Privacy Policy

The protection of your personal data is of particular importance to us. We treat your personal data confidentially and in accordance with applicable data protection laws and this Privacy Policy.

1. Data Controller

The data controller for this website within the meaning of the General Data Protection Regulation (GDPR) is:

Daniel Schwarz & Sandy Hase
Casa Feliz
Via Real 48
29780 Nerja, Málaga
Urbanización San Juan de Capistrano
Spanien

Contact: Preferably via the contact form on this website.
Email:

2. Collection and Storage of Personal Data, as well as the Nature and Purpose of Its Use

2.1 Accessing the Website (Server Log Files)

When you visit our website, your device’s browser automatically sends information to our website’s server. This information is temporarily stored in so-called server log files. In particular, the following data is collected:

  • IP address of the requesting device,
  • date and time of access,
  • Name and URL of the file accessed,
  • Website from which the access originated (referrer URL),
  • browser used and, if applicable, the operating system of your device, as well as the name of your Internet service provider.

The data mentioned is processed for the following purposes:

  • To ensure that the website connects smoothly,
  • To ensure a convenient user experience on our website,
  • Evaluating system security and stability, as well as
  • administrative purposes (e.g., error analysis, investigation of misuse).

The legal basis for data processing is Art. 6(1)(f) of the GDPR. Our legitimate interest arises from the purposes listed above. This data is not combined with other data sources. Log files are generally deleted after no later than 30 days, unless longer retention is required for security reasons (e.g., in connection with specific incidents).

2.2 Contacting Us via the Contact Form

If you submit inquiries to us via the contact form provided on the website, the information you provide in the inquiry form—including the contact information you enter there—will be stored in order to process your inquiry and in case of follow-up questions. The processing of the data entered into the contact form is therefore carried out exclusively on the basis of your consent (Art. 6(1)(a) GDPR) or, in the case of pre-contractual or contractual inquiries, on the basis of Art. 6(1)(b) GDPR.

As a rule, the following data is processed:

  • Name,
  • Email address,
  • phone number (if applicable),
  • your message, and, if applicable, travel/booking details (e.g., desired dates, number of people).

You may revoke this consent at any time. To do so, simply send an informal notification via email. The lawfulness of data processing operations carried out prior to revocation remains unaffected by the revocation.

The data you enter in the contact form will remain with us until the purpose for storing the data no longer applies (e.g., after your inquiry has been processed) or until you request that we delete it, provided that no statutory retention requirements prevent us from doing so.

2.3 Contacting Us via Email

If you contact us via email, the data you provide (e.g., name, email address, message content, and, if applicable, booking details) will be processed for the purpose of handling your inquiry and in case of follow-up questions. The legal basis is Art. 6(1)(b) of the GDPR, provided that the inquiries are pre-contractual or contractual in nature; otherwise, Art. 6(1)(f) of the GDPR.

2.4 Booking Inquiries, Bookings, and Contract Processing via Our Website

If you submit a booking request or make a binding reservation through our website, we process the personal data you provide in order to review your request, respond to it, and—if you make a reservation—execute the rental agreement for Casa Feliz.

In connection with the booking request or booking, the following data in particular may be processed:

  • Last name, first name,
  • Email address,
  • Mailing address,
  • phone number (if provided),
  • check-in and check-out dates,
  • number of travelers,
  • travelers’ dates of birth (if applicable; to comply with official registration requirements in Spain),
  • Comments or notes regarding the reservation,
  • Payment information (e.g., deposits, final payments—but no credit card information, as we do not process online payments through our website).

This data is processed pursuant to Art. 6(1)(b) of the GDPR (performance of a contract or pre-contractual measures). Without the provision of this data, we cannot process your request or arrange your stay.

Billing and Financial Accounting

To issue invoices, payment requests, booking confirmations, cancellation invoices, or other contract-related documents, we continue to process continue to process your personal data even after the booking is complete. This is done on the basis of Article 6(1)(b) of the GDPR (contract) as well as Article 6(1)(c) of the GDPR (statutory retention requirements under tax law).

Tax-related data is retained for the prescribed period in accordance with Spanish law and is subsequently deleted or anonymized.

Sharing with Our Rental Agency

To facilitate your stay (e.g., key handover, cleaning, guest registration with the Policía Nacional / Guardia Civil in accordance with Spanish registration requirements), it may be necessary to share your data with our local management office / rental agency in Nerja.

