Privacy Policy
Last updated: July 29, 2026
1. Data Controller
| Controller | Bruno Italiano |
| Tax ID (NIF/NIE) | Y3499431H |
| Address | Nerja (Málaga), Spain |
| Contact email | privacy@andalusiamalaga.com |
| Website | https://andalusiamalaga.com |
2. What data we process and why
| Purpose | Data processed | Legal basis |
|---|---|---|
| Responding to contact form inquiries | Name, email, phone (if provided), message content | Consent (Art. 6(1)(a) GDPR) |
| Sending newsletter/marketing communications | Name, email | Consent (Art. 6(1)(a) GDPR) and Spanish e-commerce law (LSSI-CE) |
| Managing user accounts (owner, guest, operator, property manager) | Registration data, profile, platform activity, associated bookings/services | Performance of a contract / pre-contractual steps (Art. 6(1)(b) GDPR) |
| Web analytics (audience measurement) | IP address (anonymized where possible), cookie identifiers, browsing behaviour | Consent via cookie banner (Art. 22 LSSI-CE) |
| Future online store (purchase of services/products) | Billing data, delivery/shipping address, order history. Payment data is processed directly by the payment gateway and is not stored on our servers | Performance of contract and legal (tax invoicing) obligation |
3. How long we keep the data
Data is retained for as long as the relationship with the user continues (active account, active subscription) and afterwards for the periods required under applicable Spanish commercial, tax and anti-money-laundering rules (generally up to 6 years for tax/accounting records in Spain). Data from a one-off inquiry is kept only as long as needed to handle it, and no longer than 12 months unless another relationship follows.
4. Who we share data with
We do not sell personal data or share it with third parties for their own commercial purposes. Data is shared only with processors necessary to provide the service:
- Web hosting: InMotion Hosting, Inc., based in the United States, where the site's servers are located.
- Email/newsletter provider Mailchimp.
- Web analytics tool Google Analytics
- Payment gateway (once e-commerce is enabled) Stripe/Redsys/PayPal, PCI-DSS certified.
5. International data transfers
The website is hosted on InMotion Hosting servers located in the United States, which involves an international transfer of data outside the European Economic Area (EEA). As InMotion Hosting is not certified under the EU-US Data Privacy Framework, this transfer relies on the Standard Contractual Clauses (SCCs) approved by the European Commission, incorporated through the corresponding Data Processing Addendum (DPA) signed with the provider, which ensure a level of protection equivalent to that required by the GDPR.
6. Your rights
Any user may exercise the following rights free of charge by emailing privacy@andalusiamalaga.com with a copy of an identity document:
- Right of access to your personal data.
- Right to rectification of inaccurate data.
- Right to erasure ("right to be forgotten").
- Right to object to processing.
- Right to restriction of processing.
- Right to data portability.
You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), www.aepd.es, if you believe the processing does not comply with applicable law.
7. Cookies
The site uses first-party and/or third-party cookies for technical and analytics purposes. For details on the cookies used, their purpose, and how to configure or reject them, see our Cookie Policy.
8. Minors
Andalusiamalaga.com's services are intended for users aged 18 and over. We do not knowingly collect data from minors. If we discover that a minor's data has been collected without valid parental/guardian consent, we will delete it.
9. Data security
We apply reasonable technical and organizational measures (encryption in transit via HTTPS/TLS, role-based access control, backups) to protect personal data against unauthorized access, loss or alteration.
10. E-commerce (future functionality)
When the site adds online sale of products or services, this policy will be expanded to detail: billing/shipping data processed, order retention periods, the payment processor used and its own privacy policies, and data processing for fraud-prevention purposes.
11. Changes to this policy
This Privacy Policy may be updated to reflect legal changes or changes to the website. Please review this page periodically. The "last updated" date at the top reflects the current version.