Privacy policy
Who is responsible
The controller for the personal data processed on this website is [not yet available], [not yet available], [not yet available].
What we process and why
Booking requests: when you send a request we receive your first and last name, email address, your dates, the number of guests, your language and, if you add them, your phone number and message. We use them only to answer your request and, if you book, to prepare your stay. Legal basis: steps taken at your request before a contract (Art. 6(1)(b) GDPR). Without an email address we cannot answer you.
Emails: we send you a short confirmation that your request arrived and then our reply by email.
Technical data: when you visit the website, our servers process your IP address and technical details of the request (such as browser type and time) to deliver the pages and to protect the site against misuse, for example by limiting the number of requests. Legal basis: our legitimate interest in a secure website (Art. 6(1)(f) GDPR). Server logs are kept on the server for 14 days and in our monitoring service for 90 days.
We do not sell your data, use it for advertising or build profiles.
Who receives your data
We use the following service providers, who process data only on our instructions under a data processing agreement:
Hetzner Online GmbH, Germany: hosting of the website, the database and the backups, in data centres in the EU.
Postmark (ActiveCampaign, LLC, USA): sending our emails. Data is transferred to the USA under the EU–US Data Privacy Framework.
Splunk Observability Cloud (Splunk Inc., a Cisco company), EU data region: technical monitoring of errors and performance, including the server logs (with IP addresses). The contents of your request are not sent there.
Apple Distribution International Ltd., Ireland (iCloud+ Mail): our mailbox, where booking notifications and your emails to us arrive.
How long we keep it
Requests that are declined or withdrawn are deleted 6 months after they were closed.
Data of confirmed bookings is kept for 5 years, as Spanish tax and accounting rules require.
Backups: deleted data disappears from our backups after at most 30 days.
Your rights
You can ask for access to your data, correction, deletion, restriction of processing and a copy of your data (portability), and you can object to processing based on our legitimate interest. Write to [not yet available].
You can also complain to a data protection authority, for example the Spanish Agencia Española de Protección de Datos (www.aepd.es) or the authority in the country where you live.
Cookies
Which cookies this website uses is explained in the cookie policy.