This English version of our Privacy Policy is provided for information only. The legally binding text is the Spanish original, which prevails in the event of any discrepancy.
Last updated: 24 April 2026
1. Data controller
In accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (“the GDPR”), and with the applicable Spanish legislation, users are informed that the personal data provided through this website and in the course of managing the accommodation will be processed by:
Data controller: JoaquĂn LĂłpez Crespo
Trading name: Casa Rural Castalla
NIF (Spanish tax identification number): 21688025Z
Postal address: Carrer Major 33, 03420 Castalla, Alicante, Spain
Email: hola@casaruralcastalla.com
Telephone: 601 99 46 95
2. Purposes of the processing
Personal data may be processed for the following purposes:
a) Dealing with enquiries and requests for information
To handle and reply to enquiries received through the contact form, by email, by telephone or by WhatsApp.
b) Managing bookings and the pre-contractual or contractual relationship
To handle availability requests, direct bookings, communications before arrival, assistance during the stay and any communications needed to provide the accommodation.
c) Traveller registration and compliance with legal obligations
To collect, verify and report the data required by law for traveller registration (registro de viajeros, the Spanish guest registration duty) through the systems provided by the competent authorities.
d) Administrative, accounting and tax management
To keep and process the data needed to manage payments, receipts, invoicing where applicable and compliance with tax and other legal obligations.
e) Managing access to the accommodation and security
To manage temporary access codes and the technical logs associated with the electronic lock system, as well as security measures for the property.
f) Requesting ratings or reviews
To ask for a rating or review of the stay once it has ended, on a one-off and non-recurring basis.
g) Website browsing, analytics and site operation
To manage the technical operation of the website, to analyse use of the site on an aggregated basis and to remember preferences, in accordance with the cookie policy and with the preferences expressed by the user.
3. Categories of data processed
Depending on the channel and the purpose, the following categories of data may be processed:
- Identification data: first name, surname, identity document and the data required by law for traveller registration.
- Contact data: email address, telephone number, postal address.
- Booking and stay data: dates, number of guests, booking channel, incidents, communications before or during the stay.
- Access data: temporary lock codes and technical records of locking and unlocking.
- Browsing data: IP address, online identifiers, cookie preferences and analytics data, depending on the browser settings and the consent given.
- Data contained in messages or enquiries sent voluntarily by the user.
No special categories of personal data are requested, unless the data subject provides them spontaneously and without being asked to do so.
4. Legal basis for the processing
The legal basis depends on the specific purpose:
- Consent of the data subject: for sending enquiries through the contact form and for the use of non-essential cookies.
- Steps taken at the data subject’s request prior to entering into a contract: when the user asks about availability or terms, or arranges a possible booking.
- Performance of a contract: for managing the booking, the stay and the communications needed to provide the service.
- Compliance with legal obligations: for traveller registration, tax and accounting obligations, and requests from the competent authorities.
- Legitimate interests of the controller: for reasonable security measures, technical control of access and a one-off request for a review after the stay, always respecting the rights and expectations of the data subject.
5. Source of the data
The data may be obtained:
- Directly from the data subject.
- Through the forms on the website.
- Through communications by email, telephone or WhatsApp.
- Through booking or intermediary platforms, such as Airbnb, Booking, casasrurales.net or similar, when the booking is made through them.
6. Recipients of the data
As a general rule, the data will not be disclosed to third parties, except where there is a legal obligation to do so or where it is necessary in order to provide the service.
However, the following may take part in the processing, depending on the case:
- Public authorities or competent bodies, where there is a legal obligation.
- Technology suppliers and providers of web hosting, maintenance, email, forms, analytics, maps, the electronic lock or other digital services, acting as data processors where applicable.
- Booking or intermediary platforms, when the booking or the communication is handled through their systems, in accordance with their own privacy policies.
7. International transfers
Certain technology providers used for email, messaging, analytics, maps or other digital features may involve the processing of data outside the European Economic Area.
Where this happens, steps will be taken to ensure that such processing is covered by appropriate safeguards in accordance with the applicable legislation, such as adequacy decisions, standard contractual clauses or other legally recognised safeguards.
Users may request further information about these safeguards by writing to hola@casaruralcastalla.com.
8. Retention periods
The data will be kept for as long as necessary for the purpose for which it was collected and, after that, for the periods required by law or needed to deal with any liabilities that may arise.
As a guide:
- Enquiries received through the contact form, by email or by telephone that do not lead to a booking: up to 12 months from the last contact.
- Communications linked to a booking or a stay: for the duration of the relationship and, afterwards, for as long as necessary to deal with incidents, complaints or liabilities.
- Traveller registration data collected through the online form before it is submitted or verified: for the time strictly necessary to process and check it, without prejudice to the information reported to the competent authorities.
- Documents of tax or accounting relevance: for the periods required by law.
- Technical access logs from the electronic lock: for a limited and reasonable period, for security reasons.
- Browsing data and cookies: as set out in the Cookie Policy and in the user’s consent settings.
Once the applicable periods have ended, the data may be deleted, anonymised or blocked as appropriate.
9. Rights of data subjects
Data subjects may exercise the following rights, on the terms set out in the applicable legislation:
- Access to their personal data.
- Rectification of inaccurate data.
- Erasure of their data where appropriate.
- Objection to the processing.
- Restriction of the processing.
- Data portability, where applicable.
- Withdrawal of consent at any time, without affecting the lawfulness of processing carried out beforehand.
To exercise these rights, you may send a request to:
The request must identify the applicant clearly enough and state which right they wish to exercise. Reasonable additional information may be requested in order to verify their identity.
If you believe that your rights have not been dealt with properly, you may also lodge a complaint with the Spanish Data Protection Agency (AEPD) through its electronic office (sede electrĂłnica).
10. Data security
The controller applies reasonable technical and organisational measures to protect personal data against loss, unauthorised access, alteration or improper disclosure, taking into account the nature of the data processed and the context of the processing.
Users should nevertheless be aware that security measures on the internet are not completely infallible.
11. CCTV and access control
The property may have security and access control measures in place.
In particular:
- An electronic lock system may be used, with temporary codes for each booking and technical records of locking and unlocking.
- There may be a live viewing system in the indoor entrance area, with no recording or storage of images and no audio capture, used solely for security purposes.
Where applicable, specific additional information will be provided by means of signage or a supplementary information notice.
12. Minors
As a general rule, this website and the related services are not aimed at minors acting on their own in the booking process. Where data relating to minors is provided, it must be provided by the person holding legal representation or responsibility for them, where applicable.
13. Links to third parties
This website may contain links to third-party pages or services. Casa Rural Castalla is not responsible for the privacy policies or the content of those external sites. Users are advised to review their respective policies before providing personal data.
14. Changes to this policy
This Privacy Policy may be updated to reflect changes in legislation or in the technical operation of the website or the service.
If significant changes are made, the updated version will be published on this same page.
