Data controller: Sunvisa SL · sunvisa@sunvisa.es.
Purposes and legal bases: (1) managing your booking and payments — performance of the contract (art. 6(1)(b) GDPR); (2) guest registration and reporting to the authorities — legal obligation (Royal Decree 933/2021, art. 6(1)(c)); (3) fraud prevention and security — legitimate interest (6(1)(f)).
Recipients: Stripe Payments Europe Ltd. (payment processor; we do not store your full card details), our email provider, and the Spanish Ministry of the Interior / Police where the law requires it.
Retention: booking and billing data for the tax and limitation periods; guest data for 3 years after check-out (then deleted). ID document numbers are stored encrypted.
Your rights: access, rectification, erasure, objection, restriction and portability by writing to sunvisa@sunvisa.es; you may also complain to the Spanish data protection authority (AEPD, aepd.es).