Privacy & GDPR Policy

The data controller responsible for the processing of personal data on casaalmar.eu is:

At Casaalmar, your privacy is safeguarded by strict engineering principles. All Personally Identifiable Information (PII) including guest names, emails, telephone numbers, and passport identifiers collected during direct reservations or inquiry processing are encrypted at rest in our databases using authenticated AES-256-GCM (Advanced Encryption Standard with Galois/Counter Mode).

Encryption keys are isolated from the database and maintained exclusively in secure server environment variables.

We process personal information under the following legal bases:

• Contractual Performance (Art. 6.1.b GDPR): Processing guest names, contact details, stay dates, and guest headcounts to execute direct holiday rental bookings and concierge arrangements.
• Legal Obligation (Art. 6.1.c GDPR & Spanish Citizen Security Organic Law 4/2015): Mandatory collection of traveler identification documents (Parte de Entrada de Viajeros) submitted to Spanish National Police / Guardia Civil traveler registers (SES.HOSPEDAJES).
• Legitimate Interest (Art. 6.1.f GDPR): Preventing fraudulent bookings, bot abuse via Cloudflare Turnstile token validation, and securing server infrastructure.

Personal booking records are retained only for as long as legally required for tax compliance (Hacienda, 4 years) and Spanish police registry requirements (3 years). Inquiries that do not convert to a booking are automatically purged or anonymized after 180 days.

Under the General Data Protection Regulation, you have full enforceable rights:

To exercise any of these rights, email our Data Protection team at privacy@casaalmar.eu. You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos - AEPD) at www.aepd.es.