Privacy policy

Who is responsible

The data controller is [NAME OR COMPANY OF THE OWNER], tax ID [TAX ID], address [ADDRESS], email [CONTACT EMAIL].

What data we process

Your booking details supplied by your host (Cubos Homes or another property manager): accommodation, dates, number of guests, language and, if available, your name, email and phone.

Data you give us when ordering a service: email, phone, notes and special requests. Allergies are health data: we only process them if you give your explicit consent by writing them, and only so the provider can serve you safely.

Payment data is handled by Stripe. We never see or store your card number.

Why and legal basis

To manage, charge and confirm your order and to email you: performance of the contract (GDPR art. 6.1.b).

To pass the provider what is needed to serve you, including allergies you mention: contract and, for health data, your consent (art. 9.2.a).

To meet tax and accounting duties: legal obligation (art. 6.1.c).

To prevent fraud and keep the service secure: legitimate interest (art. 6.1.f).

Who receives your data

The provider delivering the service (they receive your contact details only once they accept your order) and your property manager (Cubos Homes), who sees their guests' orders.

Technology providers acting on our behalf: Hetzner (hosting, Finland, EU), Cloudflare (network and security), Stripe (payments) and Resend (email). Some may process data outside the European Economic Area under GDPR safeguards.

How long we keep it

We delete your name, email, phone, notes and special requests 12 months after your departure. We keep amounts and invoices for as long as tax law requires.

Your rights

You can access, correct, delete, object to, restrict and port your data by writing to [CONTACT EMAIL]. If you think we mishandle your data you may complain to the Spanish Data Protection Agency (aepd.es).