1. Data Controller
The data controller is:
Jiřà Karvánek
NIE: Y-767-1983-W
Calle Castillo del Inglés 15
29620 Torremolinos, Málaga, Spain
E-mail: info@santa-clara.eu
This Privacy Policy applies to direct bookings made through the Santa Clara & La Roca Booking Website.
2. Personal Data We Process
When you use this Booking Website or make a direct reservation, we may process:
- your name and contact details;
- booking dates, number of guests and accommodation selected;
- address, country and other information required for the reservation;
- payment and billing information;
- messages and requests relating to your booking;
- information required to manage the stay and comply with legal obligations;
- technical information such as IP address, browser information, date and time of access and security logs.
We do not ask guests to send photographs or copies of passports or identity documents by ordinary e-mail or WhatsApp.
3. Why We Process Your Data
We process personal data for the following purposes:
- to answer enquiries and take steps before entering into an accommodation contract;
- to create, administer and confirm direct reservations;
- to manage payments, cancellations and refunds;
- to communicate with guests before, during and after the stay;
- to manage incidents and customer service;
- to comply with accounting, tax and statutory accommodation obligations;
- to comply with traveller registration and reporting requirements where applicable;
- to ensure the security and technical operation of the Booking Website and prevent fraud.
The legal bases are the performance of a contract or pre-contractual steps, compliance with legal obligations and, where applicable, our legitimate interests in operating and protecting the accommodation service.
We do not use booking data for advertising or promotional communications unless there is a separate legal basis and, where required, your prior consent.
4. Hostaway
This Booking Website is provided using the Hostaway platform.
For personal data collected through the Booking Website, Hostaway acts primarily as a service provider and data processor on our behalf. Hostaway may use sub-processors to provide hosting, communications, monitoring, analytics and other technical services. Hostaway
Hostaway may also process limited information for its own purposes where permitted by applicable law, as described in its own Privacy Policy. Hostaway
5. Payments
Payment information may be processed through Hostaway and the payment service provider connected to the Booking Website.
Payment information is processed only as necessary to complete, secure and administer your payment, refund or other transaction.
6. Other Recipients
Where necessary, personal data may also be shared with:
- banks and payment service providers;
- tax, accounting or legal advisers;
- website, hosting, security and communication providers;
- competent public authorities where required by law;
- law-enforcement authorities in connection with statutory traveller registration and reporting obligations.
We do not sell personal data or disclose it for third-party advertising purposes.
7. International Transfers
Some technology providers used by Hostaway or by us may process personal data outside the European Economic Area.
Where required, international transfers are protected by an adequacy decision, Standard Contractual Clauses or another mechanism recognised by the GDPR. Hostaway confirms that it uses safeguards for transfers outside the EU/EEA. Hostaway
8. Retention
We retain personal data only for as long as necessary for the purpose for which it was collected and for applicable statutory periods.
In particular:
- traveller registration records are retained for the period required by Spanish law;
- booking, contract and incident information is retained for the duration of the relationship and subsequently for applicable limitation periods;
- invoices and accounting records are retained for the legally required tax and commercial periods;
- technical and security logs are retained only for as long as necessary for security and operation.
9. Your Rights
Under the GDPR, where applicable, you may request:
- access to your personal data;
- rectification of inaccurate data;
- erasure;
- restriction of processing;
- objection to processing;
- data portability.
To exercise your rights, contact:
info@santa-clara.eu
We may request the minimum information necessary to verify your identity.
You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD).
10. Children
Where information about children is required for accommodation or statutory traveller registration, it is provided by the accompanying adult in accordance with applicable law.
11. Cookies and Technical Technologies
This Booking Website may use cookies and similar technologies necessary for its operation.
If optional analytics or tracking technologies are enabled, they should only be activated in accordance with your cookie preferences and applicable law. Hostaway provides a cookie consent banner for this purpose. Hostaway
12. Security
We apply reasonable technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure.
13. Full Privacy Information
For additional information about how Santa Clara & La Roca processes personal data, please see our full Privacy Policy:
https://www.santa-clara.eu/legal/
Contact: info@santa-clara.eu