Legal

Privacy Policy

Last updated 13 September 2026

Who controls your data

Giovanni Orfeo Reinaldo Zebeda, trading as Casa Cabopino Retreat, is the controller for personal data described in this policy unless another service identifies itself as an independent controller.

Data we collect

  • Identity and contact data, including names, postal address, email address, telephone number, nationality, date of birth and identification-document details where required by law.
  • Booking and stay data, including dates, guest numbers, preferences, correspondence, signed agreements, arrival information, incidents and complaints.
  • Transaction data, including amounts, payment status, refunds and limited payment-method information. Payment providers process full payment credentials under their own terms.
  • Technical and usage data, such as IP address, device and browser information, consent choices, security logs and website interactions.
  • Information about additional travellers supplied by the lead guest. The lead guest must be authorised to provide it and should direct those travellers to this policy.

When you request a stay, we ask who is travelling and the date of birth of the lead guest. We use this only to confirm that the retreat suits your stay and that the lead guest is 21 or over. Requests that don’t lead to a booking are deleted within six months.

Why we use personal data

  • To answer enquiries, prepare quotes, administer bookings, take payment, provide the stay, communicate service information and handle changes, refunds or disputes. The legal basis is taking steps at your request and performing the accommodation contract.
  • To comply with tax, accounting, tourism, consumer, guest-registration and public-security obligations, including communications through SES.HOSPEDAJES. The legal basis is compliance with legal obligations.
  • To protect guests, the property, our systems and legal rights, prevent fraud, manage incidents and establish or defend claims. The legal basis is our legitimate interests and, where applicable, legal obligations.
  • To measure and improve the website using non-essential analytics only after valid consent. You may withdraw that consent through Manage Cookie Preferences.
  • To send marketing where you have consented or where another lawful basis applies. Every marketing message will provide a simple way to opt out. Service messages about an existing booking are not marketing.

Who receives personal data

We disclose data only where necessary to the following categories of recipient:

  • OwnerRez and connected booking or communication services used to administer reservations and agreements.
  • PayPal or another disclosed payment provider used for the transaction.
  • TouchStay, where used to deliver the private digital guest guide.
  • Our authorised local host and service providers, where access is needed for check-in, guest support, maintenance, cleaning, safety or incident handling.
  • mijn.host, which provides the website hosting and the email service for our contact address.
  • Complianz, the cookie-consent service used on this website.
  • Booking platforms where a reservation originates through that platform.
  • Spanish police, SES.HOSPEDAJES, tourism, tax, courts or other authorities where disclosure is legally required.
  • Professional advisers, accountants, insurers and claims or fraud specialists where necessary and lawful.

International transfers

Some technology or payment providers may process data outside the European Economic Area. Where required, transfers must rely on an adequacy decision, approved contractual safeguards or another lawful transfer mechanism. Provider-specific information should be available in the privacy notices linked at the point where that service is used.

How long we keep data

We keep personal data only for as long as needed for the purpose collected and for applicable limitation, tax, accounting, tourism, consumer and public-security periods. Guest-registration records subject to Real Decreto 933/2021 are retained for three years from the end of the service where that retention duty applies. Booking, payment and contract records may be retained longer where needed to meet statutory obligations or establish or defend legal claims. Data based solely on consent is deleted or anonymised when consent is withdrawn unless another lawful reason requires retention.

Your rights

Depending on the circumstances, you may request access, correction, deletion, restriction, portability or objection, and may withdraw consent at any time. Contact info@casacabopinoretreat.com and provide enough information to identify the relevant record. We may request proportionate proof of identity. You may also complain to the Agencia Española de Protección de Datos at https://www.aepd.es/.

Security and required data

We use proportionate organisational and technical measures and limit access to people who need the data. Some information is required to enter into or perform a booking or to comply with Spanish guest-registration law. If required data is not provided, we may be unable to accept the booking or provide accommodation. Guests should not send passport scans through ordinary email or WhatsApp unless we specifically provide and authorise a secure process.

Children and policy updates

The booking must be made by an adult. Data about minors is processed only as needed for the stay, safety and legal guest-registration duties. We may update this policy when services or legal requirements change. The current version and update date will remain available on this page.