This sharing is strictly limited to the specified purpose and is based on Art. 6(1)(b) of the GDPR.

Spanish Guest Registration

Landlords of tourist accommodations in Spain are legally required to report certain guest data to the competent police authority. This includes, among other things:

  • Last name and first name,
  • ID/passport number,
  • Date of birth,
  • Country and place of residence,
  • Length of stay.

This processing is based on Article 6(1)(c) of the GDPR (legal obligation under Spanish law).

3. Disclosure of Data

Your personal data will not be transferred to third parties for purposes other than those listed below.

We will only disclose your personal data if:

  • you have given your explicit consent pursuant to Article 6(1)(a) of the GDPR,
  • the disclosure is necessary pursuant to Article 6(1)(b) of the GDPR to fulfill a contractual relationship with you or to take steps prior to entering into a contract,
  • there is a legal obligation to disclose the data under Article 6(1)(c) of the GDPR, or
  • the disclosure is necessary pursuant to Article 6(1)(f) of the GDPR to safeguard legitimate interests and there is no reason to believe that you have an overriding legitimate interest in preventing the disclosure of your data.

As part of the rental of Casa Feliz, it may be necessary to share your information (e.g., name, length of stay, number of guests) with our local management / rental agency in Nerja, to the extent necessary to process your booking, handle key handover, cleaning, guest registration with authorities, or similar purposes .

4. Bookings via Third-Party Platforms

If you inquire about or book our accommodation through third-party platforms (e.g., Airbnb, Booking.com, Traum-Ferienwohnungen, etc.), the collection and processing of your personal data is primarily carried out by the respective platform operator. In such cases, the privacy policies and terms of use of the respective platform apply.

We receive from these platforms only the data necessary to process the booking and arrange your stay (e.g., name, travel dates, number of guests, contact information). We process this data in accordance with this Privacy Policy.

5. Cookies

To the best of our knowledge, our website currently does not use any cookies that require consent pursuant to Art. 6(1)(a) GDPR (e.g., for tracking or advertising). Should technically necessary cookies be used in the future (e.g., to display the contact form or to ensure the functionality of the site), this will be done on the basis of Article 6(1)(f) of the GDPR (legitimate interest in a functioning website).

Should we implement a consent/cookie banner or use additional services (e.g., analytics tools, embedded maps, fonts from third-party servers) in the future, this Privacy Policy will be supplemented and amended accordingly.

6. Hosting

Our website is hosted by an external service provider (host). The host provides the infrastructure necessary for the secure and reliable operation of the website. As part of the hosting service, all data generated in connection with the operation of this website is processed on the host’s servers.

The legal basis is Article 6(1)(f) of the GDPR. Our legitimate interest lies in the secure, stable, and efficient provision of our online services. We have a contract with the hosting provider for data processing in accordance with Article 28 of the GDPR.

7. Duration of Storage

Personal data is stored only for as long as is necessary for the respective purpose or as required by statutory retention obligations. Once the purpose no longer applies or the statutory retention periods have expired, the data will be deleted or anonymized.

8. Your Rights as a Data Subject

Within the framework of applicable legal provisions, you have the right at any time to:

  • Access to your personal data processed by us (Art. 15 GDPR),
  • Rectification of inaccurate data or completion of your data stored by us (Art. 16 GDPR),
  • Erasure of your data stored by us (Art. 17 GDPR), provided that no statutory retention obligations preclude this,
  • Restriction of the processing of your data (Art. 18 GDPR),
  • Data portability (Art. 20 GDPR),
  • Objection to the processing of your data (Art. 21 GDPR), provided that the processing is based on Art. 6(1)(e) or (f) GDPR.

If you have given us consent to process your data, you may withdraw this consent at any time with future effect (Art. 7(3) GDPR).

To exercise your rights, you can contact us at any time using the contact information provided .

9. Right to File a Complaint with a Supervisory Authority

You have the right to file a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates the GDPR. As a rule, the competent supervisory authority is the one in the location where you have your habitual residence or place of work.

10. Status of This Privacy Policy

This Privacy Policy is currently in effect. It may be updated to reflect changes in legal or technical requirements. The most current version is available at any time on this website.

Back to the Home Page