Privacy policy
Last updated: April 2026
1. Data controller
| Name | María del Carmen Cartagena García |
| Address | Avda. Europa 11, 4th floor, 03140 Guardamar del Segura (Alicante), Spain |
| Contact | mamen.cartagena@gmail.com · +34 607 305 040 |
| Activity | Holiday apartment rental (VT-454572-A) |
2. Legal framework
Your personal data is processed in accordance with the EU General Data Protection Regulation (GDPR — Regulation 2016/679), the Spanish Organic Law 3/2018 on Personal Data Protection (LOPDGDD), and any other applicable regulations.
3. Data we process, purposes and legal basis
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email, stay dates | Managing the booking and sending confirmation | Contract performance (Art. 6.1.b GDPR) |
| ID / passport of all guests | Traveller registration (legal obligation) | Legal obligation (Art. 6.1.c GDPR) — R.D. 933/2021 |
| Sending booking-related communications | Contract performance (Art. 6.1.b GDPR) | |
| Email (after the stay) | Optional request for a review | Legitimate interest (Art. 6.1.f GDPR) — prior relationship |
| Email (if marketing box ticked) | Sending offers and news about the property | Consent (Art. 6.1.a GDPR) — withdrawable at any time |
We do not carry out automated decision-making or build profiles for commercial purposes.
4. Data processors
To provide our service we work with the following processors under confidentiality agreements:
| Provider | Purpose | Location |
|---|---|---|
| Stripe Payments Europe Ltd. | Card payment processing | EU (Ireland) |
| Resend Inc. | Booking transactional emails | USA — EU Standard Contractual Clauses |
| Google LLC (Calendar) | Internal availability management | USA — EU Standard Contractual Clauses |
| Vercel Inc. | Web hosting | USA — EU Standard Contractual Clauses |
Transfers outside the EU are covered by appropriate safeguards under Article 46 GDPR (Standard Contractual Clauses approved by the European Commission). Your data is never sold or transferred to third parties for their own purposes.
5. Retention periods
| Booking and contract data | 5 years (civil and tax obligations) |
| Traveller registration data | 3 years (R.D. 933/2021) |
| Payment reference (Stripe) | 5 years (accounting and tax law) |
| Email / WhatsApp communications | Up to 1 year after the stay |
Once these periods expire, data will be securely deleted or anonymised.
6. Your rights
You may exercise the following rights at any time by writing to mamen.cartagena@gmail.com, stating the right you wish to exercise and attaching a copy of your ID:
- Access: find out what data we hold about you.
- Rectification: correct inaccurate or incomplete data.
- Erasure: request deletion when data is no longer necessary.
- Objection: object to processing based on legitimate interest.
- Restriction: limit processing in certain circumstances.
- Portability: receive your data in a structured, machine-readable format.
We will respond within one month of receiving your request. If you believe your request has not been handled correctly, you may lodge a complaint with the Spanish Data Protection Authority (AEPD) at www.aepd.es.
7. Cookies
This website only uses technical cookies strictly necessary for the booking and payment process with Stripe. No advertising, tracking or profiling cookies are used. No cookie consent banner is required as no non-essential cookies are present.
8. Security
We apply appropriate technical and organisational measures to protect your data against unauthorised access, accidental loss or destruction, including HTTPS, restricted system access and encryption of data in transit. Card data never passes through our servers — it is processed directly by Stripe.
9. Updates to this policy
We may update this policy when required, for example in response to regulatory changes or changes in the services we use. The current version will always be available on this page with its update date. We will notify you of material changes by email where appropriate.