Privacy Policy

1. Who we are

This website is operated by Jans Pijbes and Minouche van den Bor, trading as Casa Malacitano, located at Cam. de la Fuente de La Zarza, 29240 Valle de Abdalajís, Málaga, Spain.

We are the data controller for the personal data collected through this website. You can reach us at info.malacitano@gmail.com or by phone at +34 680 922 373.

2. What data we collect and why

2.1 Enquiries and bookings

When you contact us or make a booking, we collect: your name, email address, phone number, number of guests, and the dates of your stay. We use this to respond to your enquiry, confirm your booking, and communicate information relevant to your stay.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR).

2.2 Guest identification, Spanish law

Spanish law (Real Decreto 933/2021) requires accommodation providers to collect and retain specific identification data from all guests aged 14 and over (full name, date of birth, nationality, ID/passport number, and date of arrival). This data is reported to the Spanish authorities (Guardia Civil / Policía Nacional) and retained for a minimum of three years.

Legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR).

2.3 Website analytics (Google Analytics)

With your consent, we use Google Analytics 4 to understand how visitors use our website. This involves the collection of anonymised usage data (pages visited, time spent, device type). No personally identifiable information is shared with Google. IP addresses are anonymised.

Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw consent at any time by clicking "Cookie preferences" in the footer.

2.4 Cookies

We use strictly necessary cookies to ensure the website functions correctly. Analytics cookies are only placed after you give explicit consent. See our cookie section below for details.

3. How long we keep your data

• Enquiry data (no booking made): deleted within 12 months of last contact.
• Booking and payment data: retained for 7 years (tax and accounting obligations under Spanish law).
• Guest identification data required by Spanish law: retained for a minimum of 3 years.
• Analytics data: retained by Google Analytics for 14 months (our configured retention period).

4. Who we share your data with

We do not sell your personal data. We may share data with:

• Spanish authorities: guest identification data as required by law.
• Google LLC: anonymised analytics data (via Google Analytics), processed under a Data Processing Agreement. Google may transfer data to the United States under Standard Contractual Clauses.
• Our booking platform: if you book via a third-party platform (e.g. Booking.com, Airbnb), their privacy policy applies to data shared through that platform.

5. Your rights under GDPR

You have the right to:

• Access: request a copy of the personal data we hold about you.
• Rectification: ask us to correct inaccurate or incomplete data.
• Erasure: ask us to delete your data, where no legal obligation requires us to retain it.
• Restriction: ask us to limit how we use your data in certain circumstances.
• Portability: receive your data in a machine-readable format.
• Object: object to processing based on legitimate interest.
• Withdraw consent: withdraw consent for analytics cookies at any time.

To exercise any of these rights, contact us at info.malacitano@gmail.com. We will respond within 30 days. You also have the right to lodge a complaint with the Spanish data protection authority (AEPD) at www.aepd.es.

6. Cookies

Cookie	Type	Purpose
cookie-consent	Strictly necessary	Stores your cookie consent preference (localStorage). No personal data.
_ga, _ga_*	Analytics	Google Analytics, measures website traffic. Only set after consent.

7. Data security

This website is served over HTTPS. We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss or disclosure. Email communication is not encrypted end-to-end; for sensitive matters, please call us directly.

8. Changes to this policy

We may update this policy from time to time. The date at the top of this page indicates when it was last revised. Continued use of the website after changes constitutes acceptance of the updated policy.