Skip to main content

Privacy policy

Last updated: 5 Nov 2026

Data controller

  • Controller: Joel Kobjoll (Alzahra Homes) (tax ID X2504506J), as manager of the homes
  • Address: Avenida Málaga 57, 29400 Ronda (Málaga), España
  • Email for privacy matters: [email protected]

Your booking and check-in details are also shared with the owner of the home you stay in, as far as the owner needs them to provide the accommodation.

What we collect, why and on what legal basis

Bookings and guest account

First name, last name, email, phone, country, dates, number of guests, pets, special requests and language. We use them to manage your booking, create your guest account (which you sign in to with a link or password), send your confirmation and look after you before, during and after your stay. Legal basis: performance of the accommodation contract (Art. 6(1)(b) GDPR).

During your stay we also handle what you ask for from your guest area (early arrival, late check-out, a cot, extending the stay or cancelling). When you sign in, we keep your IP address and browser with your session for security, and delete them when the session expires (after 30 days at most).

Bookings made on other platforms

If you book through Airbnb, Booking.com or another platform, it passes us (through Lodgify) your name, dates, number of guests and the contact details it shares with us. We send you a link through that platform to check in online on this website. Legal basis: performance of the accommodation contract (Art. 6(1)(b) GDPR) and, for traveller registration, legal obligation (Art. 6(1)(c) GDPR).

Messages and booking chat

If you write to us from your booking's chat, by email or on WhatsApp, we keep the messages with your booking in our booking system (Lodgify) so we can help you, and we email you when we reply. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

Payments and security deposit

Payments and deposits are processed by Stripe. We never see or store your full card number; we only receive the payment reference, amount and status and, for the deposit, a reference to the card saved at Stripe so the hold can stay in place until we have checked the home. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our accounting and tax obligations (Art. 6(1)(c) GDPR).

Online check-in and traveller registration (SES.Hospedajes)

Spanish law requires tourist accommodation to register every traveller and pass their details to the Ministry of the Interior (Organic Law 4/2015 on public safety and Royal Decree 933/2021). For each guest we therefore ask for: first and last names, sex, date of birth, nationality, type and number of identity document (and support number for a Spanish DNI or NIE), home address, phone and email, and, for minors, their relationship to the main guest. Legal basis: legal obligation (Art. 6(1)(c) GDPR). Without these details we cannot hand over the home.

We store these details encrypted and only the people who handle arrivals can see them. They are sent to the Ministry of the Interior through the SES.Hospedajes account of the home concerned.

Before you arrive we may ask the lead guest, by WhatsApp, for a photo of the identity document entered in the online check-in, solely to check that it matches the traveller registration details. Legal basis: legal obligation (Art. 6(1)(c) GDPR). The photo is never stored in our systems and we delete it as soon as the check is done.

If you use your camera to read your document, the image is processed only on your device to fill in the form: it is never sent to our servers or stored.

House rules

During the online check-in, the lead guest accepts the home's house rules. We keep a record of that acceptance: the lead guest's name, email, booking, date and time, IP address, browser, language and the exact text of the rules accepted, and we email them a copy. We use it to show which rules were accepted if there are complaints from neighbours or the community, damage to the home or a claim about the deposit. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in defending our rights and the owner's (Art. 6(1)(f) GDPR).

Travellers saved in your profile

If you choose to, we keep your contact details and those of your companions encrypted in your profile so you don't have to type them again at your next check-in. Legal basis: your consent (Art. 6(1)(a) GDPR). You can delete them from your profile at any time; if unused for 3 years, they are deleted automatically.

Reviews

After your stay we email you an invitation to review the home. If you write a review and give your consent, we publish it with the name you choose to show, your rating and the month of your stay. We may also show reviews you left for the home on other channels (such as Airbnb), with the name shown there. You can withdraw your consent at any time and we will remove it. Legal basis: your consent (Art. 6(1)(a) GDPR) and, for the invitation, our legitimate interest in hearing about your experience as a customer (Art. 6(1)(f) GDPR); you can object by replying to the email.

