Privacy Policy

1. Data controller

Alquileres Moya acts as authorised manager and intermediary, in the name and on behalf of the holder of each property, and is the party that handles requests, bookings and guest support. We process the data you provide to us within that framework.

No data protection officer has been appointed, as none of the circumstances that require one apply. For any question relating to your data, you can write directly to contacto@alquileresmoya.es.

2. What data we collect and how

We only process the data you provide to us voluntarily. We do not collect browsing data, we do not build profiles and we do not use analytics tools.

2.1 Quote request form

• The property chosen.
• Arrival and departure dates, and the resulting number of nights.
• Number of people and, where the property allows them, the number of pets and the corresponding surcharge.
• The rate chosen.
• First name and surname(s).
• Email address.
• Phone number, with its international dialling code.
• Your preferred contact method: email, phone or WhatsApp.
• Any message or comments you wish to add.
• Confirmation that you have read this data protection information.

Your first name, surname(s), email address and the number of people are required: without them we cannot prepare a quote or reply to you. Your phone number is only required if you choose to be contacted by phone or by WhatsApp. The rest is optional or is calculated from what you have chosen.

2.2 Contact form

• Name.
• Email address.
• Phone number.
• Subject of the enquiry.
• Message.

2.3 Guest registration form

If the booking is confirmed, before your arrival we will send you a form to comply with the legal obligation to register the people who stay. It collects, for each guest:

• First name and surname(s);
• Gender;
• Date of birth;
• Nationality;
• Address, postcode, town or city and country;
• Type and number of identity document, and document support number;
• Email address and phone number;
• The same details for any additional guests accompanying you.

No photographs or copies of identity documents are requested or stored.

This form is managed with Smoobu and includes its own data protection information before you fill it in.

2.4 What we do not collect through the website

Through this website we do not ask for bank details, identity documents or any special category of data.

If you write to us by email, phone us or contact us through social media, we will process the data you provide in that communication for the same purposes described here.

3. What we use your data for

• To answer the enquiries you send us.
• To prepare a quote and send it to you.
• To handle your request and the subsequent communication.
• To manage the booking, if it is finally confirmed, in the name and on behalf of the holder of the property.
• To assist you before, during and after the stay.
• To comply with the legal obligations that apply to us, in particular tax and accounting obligations, those arising from tourism legislation and those relating to the guest register.
• To handle complaints and, where applicable, to defend or bring any possible claims.

We do not use your data for advertising, promotions, newsletters or any other commercial communication. We do not disclose or sell your data for commercial purposes, and there is no secondary purpose other than those listed above.

4. The legal basis on which we process it

• Taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR): when you ask us for a quote or make an enquiry about a possible stay.
• Performance of a contract (Article 6(1)(b) GDPR): when the booking is confirmed, in order to manage it and so that you can enjoy the property.
• Compliance with legal obligations (Article 6(1)(c) GDPR): for tax, accounting and tourism obligations and, in particular, for guest registration.
• Legitimate interest (Article 6(1)(f) GDPR): to answer general enquiries, to prevent abusive or fraudulent use of the forms and to keep the information strictly necessary to handle or defend claims.

The box you tick on the request form serves to show that you have received and read this information. It is not a general consent to all the processing described, nor does it replace the legal bases above.

5. Who has access to your data

Only Elena Pindado Moya. She is the only person with access to the website forms and to the booking management tool. There is no other user or team member with access.

Two providers are involved; they act as data processors and may only use the data to provide their service to us:

5.1 Netlify — web hosting and form handling

Provides the hosting of the website, the server functions and the receipt of the two website forms.

• Notifications of new submissions are sent only to contacto@alquileresmoya.es.
• Submissions are recorded in the dashboard and remain there until they are deleted manually; they can be exported and deleted at any time.
• Netlify’s real user monitoring and analytics are disabled.

How we manage them: we review submissions every three months. Enquiries that do not lead to a booking are deleted 12 months after the last communication. Submissions linked to a confirmed booking are deleted once the necessary information has been transferred to the relevant management systems. This form log is not used as a permanent contractual, accounting or tax archive.

5.2 Smoobu — booking management and guest registration

This is the internal tool we use to manage the properties, the prices, the availability calendars and the guest registration form. Smoobu is not loaded in your browser when you visit this website: the website does not embed any of its content.

• Only Elena Pindado Moya has access.
• The guest registration data remains there after it has been sent to the authorities, within the periods set out in section 7.
• It is possible to delete the data of a specific guest without deleting the rest of the booking, and this is done where appropriate.

5.3 Public authorities

Guest registration data is submitted manually to SES.HOSPEDAJES, the system set up by the public authorities for compliance with this legal obligation.

Certain data may also be accessed by the bodies to which we are required by law to disclose it, such as the tax authorities or the competent tourism authorities.

There is no payment gateway on the website, so no payment provider is involved in processing the data collected through this website.

6. International data transfers

The providers listed may process information outside the European Economic Area. In that case, the processing must be covered by the safeguards provided for in the GDPR, such as the standard contractual clauses approved by the European Commission.

We periodically review our providers’ privacy documentation to check that these safeguards are still in place.

7. How long we keep your data

• Requests and enquiries that do not lead to a booking: a maximum of 12 months from the last communication, unless there is a pending complaint or liability.
• Confirmed bookings: the mandatory contractual, accounting and tax documentation, 6 years; guest registration data, three years from the end of the stay; all other data, for as long as necessary to meet the obligations and any possible liabilities arising from the stay.

Data is not kept indefinitely. We review the stored data every quarter. Once the applicable period has expired, identifying data that no longer needs to be kept is deleted, and the rest is appropriately blocked for as long as any legal obligation remains.

8. Your rights

You can exercise the following rights at any time:

• Access: to know what data about you we process.
• Rectification: to correct inaccurate or incomplete data.
• Erasure: to ask us to delete it when it is no longer necessary.
• Objection: to object to processing based on legitimate interest.
• Restriction: to ask us to suspend processing in certain cases.
• Portability: to receive your data in a structured, commonly used format.

Some of these rights may be limited where we must keep the information to comply with a legal obligation —such as guest registration— or to handle a complaint.

How to exercise them: write to contacto@alquileresmoya.es stating the right you wish to exercise. We may ask you to prove your identity. We will reply within the time limit set by law.

If you consider that we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), calle Jorge Juan 6, 28001 Madrid — www.aepd.es.

9. Security

The website is served over an encrypted connection (HTTPS) and applies security headers in the browser. Access to form submissions and to the management tool is restricted to the data controller and protected by her credentials.

We apply reasonable technical and organisational measures to protect your data, and we require our providers to do the same. No system is infallible: if a security breach posing a risk to your rights were to occur, we would act as provided for by law.

10. Minors

The forms on this website are intended for adults. If a booking includes minors, their data is provided under the responsibility of the adult making the booking, and only to the extent that it is necessary for the stay or for guest registration.

11. Changes to this policy

This policy may be updated if the services, the providers, the booking conditions or the way we process data change. The version in force will always be the one published on this page, with its update date.