Privacy & Data Protection

Last updated: November 2026

This Privacy Policy explains how Sun & Palms ("we", "us") collects, uses and protects your personal data when you visit our website, contact us or stay in one of our apartments in Riviera del Sol, Mijas Costa (Spain). We process personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Spanish Organic Law 3/2018 on Personal Data Protection and guarantee of digital rights (LOPDGDD).

 

1. Who is responsible for your data (data controller)

Controller: Sun & Palms

Address: C. Orfebres, 29649 Mijas, Spain

Email: sunandpalms.spain@gmail.com

Phone / WhatsApp: +34 634 78 71 81

 

2. What data we collect

• Booking data: name, email address, phone number, country, arrival and departure dates, number of guests and any special requests.

• Payment data: payments are processed securely by our payment provider (Stripe). We never see or store your full card details.

• Guest registration data: Spanish law requires us to register every guest aged 14 or over before check-in (name, ID or passport number, nationality, date of birth, address and other data required by law). This is collected through our online check-in service.

• Communication data: messages you send us by email, WhatsApp, phone or through booking platforms.

• Website data: technical data such as IP address, browser type and pages visited, collected through cookies and similar technologies (see section 9).

 

3. Why we use your data and our legal basis

• Managing your booking, payment, check-in and stay – performance of a contract (GDPR art. 6.1.b).

• Registering guests and sending the data to the Spanish authorities (Ministry of the Interior, SES.HOSPEDAJES) as required by Royal Decree 933/2021 – legal obligation (art. 6.1.c).

• Keeping invoices and accounting records – legal obligation (art. 6.1.c).

• Answering your questions and messages – pre-contractual steps and legitimate interest (art. 6.1.b and 6.1.f).

• Sending you offers, e.g. returning-guest discounts, by email – your consent (art. 6.1.a), which you can withdraw at any time.

• Keeping our website secure and working – legitimate interest (art. 6.1.f).

• Non-essential cookies (analytics, marketing) – your consent (art. 6.1.a).

We do not use your data for automated decision-making or profiling.

 

4. Who we share your data with

We only share your data when necessary, with:

• Spanish authorities: guest registration data is sent to the Ministry of the Interior (SES.HOSPEDAJES) as required by law.

• Service providers acting on our behalf (data processors): our property management and booking system (Smoobu), online guest registration (Chekin), payment provider (Stripe), website hosting (Wix) and email services. These providers only process your data on our instructions and under data processing agreements.

• Booking platforms: if you book through Airbnb, Booking.com or Vrbo, that platform also processes your data under its own privacy policy.

• Tax authorities, courts or police when we are legally required to do so.

We never sell your personal data.

 

5. International transfers

Some of our service providers may process data outside the European Economic Area (for example in the United States). In those cases, transfers are protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.

 

6. How long we keep your data

• Guest registration data: 3 years from the end of your stay, as required by Royal Decree 933/2021.

• Booking, invoicing and accounting data: for as long as required by Spanish tax and commercial law (generally up to 6 years).

• Messages and enquiries that do not lead to a booking: up to 12 months.

• Marketing data: until you unsubscribe or withdraw your consent.

After these periods, your data is securely deleted or anonymised.

 

7. Your rights

You have the right to access your personal data, correct inaccurate data, request deletion, restrict or object to certain processing, receive your data in a portable format, and withdraw your consent at any time without affecting earlier processing.

To exercise your rights, email sunandpalms.spain@gmail.com. We may ask you to confirm your identity and will reply within one month.

If you believe we have not handled your data correctly, you can file a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).

 

8. Security

We use appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access. We will never ask for card or payment details by WhatsApp, SMS or phone.

 

9. Cookies

Our website uses cookies that are necessary for it to work. With your consent, we may also use analytics and marketing cookies. You can accept, reject or change your cookie preferences at any time through the cookie banner on our website or in your browser settings.

 

10. Children

Our services are not aimed at children. Data about minors is only processed when they stay with a parent or guardian and the law requires it (for example guest registration).

 

11. Changes to this policy

We may update this Privacy Policy from time to time. The latest version is always available on this page, with the date of the last update at the top.

 

12. Contact

If you have questions about this Privacy Policy or your personal data, please contact us at sunandpalms.spain@gmail.com or +34 634 78 71 81 (WhatsApp).