Privacy Policy - Villa La Dolce Vita

1. DATA CONTROLLER

La Dolce Vita El Salobre

Address: C/ Green 7, villa 11, Urb. Salobre Golf, 35106 San Bartolomé de Tirajana (Las Palmas, Spain)

Email: [email protected]

Activity: Management and operation of tourist accommodation.

2. PURPOSES AND LEGAL BASES FOR PROCESSING

We process personal data collected via the website and direct channels for the following purposes:

- Handling inquiries, requests, and price quotes: Processing pre-booking requests. Legal basis: Implementation of pre-contractual measures (Article 6(1)(b) GDPR).

- Booking formalisation and performance: Comprehensive management of accommodation, booking confirmations, and payment processing. Legal basis: Performance of an accommodation contract (Article 6(1)(b) GDPR).

- Compliance with official guest registration requirements: Mandatory completion and submission of guest check-in records to competent law enforcement authorities. Legal basis: Compliance with a legal obligation (Article 6(1)(c) GDPR), pursuant to Organic Law 4/2015 on Citizen Security Protection and Royal Decree 933/2021.

- Compliance with tax and accounting obligations: Invoicing and tax settlement. Legal basis: Compliance with a legal obligation (Article 6(1)(c) GDPR).

- Security and fraud prevention: Protecting communication integrity and information systems. Legal basis: Legitimate interest (Article 6(1)(f) GDPR) in preventing unauthorized access and cyber threats.

3. CATEGORIES OF DATA PROCESSED

- Identification and contact details: Full name, telephone number, email address, and postal address.

- Official identification documents: Document type and number (National ID, Foreigner Identification Number / NIE, or Passport), date of birth, and nationality, collected solely to comply with the mandatory guest registration required under public security regulations.

- Stay details: Check-in and check-out dates, number of guests, and operational booking preferences.

- Billing and payment data: Electronic payments are handled through secure, certified payment gateways (PCI-DSS compliant). Full payment card numbers and CVV/CVC security codes are never stored on our systems.

Special categories of personal data (revealing racial or ethnic origin, political opinions, religious beliefs, health, biometric data, or sexual orientation) are not processed.

4. RECIPIENTS AND DATA PROCESSORS

Personal data will not be disclosed to third parties, except where required by law to Spanish State Security Forces and the Tax Administration.

To provide technical and operational services, the following categories of providers access data as Data Processors (under formal contracts compliant with Article 28 GDPR):

- Property Management Software and booking engine providers (Cloud PMS / SaaS).

- Web hosting and email infrastructure providers.

- External tax, accounting, and administrative advisory services.

No international data transfers outside the European Economic Area (EEA) are conducted without the appropriate legal safeguards required under the GDPR.

5. RETENTION PERIODS AND DATA LOCKING (BLOQUEO)

- General inquiries without a booking: Retained for a maximum of 6 months following our reply.

- Guest check-in reports and entry forms: Retained for 3 years from the end of the stay, in strict compliance with Royal Decree 933/2021.

- Invoices and accounting records: Retained for 5 years for tax and contractual compliance purposes (General Tax Act and Civil Code), and 6 years for statutory accounting books (Commercial Code).

Data Blocking: In accordance with Article 32 of Spanish Organic Law 3/2018 (LOPDGDD), once data is rectified or erased, it will remain blocked and accessible exclusively to courts, tribunals, the Public Prosecutor’s Office, and competent administrative authorities to handle potential liabilities arising from processing. Blocked data cannot be actively used and will be permanently deleted upon expiry of the applicable statute of limitations.

6. SECURITY AND FRAUD (PHISHING) PREVENTION NOTICE

The Data Controller implements appropriate technical and organizational measures to ensure data confidentiality, including logical access control through enhanced credentials and two-factor authentication (2FA).

Notice to Guests: La Dolce Vita El Salobre will never contact you via messaging apps (WhatsApp, Telegram, or SMS) or non-official links requesting credit card details, security codes, or urgent bank transfers to accounts not previously specified during the booking process. All payment transactions are managed through official contractual channels. If you receive any suspicious communication, do not click any links and contact us immediately at [email protected].

7. DATA SUBJECT RIGHTS

You may exercise your rights of access, rectification, erasure, restriction of processing, data portability, and objection at any time by sending a signed request to [email protected], including a copy of your valid identity document to confirm your identity.

You also have the right to lodge a complaint with the competent supervisory authority, the Spanish Data Protection Agency (Agencia Española de Protección de Datos - AEPD), via its website at www.aepd.es.