Privacy policy

The controller for this website’s own processing activities is Peter Schaller, a self-employed professional (autónomo) managing accommodation owned by third parties, with NIE Y7076174P and business address Calle Isla Lanzarote 6, pt 197, Golf Badia, 03509 Finestrat, Spain, trading as Azure Bay Collection. Contact for privacy matters and rights requests: info@azurebaycollection.com. Telephone: +34 699 901 338.

We apply the General Data Protection Regulation, Regulation (EU) 2016/679, and Spain’s Organic Law 3/2018 on personal data protection and digital rights (LOPDGDD). Spain’s Law 34/2002 (LSSI) also applies to cookies and commercial communications. Accepting website terms does not replace these rules.

This policy covers browsing, accommodation searches, booking requests, enquiries and user accounts. Online payment is available only when the provider is connected and the owner is approved to receive payments. Google Analytics and Google Ads advertising tags are not enabled.

Section 9 describes processing when booking and guest registration services are enabled. It does not mean those services are already available. When we process data solely on another accommodation operator’s instructions, we act as a processor under the relevant agreement; that operator must be identified as the controller and provide their own notice. The trading name alone does not determine the parties’ data protection roles.

When you contact us, we process your name, email address, telephone number if supplied, message and information you provide about your stay or property. We receive it from you or an authorised representative. Please provide only necessary information; a general enquiry does not require identity document copies or health information.

In the private area, we process account identifiers, names, email addresses, permissions, protected authentication details, access events, IP addresses and technical browser information. Audit records may include the action, time, affected item and changed values needed for traceability.

Connecting to the server involves processing the IP address and technical information needed to deliver the page and address incidents. This does not mean every visitor is automatically recorded on the traffic map. The public presentation website currently does not include the booking module’s separate visitor logging.

Enquiries and proposals: responding to requests about stays or property management and preparing a possible contract, under GDPR Article 6(1)(b) where you request pre-contractual steps. For other enquiries or professional contacts, we rely on the legitimate interest in responding, subject to balancing the rights affected. An enquiry alone is not consent to marketing campaigns.

Accounts and contracted services: providing access and functions necessary for the service under Article 6(1)(b) where you are a contracting party. For users acting for a business or owner, the relevant basis is the legitimate interest in managing the professional relationship and its access permissions, where applicable.

Security and audit: preventing unauthorised access, investigating incidents and maintaining traceability on the basis of legitimate interest under Article 6(1)(f). That interest must be balanced against individual rights and limited to proportionate data and retention periods; it does not permit indefinite storage.

Legal obligations: responding to valid requests and complying with applicable tax, accounting and accommodation obligations under Article 6(1)(c). The specific law and processing activity depend on the service provided.

Marketing: no campaign system is currently enabled on the website. Before introducing one, we will provide information and obtain consent where required. Electronic marketing must comply with LSSI Articles 21 and 22, including an easy, free way to object.

Authenticated access is entered in the audit log. The IP address may be compared with a geographic database held on our server to display an approximate location. We do not request the device’s GPS location. The result does not identify a home address or a person’s exact location. An IP address does not necessarily represent one person.

If the booking website is enabled, its visitor module records IP address, page and date and time, using a derived identifier to group reloads from the same IP address and page in five-minute intervals. This logging does not use cookies. A daily task removes visitor entries older than 90 days from the operational register. This period does not automatically apply to the access audit log.

Visitor measurement in that module will only be enabled with the appropriate information and legal basis. The absence of cookies does not exempt processing from the GDPR.

In the private area’s map, the administrator’s browser requests map images from OpenStreetMap. The provider may receive that administrator’s IP address, connection details and map requests. OpenStreetMap uses an international image delivery network, so requests may be served outside the EEA under its own privacy policy. Matching logged IP addresses to geographic information happens locally; those logged IP addresses are not sent to the map provider. The OpenStreetMap Foundation privacy policy is linked below.

Enquiries: while dealing with the enquiry and requested pre-contractual steps. Once closed, only information necessary for liabilities or a legal obligation is retained for the applicable period, with restricted access where appropriate.

Accounts: for the relationship that justifies access. After closure, information needed for obligations or claims may be kept with restricted access for the relevant periods; this does not keep login permissions active.

Security and audit logs: the ordinary retention period selected for login and operation records is three calendar years from each event. A daily task removes entries whose third anniversary has passed. This period supports incident investigation and evidence of operations; it is not a general statutory obligation for all logs. A documented incident may justify retaining only directly related information separately, with restricted access, for a necessary and legally justified period. The traffic screen’s 90-day filter is not a deletion policy for all records.

For transactions subject to accounting or tax obligations, records follow their own rules: generally six years from the last accounting entry for business records under Article 30 of Spain’s Commercial Code. Tax records follow applicable limitation and inspection periods; the general four-year period does not exclude interruptions or special cases. This does not justify retaining all customer information for the longest period when unnecessary.

The professional electronic traveller register covered by Article 5 of Royal Decree 933/2021 is retained for three years from the end of the service. Statutory exceptions and documents retained for other purposes are assessed separately.

