Privacy policy

Data controller

• [name or company name — to be completed], [tax ID — to be completed]
• [address — to be completed]
• Email for data protection requests: [email — to be completed]

What data we process

• Booking request: name, email address, phone number (optional), number of guests, dates, your message and the language of the website.
• Booking contract: the data above plus booking status, price and payment information.
• Guest registration: before arrival, the identity data that Spanish law requires us to record for every guest (Royal Decree 933/2021). We collect it separately, not through the booking form.
• Technical data: our server may log IP addresses and the pages requested, for security, for a short period.

Why we process it and on what legal basis

• To handle your booking request, confirm your email address and perform the rental contract: Article 6(1)(b) GDPR (contract and pre-contractual steps).
• To register guests with the Ministry of the Interior (SES.HOSPEDAJES) and to meet tax and accounting obligations: Article 6(1)(c) GDPR (legal obligation).
• To protect the website against abuse: Article 6(1)(f) GDPR (legitimate interest).
• We do not use your data for advertising or profiling, and we do not send newsletters.

Who receives your data

• Our hosting and email providers, which process data on our behalf under a data processing agreement: [hosting and email providers — to be completed].
• Spanish authorities where the law requires it (police guest registration, tax authority).
• We do not share personal data with booking portals. The calendar we share with them only shows which dates are taken.
• We do not transfer personal data outside the European Economic Area.

How long we keep it

• Booking requests that are not confirmed by email are deleted automatically after 60 minutes.
• Rejected or cancelled requests: 12 months.
• Confirmed bookings: for the duration of the contract and then for as long as tax and civil law require (5 years).
• Guest registration data: 3 years, as required by Royal Decree 933/2021.

Your rights

You can request access to your data, rectification, erasure, restriction of processing, data portability, or object to processing by writing to [email — to be completed]. We reply within one month.

You can also lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or the authority in your country of residence.

Cookies

We only use cookies that are necessary for the website to work, so we do not ask for consent:

• locale: remembers the language you chose (12 months). Set only when you change the language.
• admin_session: keeps the owner logged in to the administration panel (7 days). Not used for guests.
• We do not use analytics, advertising or social media cookies. Fonts and photos are served from our own server.

Security

The website uses an encrypted connection (HTTPS). Access to booking data is limited to the owner and protected with a password.