2. Processing Activities and Legal Bases

2.1 Operation and Hosting of This Website

Processed Personal Data:

IP address, browser type and version, operating system, referrer URL, host name of the accessing computer, time of the server request, amount of data transferred, HTTP status code

Purposes:

Enabling website use, ensuring system security, error analysis, protection against misuse and cyber attacks

Legal Basis:

Legitimate interests in the proper operation of the website

Storage Period:

Server log files 30 days, then deletion or anonymisation

Recipient:

1&1 IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany

2.2 Contact Form and Enquiries

Processed Personal Data:

First name, surname, telephone number, email address, message content, IP address, time stamp of transmission

Purposes:

adressing guest enquiries, communicating with interested parties and guests, documenting business communications

Legal Basis:

Consent through explicit declaration of consent in the contact form

Pre-contractual and contractual activities

Legitimate interests in customer/ guest service

Retention period:

3 years from complete processing of the enquiry for documentation of the business relationship; general questions from guests are deleted within 30 days after their stay

2.3 Bookings and Contract Performance

Processed Personal Data:

First and last name, full address, email address, telephone number, booking period, number of persons, special requests

Purposes:

performance of the rental agreement, provision of accommodation, guest service during the stay

Legal Basis:

Contract performance

Storage Period:

Until complete contract performance, then in accordance with statutory retention periods up to 10 years in accordance with tax law retention obligations

2.4 Payment Services (Only for Bookings Made via This Website)

Processed Personal Data:

First and last name, email address, postal address, bank details or credit card details, transaction data, invoice amounts

Purposes:

Processing payments for bookings, fraud protection

Legal Basis:

Contract performance

Recipient:

Stripe, Inc., 510 Townsend Street, San Francisco, CA 94103, USA

Third Country Transfer:

USA, adequacy decision by the EU Commission based on the so-called EU-US Data Privacy Framework, (Adequacy Decision (EU) 2023/1795 of 10 July 2023)

Storage Period:

Until complete contract performance, then in accordance with statutory retention periods up to 10 years in accordance with tax law retention obligations.

Note:

This processing only takes place for actual bookings and payment transactions via this website.

2.5 Guest Registration in Accordance With Spanish Law

Processed Personal Data:

Full name, date of birth, nationality, type and number of identity document, full residential address including country, telephone number or email address, for minors under 14 years of age, relationship to the accompanying person

Purposes:

Compliance with the legal reporting obligation in the tourism sector.

Legal Basis:

Compliance with a legal obligation in accordance with Real Decreto 933/2021 (external link)

Recipients:

Spanish Ministry of the Interior (Ministerio del Interior); when using the digital registration tool, also Spanish third-party service providers

Transfer Period:

No later than 24 hours after check-in

Storage Period:

3 years on a secure server in Germany, immediate deletion in the event of cancellation prior to arrival

Note:

Further information on the Guest Registration can be found here. [Link to guest registration information]

2.6 Cookies and website functionalities

2.6.1 General information

Cookies and similar technologies are implemented on this website. Detailed information can be found in our Cookie Policy. [LINK TO COOKIE POLICY].

We obtain your consent for cookies that are not technically necessary (in particular Google Maps). Before you give your consent, we inform you about:

·    the type and scope of storage and access

·    the purposes of processing

·    the storage period of the information

·    your rights of objection

You can change your settings at any time. For instance here . [LINK TO CMT]

2.6.2 Technically necessary cookies

Purposes:

Basic functionality of the website, session management, security measures, storage of language settings

Legal Bases:

Technical necessity

Legitimate interests

Services Affected:

• WordPress (session management for website functionality)
• Polylang (storage of the selected language)
• LiteSpeed (performance optimisation and caching)
• Complianz (cookie consent management and consent storage)

Storage Period:
Session cookies until browser closure, persistent cookies for a maximum of 2 years

2.6.3 Accessibility widget

Processed Personal Data:

User settings for accessibility (text size, contrast, font, etc.)

Purposes:

Improving website accessibility, e.g. for people with disabilities, adapting the display to individual needs

Legal basis:
Compliance with a legal obligation

Legitimate interests in inclusive website design

Technical necessity for desired functionality

Service:
Ally – Web Accessibility (Elementor Ltd.)

Storage location:
Locally in the user’s browser (local storage)

Storage Period:
Until deletion by the user or browser reset

2.6.4 Services requiring consent
Google Maps integration

Processed Personal Data:
IP address, geolocation data (if activated by the user), interaction data with the map

Purposes:
Display of interactive maps for location visualisation of accommodation

Legal bases:

Consent

Legitimate interests in location display

Recipient:

Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland

Third Country Transfer:

USA, adequacy decision by the EU Commission based on the so-called EU-US Data Privacy Framework, (Adequacy Decision (EU) 2023/1795 of 10 July 2023)

Activation:

Google Maps is only loaded after the user has given their express consent

Note:

https://policies.google.com/privacy (external link)