Backups: automated daily server backups have a selected retention period of three calendar years from creation. After a new complete backup, the daily task checks and removes expired sets. If no complete, unexpired backup exists or files are abnormal, an incident is raised and must be resolved without unduly prolonging storage. Backups are for recovery, with restricted access. Restores must reapply previous deletions and prevent deleted data returning to active use. Separately downloaded or created copies require their own retention procedure. Moving or duplicating a copy does not restart its retention period. Backup rotation does not replace the statutory retention periods for original documents. Where blocking under LOPDGDD Article 32 is required, data is reserved exclusively for the legally specified liabilities and destroyed when that period ends.

Only authorised personnel who need the information for their work may access it. Hosting, email, maintenance and support providers may process information needed to deliver their services. The current infrastructure uses Hostinger with the primary server in France, and email and domain services from Websupport Magyarország Kft. Accommodation owners receive only information necessary for the service relevant to them.

Authorities, courts and other competent bodies may receive information where a legal obligation or valid request requires it. If providing a service requires sharing information with an accommodation owner or another provider, their role is identified and disclosure is limited to what is necessary.

The server location does not exclude international access by providers. Hostinger’s data processing agreement provides for European Commission standard contractual clauses for transfers to countries without an adequacy decision. Its terms and subprocessor list appear in the agreement linked below. Websupport and OpenStreetMap privacy information is also linked. You may request information about recipients and a copy of applicable safeguards at info@azurebaycollection.com.

There is currently no active data-exchange integration with Booking.com, Airbnb, a payment provider or an artificial intelligence service. Before introducing these services, we will update the information about their roles, recipients and safeguards.

The authenticated area uses essential first-party session cookies: azb_at lasts 15 minutes and azb_rt lasts 14 days. Renewal may start a new period. These cookies are accessible only to the server (HttpOnly) and transmitted over HTTPS. Blocking them may prevent private access.

Your chosen application language may be saved in browser local storage under azb.locale. It has no automatic expiry and can be removed in browser settings. It remembers the preference you requested and must not be repurposed for advertising tracking.

There are currently no Google Ads or Google Analytics cookies. If non-essential tracking technologies are introduced, they must remain disabled until the required consent is obtained. Refusing or withdrawing consent must be as accessible as accepting it. Browsing alone is not consent.

For a booking, the necessary identity and contact details, dates, guest information, billing and transaction details are processed. The contract or requested pre-contractual steps provide the basis for data needed to deliver the service; traveller registration and invoicing have their own legal basis. Specific information must be provided before collection, including the identities of the accommodation provider and controller.

Where Royal Decree 933/2021 requires it, the information necessary for registration and reporting to the competent Spanish Ministry of the Interior authorities is collected. Full identity card or passport copies are not routinely requested. Identification uses proportionate means. This notice does not claim that the system has a working or certified automatic connection to SES.Hospedajes.

Data required by contract or law is necessary for the relevant service; failing to provide it may prevent that service. Children’s information is requested only where needed and with the involvement of their representative or accompanying adult as required by law. The website does not offer independent registration for children.

You may request access, rectification, erasure, restriction or objection, and portability where its conditions are met, by writing to info@azurebaycollection.com or the controller’s postal address. State the right you wish to exercise and enough information to identify the processing. Additional identity information is requested only where there are reasonable doubts, in a proportionate manner.

Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing. You may object to processing based on legitimate interest for reasons relating to your situation; you may object to direct marketing at any time.

We normally respond within one month of receipt. If the complexity or number of requests justifies an extension of up to two further months, we will explain the reason within the first month. Exercising your rights is free, except for the statutory cases involving manifestly unfounded or excessive requests.

You may complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos) through its electronic office, without first having to complete an internal complaint procedure, or to another competent EEA authority where applicable. These functions do not make decisions based solely on automated processing that produce legal or similarly significant effects on individuals.

We update this policy when processing changes. A new date alone does not authorise incompatible purposes or replace new consent where needed. Significant changes will be communicated appropriately before they take effect.

When available and you choose Google sign-in, we receive your Google account identifier, verified email address and name to create or link your guest account and authenticate you. We do not request access to Gmail, Drive, contacts or calendars. Google sign-in does not grant owner or administrator permissions and does not automatically link bookings by matching email addresses.

The connection to Google begins only when you press the sign-in or linking button. Google may process connection data under its own policy: https://policies.google.com/privacy. The linked identity is retained while needed for access to your account; you can request its removal at info@azurebaycollection.com, subject to the retention obligations described above.

To secure this sign-in we use the technical cookie azb_google_flow, HttpOnly and HTTPS in production, for up to 8 minutes. Temporary sign-in attempt data expires after 8 minutes and is deleted on use or by a cleanup every 10 minutes. This is not an advertising cookie.

A booking request is linked to the signed-in account. Dates, guest count, contact details and booking/payment status are used to manage the request and stay. We retain the user, version and time of the owner’s commission acceptance as evidence of that agreement.

When Stripe Connect is connected, owner identification and bank-account entry and guest card payment take place on Stripe. We send the owner’s name, contact email and selected country, and the booking identifier, amount, currency and guest email needed for payment. This website does not store full card numbers or CVC codes. Connection and transaction identifiers and statuses and commission terms are retained. Stripe’s own processing is described at https://stripe.com/privacy.

Opening the property map requests images from OpenStreetMap, which may receive your IP address and the requested map area. The public map shows an approximate location. The list and calendar work without opening the map.