Privacy Policy

Last Updated: July 10, 2025

This Privacy Policy describes how Pueblo Andaluz 83, Nerja collects, uses, and shares personal information when you use our vacation rental services at Pueblo Andaluz 83 located in Nerja, Málaga, Andalucía, Spain.

We are committed to protecting your privacy and handling your personal information in a transparent and responsible manner, in compliance with the General Data Protection Regulation (GDPR) (EU) 2016/679, the Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), Royal Decree 933/2021, and other applicable Spanish and regional data protection laws.

1. What Information We Collect

We may collect and process the following types of personal information about you:

• Contact Information: Name, email address, postal address, phone number.
• Booking Details: Arrival and departure dates, number of guests, special requests, purpose of stay.
• Mandatory Guest Registration Data (for all guests aged 14 and over):
  • Full name (first and second surname, first name)
  • Type of identity document (e.g., Passport, DNI, NIE)
  • Identity document number
  • Nationality
  • Date of birth
  • Gender
  • Date and time of check-in
  • Date and time of check-out
  • Signature (often digital)
  • Note: Other details like place of residence, contact numbers, and email for the main booker may also be collected as per booking platform requirements.
• Payment Information: While we do not directly store your full payment card details (these are typically processed by secure third-party payment processors), we may receive confirmation of payment, transaction IDs, and limited billing information. Some regulations may require recording the means of payment for transaction traceability.
• Communication Records: Copies of correspondence between you and us (e.g., emails, messages through booking platforms).
• Usage Data: Information about how you interact with our website or booking platforms, if applicable (e.g., IP address, browser type, pages visited).
• CCTV Footage (if applicable): If we have CCTV cameras on the exterior of the property for security purposes, footage may be collected. 

2. How We Collect Your Information

We collect information from you in the following ways:

• Directly from you: When you make a booking inquiry, complete a booking form, communicate with us via email, phone, or messaging. Crucially, we will request the mandatory guest registration data directly from you upon or prior to your arrival.
• From Booking Platforms: When you book through third-party platforms (e.g., Airbnb, Booking.com, VRBO), they may share necessary booking and contact details with us. Please refer to their respective privacy policies for details on their data practices.
• Automatically: Through cookies and similar technologies on our website.

3. How We Use Your Information (Legal Basis for Processing)

We use your personal information for the following purposes, based on the specified legal bases under GDPR:

• To Comply with Legal Obligations (Article 6(1)(c) GDPR):
  • To fulfil mandatory guest registration requirements in Spain: We are legally obliged to collect and transmit specific identification data for all guests (over 14 years old) to the State Security Forces and Agencies (e.g., Guardia Civil, Policía Nacional) via designated platforms (e.g., SES.HOSPEDAJE or similar regional systems) upon or shortly after your arrival. This is a non-negotiable legal requirement for operating a tourist accommodation in Spain.
  • To maintain records required by tax authorities (e.g., income records).
  • To comply with other applicable Spanish laws or regional regulations for tourist accommodation (e.g., local tourism registration, if any).
  • To respond to lawful requests from public authorities (e.g., police, courts).

• To Fulfil Our Contract with You (Article 6(1)(b) GDPR):
  • To process and confirm your booking.
  • To manage your stay at the property.
  • To provide you with access to the property and its amenities.
  • To communicate with you regarding your booking, arrival, stay, and departure.
  • To process payments for your booking.

• For Our Legitimate Interests (Article 6(1)(f) GDPR):
  • To improve our services and your guest experience.
  • To respond to your inquiries and provide customer support.
  • To prevent fraud and ensure the security of our property and guests.
  • To manage and resolve any disputes or issues related to your stay.
  • To comply with internal record-keeping and administrative requirements.

• With Your Consent (Article 6(1)(a) GDPR):
  • We will obtain your explicit consent for any specific purposes not covered by the above, such as sending marketing communications (if we choose to do so in the future). You have the right to withdraw your consent at any time.

