;
  • the AI service that reads a booking screenshot for us where your host uses that tool (Anthropic), and which therefore receives the data visible on that image;
  • the supplier of the doorbell camera, where such a camera is in use, which stores the footage from the entrance and makes it available to us;
  • the booking platform your reservation came from, where the reservation has to be handled through that platform;
  • where it is genuinely necessary: our insurer, the management of Galaxy Residence, or a competent authority — for example for the guest registration required by Tunisian law.

Some of these recipients process data outside the European Economic Area: Meta (for WhatsApp), Stripe, Vercel, Anthropic and Microsoft may process data in the United States, under the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses in their data processing terms. Because the apartment is in Tunisia, the data needed for your stay — including the guest registration required by Tunisian law — also goes to the residence management and the competent authorities in Tunisia, as far as this is necessary to carry out your reservation (Article 49(1)(b) GDPR).

16. Your rights

You can ask us at any time for access to the data we hold about you, for a correction, or for its deletion. Write to info@fivestarescape.org and we will handle your request personally. Where a legal obligation requires us to keep something — the reservation administration, for instance — we will tell you which data that concerns and why. Section 17 explains step by step how to have your data deleted.

You can also ask us to restrict the processing of your data or to give you your data in a commonly used format. You can object at any time to processing based on our legitimate interest, such as the use of WhatsApp described in section 9. Where we process data on the basis of your consent — the newsletter or Microsoft Clarity — you can withdraw that consent at any time. If you believe we handle your data incorrectly, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or with the supervisory authority in the EU country where you live.

We do not sell your data, we do not use it for advertising and we do not build profiles of you. The only measurement that places cookies is Microsoft Clarity, and it runs only after you have accepted it.

17. Having your data deleted

You can ask us at any time to delete the personal data we hold about you; you do not need an account for this and it costs nothing. This is how it works:

  • write to info@fivestarescape.org with the subject "Delete my data" and give your name and, if you have it, your booking reference (FSE-YYYY-NNNN) or the booking platform and the dates of your stay, so that we can find your data;
  • we confirm that we have received your request and, where needed, ask one question to make sure the request comes from you;
  • within 30 days we delete your personal data from our reservation system — your contact details, your messages, the record of your portal visits and, where they are still present, your identity documents — together with our chat with you and your contact in our WhatsApp Business app, and let you know once that is done;
  • where the law requires us to keep part of the reservation administration, for instance for our accounts, we keep only that part, for no longer than the law requires, and tell you which data it concerns; if you subscribed to our newsletter, we unsubscribe you and keep only your e-mail address with the record of that unsubscribe, so that you are not mailed again (section 12);
  • we also delete your customer record and any saved card at Stripe, and the copies our service providers hold for us — such as Meta for messages that passed through the WhatsApp Business Platform, or our e-mail provider — are deleted as well or expire under their retention periods; data that others keep under their own responsibility — your booking platform, the payment records Stripe has to keep, or your own WhatsApp account — is deleted through them, and we tell you where to ask.

If you are a business that connected a WhatsApp number through our app "FSE Property Tool", you can remove that link yourself in your Facebook settings under Business integrations. To have the data our app received through that link deleted, write to info@fivestarescape.org with the subject "Delete my data" and give the name of your business and the WhatsApp number you connected; within 30 days we delete those identifiers and let you know once that is done.

18. Contact

Questions about this policy, or about the data we hold about you? Write to us — we answer in English, French and Dutch.

Five Star Escape, operated by Adoudi Chamber of Commerce (KvK) 75097346, Dordrecht, the Netherlands Apartment: Galaxy Residence / Doret El Menzah 9C, Tunis, Tunisia

Email: info@fivestarescape.org Website: fivestarescape.org