Privacy Policy
The Spanish version is binding; other language versions are translations. Spanish version
This policy explains which personal data we process in connection with the website marresidences.com and with the booking and provision of tourist accommodation in Andalusia (Spain), for what purposes, on what legal basis, and what rights you have under Regulation (EU) 2016/679 (GDPR) and the Spanish data protection act (Ley Orgánica 3/2018, LOPDGDD).
1. Data Controller
Beautiful Home Lettings Spain S.L.
registered office: Urb. El Palmeral, Casa Hinojosa s/n, 29570 Cártama (Málaga), Spain
NIF (Spanish tax ID): B10858736
Data protection e-mail: info@marresidences.com
Phone: +420 602 281 725
(the "Controller")
The Controller has not appointed a data protection officer, as it is not legally required to do so.
2. Data We Process
- identification and contact data: first name and surname, e-mail, phone, preferred language;
- booking data: property, dates of stay, number and age of guests, any pet, selected rate, ordered additional services, booking notes;
- payment data: details of the bank transfer received (payer name, payer account/IBAN, amount, date, payment reference). The Controller does not accept card payments and does not process payment card data;
- billing data, where needed to issue an invoice;
- traveller registration data (Royal Decree 933/2021): first name and surname, date of birth, nationality, type and number of identity document, home address, visa number where applicable and other details required by law, for all persons staying, to the extent required by law;
- photos of identity documents — only if the guest chooses verification by document photo during online check-in. Reading data from the photo (OCR) takes place in the guest's own browser. The photos are accessible only to the Controller and are deleted automatically 7 days after departure. Alternatively, the guest can enter the details manually and the Controller will check them;
- data from the My apartment app: booking login, a random device identifier (used to alert the guest to a login from a new device), service orders and operational records of the stay (e.g. completion of check-in);
- communication with the guest (e-mails, phone calls, complaints);
- technical data necessary to operate and secure the website (e.g. IP address, browser type, time of request).
3. Purposes and Legal Basis
- creating and performing the booking and accommodation contract, including communication about the stay (confirmation, payment details, arrival reminder, access details) — performance of a contract, Art. 6(1)(b) GDPR;
- receiving and reconciling payments — performance of a contract, Art. 6(1)(b) GDPR;
- registering travellers and transmitting their data to the Spanish Ministry of the Interior via SES.Hospedajes — legal obligation, Art. 6(1)(c) GDPR in conjunction with Organic Law 4/2015 and Royal Decree 933/2021;
- complying with Andalusian tourist accommodation rules (Decree 28/2016) — legal obligation, Art. 6(1)(c) GDPR;
- accounting and tax compliance — legal obligation, Art. 6(1)(c) GDPR;
- identity verification by document photo — your consent, Art. 6(1)(a) GDPR, which you may withdraw at any time (the details can be entered manually instead);
- securing the website and the My apartment app, preventing misuse, handling complaints and establishing or defending legal claims — legitimate interest of the Controller, Art. 6(1)(f) GDPR.
Providing the data needed for the booking and for traveller registration is necessary to conclude the contract or required by law; without it, the accommodation cannot be provided. We do not use the data for automated decision-making or profiling, and we do not send you marketing communications without your consent.
4. Recipients and Processors
- Spanish Ministry of the Interior (SES.Hospedajes system) — traveller data, as required by law;
- public authorities (e.g. tax authorities, courts) where required by law;
- Cloudflare, Inc. — hosting of the website, app and booking database (Cloudflare Workers);
- Resend (Resend, Inc.) — sending confirmation and information e-mails;
- the bank holding the Controller's account — receiving and reconciling payments;
- the Controller's accountant or tax adviser (gestoría), to the extent necessary.
The website loads fonts from Google Fonts (Google) and, on the home page, current weather from Open-Meteo; these services technically receive your device's IP address. We do not sell data or pass it to third parties for marketing purposes.
5. Transfers Outside the European Economic Area
Some processors (Cloudflare, Resend) are US-based companies, and data may also be processed outside the EEA. Such transfers take place only on the basis of appropriate safeguards under Chapter V GDPR, in particular the European Commission's adequacy decision (EU–US Data Privacy Framework) for certified recipients, or standard contractual clauses approved by the European Commission.
6. Retention
- booking data and communication: for the duration of the contract and thereafter for the limitation periods for possible claims;
- accounting and tax records: for the period required by Spanish law (as a rule 6 years under the Commercial Code, Código de Comercio);
- traveller registration: 3 years, as required by Royal Decree 933/2021;
- photos of identity documents: deleted automatically 7 days after departure;
- data stored in your browser (see the Cookie Policy): until you delete it or log out.
7. Your Rights
You have the right of access to your data, to rectification, to erasure (unless a legal retention obligation applies), to restriction of processing, to data portability, to object to processing based on legitimate interest, and to withdraw consent at any time without affecting the lawfulness of prior processing. You can exercise your rights by e-mail at info@marresidences.com; we will reply within one month at the latest.
You also have the right to lodge a complaint with the supervisory authority: Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, Spain, www.aepd.es, or with the supervisory authority of the EU Member State of your habitual residence or place of work.
8. Data Security
The Controller takes appropriate technical and organisational measures: encrypted data transfer (HTTPS), access to the administration protected by a password and, where enabled, two-factor authentication, access details for the property released only after online check-in and only for the duration of the stay, and automatic deletion of document photos.
9. Cookies
Information on cookies and data stored in your browser is set out in the Cookie Policy. The booking terms are set out in the Booking and Accommodation Terms and Conditions.
10. Changes to This Policy
The Controller may update this policy to a reasonable extent, in particular when the services used or the law change. The current version is always available on this page.