1. Who controls your data
The controller is [Marcel’s full legal name/company], NIF/CIF [number], at [address]. Privacy enquiries and rights requests may be sent to [privacy email].
Data Protection Officer: [contact details, or “Not appointed because PDG15 is not required to appoint one” after confirmation].
2. What we use information for
| Activity | Information | Legal basis | Retention |
|---|---|---|---|
| Enquiries and pre-booking requests | Name, contact details, dates, guest requirements and message | Steps requested before a contract; legitimate interests in responding | [Period] |
| Reservations, payments and guest service | Identity, contact and booking details, payment status, correspondence and stay preferences | Performance of the accommodation contract; legal obligations | [Period, including tax/accounting period] |
| Statutory traveller registration | Guest identity and information required by Spanish authorities | Legal obligation | [Statutory period] |
| Security, damage and claims | Booking records, communications, incident evidence and transaction details | Contract; legitimate interests; legal claims | [Period] |
| Marketing, if offered | Email and consent record | Consent, or another basis confirmed by counsel | Until consent is withdrawn, subject to [suppression period] |
| Website preferences and measurement | Device, browser, IP and interaction data | Consent for non-essential technologies; legitimate interests for necessary security | See the Cookie Policy |
3. Who receives information
Information may be handled by providers needed to operate PDG15, including Lodgify for booking technology, [payment provider], [hosting provider], professional advisers, cleaning/guest-service partners where necessary, and competent public authorities.
PDG15 does not sell personal information.
4. International transfers
Some providers may process information outside the European Economic Area. Where this occurs, PDG15 will use an approved transfer mechanism such as an adequacy decision or Standard Contractual Clauses. Confirmed providers and safeguards: [List providers, countries and safeguards].
5. Your rights
You may request access, correction, deletion, restriction, portability or objection, and may withdraw consent at any time without affecting earlier lawful processing. Send a request to [privacy email]. PDG15 may request reasonable identity verification.
You may also complain to the Spanish Data Protection Agency (AEPD).
6. Required information
Fields identified as required are needed to respond, make a reservation or meet legal obligations. A booking or stay may not be possible if required information is not supplied.
7. Children and updates
The website is not directed at children booking accommodation independently. Information about minors may be processed as part of a family booking where necessary. This policy may be updated when services or legal requirements change; the date above identifies the current version.