1. Data Controller

The controller responsible for data processing on this website and in connection with the rental of the holiday property is:

Andreas Pennartz
Gartenstr. 27, 58313 Herdecke (Germany)
Email: contact@lagorosasignaturestay.com
Phone: +49 151 12724598

The controller determines the purposes and means of processing personal data in accordance with Art. 4(7) GDPR.

2. General Information

We take the protection of your personal data very seriously. Personal data is processed in accordance with the applicable data protection laws, in particular the General Data Protection Regulation (GDPR).

Personal data includes all information relating to an identified or identifiable natural person, such as name, email address, or IP address.

3. Categories of Data Processed

Depending on your interaction with us, we process the following categories of personal data:

3.1 Personal identity and contact details

• Name and Surname
• Address
• E-mail address
• Phone number
• Date of birth (if required for registration)
• Passport or ID Card information (only when legally required for tourist registration in Spain)

3.2 Booking, stay and payment details

• Arrival and departure dates (Reservation dates)
• Number of guests
• Special preferences and requests
• Payment and billing information (processed securly via third-party providers)
• Payment status
• Check-in and check-out informations

3.3 Technical details (collected automaticaly)

• IP-Address
• Browser information
• Device information
• Pages visited on our website
• Cookies and similar technologies (see section xx)

4. Purposes and Legal Bases

We process personal data for the following purposes:

4.1 Contract performance (Art. 6(1)(b) GDPR)

• processing reservations and bookings requests
• concluding and fulfilling for the rental 
• communication with guests
• process payments
• prepare the property for your stay
• handle check-in and check-out

4.2 Legal obligations (Art. 6(1)(c) GDPR)

• compliance with tax and accounting obligations
• Spain requires tourist accommodations to register guest identity details with the authorities.

4.3 Legitimate interests (Art. 6(1)(f) GDPR)

• Respond to inquiries
• Personalize your experience
• ensuring website functionality
• preventing misuse or fraud 
• improve service quality and security

4.4 Consent (Art. 6(1)(a) GDPR – where applicable)

• marketing activities or newsletters

Processing necessary for booking and contract execution does not require consent.

5. Website Data Processing

When you visit our website, certain information is collected automatically:

• IP address
• date and time of request
• browser type and operating system

This data is required for the provision and security of the website.

IP addresses are considered personal data within the meaning of the GDPR.

6. Data Sharing and Recipients

Personal data will only be shared where necessary for the provision of our services.

6.1 Property Manager 

We cooperate with an external property manager:

Niels Blankenstein and Gina Guillamon
Wijkermeerhof 19
2493 WB Den Haag
The Netherlands

The property manager processes personal data on our behalf for:

• booking administration
• guest communication

Role:
Generally, the property manager acts as a data processor pursuant to Art. 28 GDPR.
In cases where the manager independently determines the purposes of processing, the relationship may qualify as joint controllership pursuant to Art. 26 GDPR.

6.2 Key Holder

A local key holder is engaged for on-site services:

Costa Blanca Keyservice
Van Campenhout Sammy
Calle Revolcadores 43
03185 Torrevieja

Processing purposes include:

• check-in and check-out
• guest support

The key holder acts as a data processor unless operating as an independent controller.

6.3 Cleaning Service

We use a service provider for cleaning and preparation:

Costa Blanca Keyservice
Van Campenhout Sammy
Calle Revolcadores 43
03185 Torrevieja

Personal data is processed only where necessary.
The service provider acts as a data processor, provided personal data is involved.

6.4 Local authorities

6.5 Data Minimisation Principle

Personal data is only shared to the extent necessary to fulfill contractual purposes, in accordance with the principle of data minimisation under the GDPR.

All third parties comply with GDPR standards through Data Processing Agreements.

7. Data Processing Agreements (Art. 28 GDPR)

We have concluded Data Processing Agreements (DPAs) with all service providers acting as data processors.

