Privacy policy

1. Data controller

Controller: José Parreño Gago, owner of Apartamento El Rompido (VUT/HU/005589), Cartaya, Huelva, Spain.

Contact and rights requests: contacto@apartamentoelrompido.es.

2. Data, purposes and legal bases

• Booking requests: dates, number of guests, name, email, telephone, optional message and quote details, used to reply, check availability and take requested pre-contractual steps.
• Confirmed bookings and stays: data needed to manage the booking, payment, guest assistance and legal duties. The basis is performance of the contract and compliance with legal obligations.
• Email enquiries: address, message and metadata, used to reply on the basis of your request or our legitimate interest in handling communications.
• Website analytics: pages, language, device and interactions, without sending booking-form personal data to Analytics. This starts only after consent to analytics cookies.

3. Retention

Enquiries that do not become bookings are kept only as needed to reply and for no longer than 12 months, unless required for a claim. Booking, payment and invoicing records are retained for applicable legal periods. Analytics consent may be withdrawn at any time.

4. Recipients and providers

We do not sell personal data. Necessary providers may process it for website hosting, email, Google Analytics after consent and Stripe when its payment link is used. Airbnb and Booking.com apply their own policies when you use those platforms.

Where a provider processes data outside the EEA, recognised safeguards such as adequacy decisions or standard contractual clauses will apply.

5. Your rights

You may request access, rectification, erasure, restriction, objection or portability, and withdraw consent. Email contacto@apartamentoelrompido.es. You may also complain to the Spanish Data Protection Agency at aepd.es.

6. Security and children

We use reasonable security measures and restrict access to the owner area. The form is intended for adults arranging accommodation and is not designed to collect children's data directly.

7. Changes

We may update this policy when services or legal requirements change. The current version date is shown above.