Legal information
Privacy policy
Last updated: 2026-08-20
This policy explains how the personal data of those who visit this website, contact us or stay in our apartments is processed, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Act 3/2018 on Data Protection and the guarantee of digital rights (LOPDGDD). This is a courtesy translation: in the event of any discrepancy, the Spanish version prevails.
1. Data controller
- Controller
- MEDINATOLETUM, S.L.
- Tax ID (NIF / CIF)
- B19659721
- Registered address
- Plaza Bibrambla 18, 18001 Granada
- [email protected]
- Phone
- +34680251473
No data protection officer has been appointed, as none of the circumstances set out in article 37 GDPR or article 34 LOPDGDD applies.
2. What data we process and where it comes from
- Contact details you provide. Name, email address, phone number and the content of your message when you write by email, WhatsApp or through the contact form. The form on this site does not send information to any server of ours: it opens your own email programme so that the message is sent as an ordinary email from your account.
- Booking data. Name and surname, contact details, dates and accommodation chosen, number of guests and payment or guarantee details. These are collected by the external booking engine or by the platform you booked through, not by this website.
- Traveller registration data. The identification and identity document details of guests that Spanish public security legislation requires us to collect and report to the competent authorities.
- Billing data. Those needed to issue and keep invoices for the services provided.
Data comes from the data subject or, for bookings, from the platform or booking engine used. No special categories of data are collected, and no profiling or automated decision-making with legal effects takes place.
3. Purposes and legal basis
| Purpose | Legal basis (art. 6 GDPR) |
|---|---|
| Answering enquiries, information requests and availability questions. | Pre-contractual steps at the data subject's request (art. 6.1.b) and legitimate interest in replying to those who write to us (art. 6.1.f). |
| Managing the booking, the stay and guest support during it. | Performance of the accommodation contract (art. 6.1.b). |
| Complying with traveller registration and reporting obligations to the competent authorities. | Legal obligation (art. 6.1.c) under Organic Act 4/2015 on public security and Royal Decree 933/2021. |
| Issuing invoices and meeting tax and accounting obligations. | Legal obligation (art. 6.1.c). |
| Handling complaints, claims and requests to exercise rights. | Legal obligation (art. 6.1.c) and performance of the contract (art. 6.1.b). |
| Sending commercial communications, should they ever be offered. | Consent of the data subject (art. 6.1.a), which may be withdrawn at any time. |
Providing the data marked as necessary for a booking or for traveller registration is essential: without it the stay cannot be arranged.
4. How long we keep the data
- Enquiries that do not lead to a booking: as long as needed to answer them and thereafter for the limitation period of any resulting claims.
- Booking and stay data: for the duration of the relationship and thereafter blocked for the applicable statutory limitation periods.
- Traveller registration: the period required by public security legislation (three years from registration), after which it is deleted.
- Invoicing and accounting: the periods required by commercial and tax legislation (six years under the Commercial Code and the four-year tax limitation period).
- Data processed on the basis of consent: until consent is withdrawn or removal is requested.
5. Who the data is shared with
Data may be disclosed to:
- Law enforcement bodies and competent public authorities where there is a legal obligation (traveller registration, judicial or administrative requests).
- The tax authorities, in compliance with tax obligations.
- Banks and payment service providers, in order to process payments and booking guarantees.
- Technology providers acting as processors, which access data solely to deliver their service: web hosting, email, the booking engine and distribution platforms.
- Tax, accounting and employment advisers, and legal services.
A processing agreement as required by article 28 GDPR is in place with every processor. Personal data is never sold or transferred to third parties for advertising purposes.
6. International transfers
Processing takes place primarily within the European Economic Area. If any provider processes data outside the EEA, the transfer relies on a European Commission adequacy decision or on the standard contractual clauses referred to in article 46 GDPR, together with any additional safeguards required.
7. Your rights
Any person may exercise the following rights:
- Access: to know what data about them is processed and obtain a copy.
- Rectification: to correct inaccurate or incomplete data.
- Erasure: to have data deleted when it is no longer necessary, unless it must be kept to comply with a legal obligation.
- Objection: to object to processing based on legitimate interest on grounds relating to their particular situation.
- Restriction: to have data stored but not processed while a dispute about it is resolved.
- Portability: to receive, in a structured format, data provided and processed on the basis of consent or contract, or to have it sent to another controller.
- Withdrawal of consent: at any time, without affecting the lawfulness of prior processing.
To exercise them, send a request to the email address in section 1, stating the right you are exercising and attaching a copy of a document proving your identity. Requests are answered within one month, extendable by two further months where complexity requires it. Exercising these rights is free of charge.
8. Complaints to the supervisory authority
If you believe your data is not being processed in accordance with the law, or that a request to exercise your rights has not been properly handled, you may lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid — www.aepd.es), without prejudice to any other administrative or judicial remedy.
9. Minors
This website is not aimed at children under fourteen and their data is not knowingly collected. Data of minors staying with us is provided by their parents or guardians, who are responsible for its accuracy.
10. Data security
Appropriate technical and organisational measures are applied to protect personal data against loss, unauthorised access or improper processing, taking into account the state of the art and the risks of each processing activity.
11. Changes to this policy
This policy may be updated to reflect legislative changes or new processing activities. The version in force is always the one published on this page. See also the legal notice and the cookie policy.