These agreements ensure that:

• personal data is processed only based on our instructions
• confidentiality obligations are respected
• appropriate technical and organisational measures are implemented

8. Joint Controllership (Art. 26 GDPR – if applicable)

Where personal data is processed jointly with another party (e.g. the property manager), a joint controllership agreement has been established in accordance with Art. 26 GDPR.

This agreement defines responsibilities for compliance with GDPR obligations, in particular with regard to transparency and the exercise of data subject rights.

9. International Data Transfers

All processing activities take place within the European Economic Area (EEA).

No transfers of personal data to third countries outside the EEA take place.
A uniform level of data protection applies within the EU.

If a service provider is located outside the EU/EEA, transfers of personal data will only take place under the following conditions:

• Adequacy decisions
• Standard Contractual Clauses
• GDPR-compliant safeguards

10. Data Retention

Personal data is retained:

• Booking and payment records: 7 years (legal requirement)
• Guest registration data: per Spanish regulations
• Communication emails: max 2 years
• Marketing consent: until you withdraw consent

Once the legal retention period expires, the data is deleted or anonymized.

11. Data Security

We implement appropriate technical and organisational measures in accordance with Art. 32 GDPR to protect personal data:

• SSL/TLS encryption
• access controls and authentication
• data minimisation and pseudonymisation
• secure storage and backup procedures

12. Rights of Data Subjects

You have the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)

To exercise any rights, email us at: contact@lagorosasignaturestay.com

13. Complaint with Supervisory Authority

You have the right to lodge a complaint with a supervisory authority, in particular in your country of residence or where the alleged infringement occurred.

14. Website-Specific Services

14.1 Hosting

Our website is hosted by:

STRATO GmbH

Personal data (e.g. IP addresses) is processed on the servers of the hosting provider.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and efficient website operation)

You can withdraw your consent at any time via the cookie settings.

14.2 Booking Platforms

Bookings may be processed via third-party platforms such as:

• Airbnb.com
• Booking.com
• Micazu.com

These platforms act as independent data controllers.

Their respective privacy policies apply.

14.3 Payment Provider

For payment processing, we use:

• Stripe Payments Europe Ltd.

Payment data is transmitted securely to the provider.

Legal basis: Art. 6(1)(b) GDPR (contract performance)

14.4 Meta (Instagram / Facebook Presence and Services)

We maintain an online presence on social media platforms operated by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Meta”).

This includes in particular:

• Instagram
• Facebook

14.4.1 Purpose of Processing

We use these platforms to:

• present our services
• communicate with customers and interested parties
• analyze user interactions and improve our offerings

14.1.2 Joint Controllership (Art. 26 GDPR)

When using Meta services (e.g. Instagram pages), the processing of personal data may occur under joint controllership between us and Meta pursuant to Art. 26 GDPR.

Meta provides so-called “Insights” (statistics on page usage), which are generated based on user behavior.

14.1.3 Data Processing by Meta

When visiting our social media pages, Meta may process personal data, including:

• IP address
• usage behavior
• device information
• interaction data (likes, comments, messages)

This data may also be transferred to servers outside the European Union, in particular to the United States.

14.1.4 Legal Basis

The processing is based on:

• Art. 6(1)(f) GDPR (legitimate interest in communication and marketing)
• Art. 6(1)(a) GDPR (consent, where required – e.g. tracking technologies)

14.1.5 User Rights

Data subjects may exercise their rights both:

• with us as the page operator
• directly with Meta as the primary data processor

Please note that Meta has primary responsibility for processing certain data.

14.1.6 Further Information

Further information on data processing by Meta can be found here:

• https://privacycenter.instagram.com/
• https://www.facebook.com/privacy/policy/

14.5 Cookies and Consent Management

Our website uses cookies to ensure functionality and improve user experience. Non-essential cookies (e.g. analytics) are only set after obtaining your consent via a cookie banner.

Legal basis: Art. 6(1)(a) GDPR (consent)

15. Updates to This Policy

We may update this Privacy Policy to reflect changes in legal requirements or our practices.
The updated version will always be posted on our website.