4. Sharing Your Information

We may share your personal information with the following categories of recipients, only when necessary and for the purposes outlined in this policy:

• Spanish State Security Forces and Agencies: As legally required by Royal Decree 933/2021 and relevant regional laws, we submit mandatory guest registration data for all guests to the authorities (e.g., via SES.HOSPEDAJE / Hospedajes online).
• Booking Platforms: To facilitate and manage your booking made through their services (e.g., Airbnb, Booking.com).
• Payment Processors: Secure third-party payment gateways (e.g., Stripe, PayPal) to process your payments. We do not store your full payment card details.
• Service Providers: Third-party service providers who assist us with property management, cleaning, maintenance, or IT support (e.g., a cleaner, handyman, software provider for booking management). These providers are contractually obliged to protect your data.
• Legal & Regulatory Authorities: If required by law, court order, or to protect our legal rights, we may disclose your information to law enforcement, regulators, or other government bodies.
• In Case of Business Transfer: In the event of a sale, merger, or transfer of all or a portion of our business, your personal information may be transferred to the acquiring entity.

We will never sell your personal information to third parties.

5. International Data Transfers

As we operate in Spain, your personal information will primarily be processed within the European Economic Area (EEA). If we ever need to transfer your data outside the EEA (e.g., if a service provider is based outside the EEA), we will ensure that appropriate safeguards are in place (such as standard contractual clauses approved by the European Commission or ensuring the recipient country has been deemed adequate by the European Commission) to protect your privacy rights.

6. Data Retention

We will retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements.

• Mandatory Guest Registration Data: We are legally required to retain this data for three (3) years from the end of the contracted service, as stipulated by Spanish law.
• Booking Records (excluding guest registration data): Generally retained for a minimum of 4-6 years to comply with Spanish tax laws.
• CCTV Footage: Typically retained for a maximum of 30 days, unless required for an ongoing investigation by authorities.
• Communication Records: Retained as long as necessary to address ongoing inquiries or disputes.

Once the retention period expires, your personal information will be securely deleted or anonymised.

7. Your Data Protection Rights (under GDPR)

As a data subject, you have the following rights regarding your personal information:

• Right to Access (Article 15): You have the right to request a copy of the personal information we hold about you.
• Right to Rectification (Article 16): You have the right to request that we correct any inaccurate or incomplete personal information we hold about you.
• Right to Erasure ("Right to be Forgotten") (Article 17): You have the right to request the deletion of your personal information in certain circumstances (e.g., if the data is no longer necessary for the purposes for which it was collected), except where we have a legal obligation to retain it (e.g., mandatory guest registration data).
• Right to Restriction of Processing (Article 18): You have the right to request that we restrict the processing of your personal information in certain situations (e.g., if you contest the accuracy of the data).
• Right to Data Portability (Article 20): You have the right to receive your personal information in a structured, commonly used, and machine-readable format and to transmit it to another data controller, where technically feasible.
• Right to Object (Article 21): You have the right to object to the processing of your personal information where we are relying on legitimate interests as the legal basis for processing.
• Right to Withdraw Consent (Article 7(3)): If we are processing your personal information based on your consent, you have the right to withdraw that consent at any time.

To exercise any of these rights, please contact us using the contact details provided below. We will respond to your request within one month, as required by GDPR.

8. Security

We implement appropriate technical and organisational measures to protect your personal information from unauthorised access, alteration, disclosure, or destruction. These measures include:

• Using secure booking platforms and official government platforms (e.g., SES.HOSPEDAJE) for mandatory guest registration.
• Restricting access to your personal data to authorised personnel only.
• Implementing data minimisation principles.
• Regularly reviewing our security practices.
• Securely storing any physical guest registration forms in compliance with AEPD guidelines.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The "Last Updated" date at the top of this policy will indicate when it was last revised. We encourage you to review this policy periodically.

10. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, or if you wish to exercise your data protection rights, please contact us through the contact us form on this website. Please address to Caragh Curran Ref: Pueblo Andaluz 83 Nerja.

Tourist License Number: VUT/MA/90172