1. Data controller Responsible:

María del Carmen Moreno Ruiz NIF: 52586435V

Commercial name: Family Apartment NerjaChaparil

Contact address: Calle Chaparil, 2. 29780-Nerja (Málaga). España.

Email: nerjachaparil@hotmail.com

Phone: +34614373281.

2. Data processed Depending on your relationship with us, the following may be treated:

* Identification and contact details.

* Dates of stay, number of guests and booking details.

* Data required for billing and payment management.

* Mandatory data for the registration and communication of travellers.

* Communications, inquiries and incidents related to the stay.

* Full copies of ID, passport or other identification documents shall not be requested or retained.

* Complete bank card details are processed directly by the payment gateway and not stored by Family Apartment NerjaChaparil.

3. Purposes and legal bases:

Data will be processed for: Manage pre-booking inquiries and requests, implementation of pre-contractual measures. Formalize and manage the reservation, payment, stay and guest care, execution of the contract. Issue invoices and fulfill tax, tourist and traveller registration obligations, compliance with legal obligations. Resolve incidents, prevent fraudulent uses and address claims, legitimate interest and defense of rights. Send commercial communications, only when there is explicit consent, which can be withdrawn at any time.

4. Addressees:

The data may be communicated or processed by: Smoobu, as a provider of the management and reservation system. Stripe or other payment institutions used during the booking. Strictly necessary technical, IT or maintenance providers. Security forces and other public administrations when there is a legal obligation. Tax, accounting or legal advice when necessary. Personal data is not sold or rented to third parties. Smoobu contractually establishes that it acts as a data processor with regard to guest data processed on behalf of the accommodation. 

5. Conservation:

The data will be kept during the contractual relationship and, subsequently, for the periods necessary to fulfill legal, tax, accounting obligations and to meet possible liabilities. Data relating to the passenger register shall be kept or communicated in accordance with the time limits and conditions laid down by applicable law. Royal Decree 933/2021 establishes a general period of three years for subjects subject to the obligation of documentary registration, although it includes particularities for non-professional activities. Data used for commercial communications will be retained until consent is withdrawn.

6. Rights:

The interested person may request: Access to your data. Correction of inaccurate data. Deletion where applicable. Limitation of treatment. Opposition. Portability. Withdrawal of consent. To exercise them, you must write to nerjachaparil@hotmail.com, indicating the right you wish to exercise and providing only the information necessary to verify your identity. You can also file a complaint with the Spanish Data Protection Agency.

7. Security:

Appropriate technical and organisational measures are in place to protect the data against unauthorised access, loss, alteration or disclosure.

8. Updates:

This policy may be modified to adapt it to changes in regulations or services used. The current version will always be the one published on this page.