Contact form

Name, email, phone if you give it, topic and message, so we can reply. Legal basis: your request and any pre-contractual steps you ask for (Art. 6(1)(b) GDPR) or our legitimate interest in answering you (Art. 6(1)(f) GDPR).

Website security

When you browse, technical data such as your IP address is processed to prevent abuse (for example, limiting repeated booking or contact attempts) and protect the site. Legal basis: legitimate interest in security (Art. 6(1)(f) GDPR).

Visit statistics

To learn which pages are useful and improve the site, we count visits with Umami, an open-source tool installed on our own server: this data is not sent to any third party. It uses no cookies and stores nothing on your device. We record the page visited (without parameters or booking numbers), the site you came from, language, screen size, browser, operating system and device type, country, how long the page takes to load and respond on your device (loading times, nothing you type), and a few actions without your details (searching dates, starting or completing a payment, completing check-in, sending the contact form or tapping the WhatsApp button, with facts such as the home, the nights or the amount). Your IP address is only used at that moment to work out the country and an anonymous identifier that changes every month; it is not stored. So the statistics cannot identify you. They are deleted automatically after 25 months. If your browser sends the "Global Privacy Control" or "Do Not Track" signal, we do not count your visits. Legal basis: legitimate interest in knowing, in aggregate, how the site is used (Art. 6(1)(f) GDPR).

We make no automated decisions or profiles that affect you, and we do not use your data for advertising.

How long we keep it

  • Booking and payment data: for as long as our relationship lasts and then 6 years, to meet accounting and tax obligations (Spanish Commercial Code and General Tax Law).
  • Traveller registration data: 3 years after the end of the stay, as required by Royal Decree 933/2021, then deleted automatically.
  • House rules acceptance record: as long as the traveller registration data for the stay (3 years after it ends), to deal with complaints or claims, and deleted with it. If the booking is cancelled, it is deleted straight away.
  • Guest account: until you ask us to delete it, subject to the periods above.
  • Travellers saved in your profile: until you delete them, or at most 3 years without use.
  • Session data (IP address and browser): until the session expires, at most 30 days.
  • Reviews: while they are published or until you withdraw your consent.
  • Visit statistics: 25 months; then they are deleted automatically.
  • Contact messages: as long as needed to reply and at most 12 months, unless they lead to a booking.

Who we share it with

  • The owner of the home: the details needed to provide the accommodation.
  • Spanish Ministry of the Interior (SES.Hospedajes): traveller registration data, as required by law.
  • Tax authorities, courts and police: when the law requires it.

And these providers, who process data on our behalf under contracts that oblige them to protect it:

  • Lodgify (booking management and calendar software).
  • Stripe Payments Europe, Ltd. (Ireland), for payments and deposits. Stripe also processes some data as an independent controller to prevent fraud and comply with financial regulations.
  • Resend (transactional emails).
  • Cloudflare (content delivery and site protection). Its Turnstile service runs an invisible check on the contact, booking and sign-in forms to tell people from bots, using technical data from your browser and your IP address.
  • IONOS SE (Germany), server hosting the site and database, in a data centre in Spain.
  • WhatsApp Ireland Limited (end-to-end encrypted messaging), if you write to us on WhatsApp or we ask you there for the photo of your document.

Some providers (such as Resend and Cloudflare) may process data in the United States. Such transfers rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

Your rights

You can ask us for access, rectification, erasure, objection, restriction of processing and portability of your data, and withdraw your consent at any time, by writing to [email protected]. We will reply within one month. Please note we cannot delete early any data the law requires us to keep.

From your guest area you can download a copy of your data and delete what you have saved at any time.

If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es) or the data protection authority where you live.

Children

Only people aged 18 or over can book. Details of travelling minors are collected through the responsible adult, solely for traveller registration.

Security

We use encrypted connections (HTTPS), encrypt check-in identity data, restrict staff access and only work with providers that offer adequate safeguards.

Changes

If we change this policy, we will show a new date at the top. See also our cookie policy.