1. Who we are

Bob Henzen & Sabine Romeijn, trading as Finca Hero, Bolulla (Alicante), Spain.
Postal address: [address] [TO CONFIRM]
Tax ID (NIF/NIE): [number] [TO CONFIRM]
Email: info@fincahero.es

We are the data controller for the personal data described here. We have not appointed a Data Protection Officer, as we are not required to.

2. What data we collect

• Enquiry and contact forms: name, email address, phone number, preferred dates, number of guests (adults, children), pets, and your message.
• Bookings: the above plus billing details and, where Spanish law requires, guest identity data (full name, ID/passport number, nationality, date of birth, address, relationship between guests) for the mandatory traveller registration.
• Communication: emails and messages you send us.
• Technical data: IP address, browser and device type, pages visited, collected through essential cookies and, only with your consent, analytics cookies.

We do not knowingly collect data from children under 14 except as part of a booking made by a parent or guardian.

3. Why we use it and our legal basis

4. Cookies and analytics

We use essential cookies to make the site work. We plan to use Google Analytics 4 to understand how visitors use the site; it is only activated after you accept analytics cookies, with IP data minimised. Details are in our Cookie Policy.

5. Who we share data with

• Our website host and email provider, under data processing agreements. [hosting provider name] [TO CONFIRM]
• Google (Analytics, Maps), only as described in the Cookie Policy.
• Payment provider or bank to process payments. [provider] [TO CONFIRM]
• Spanish authorities (Guardia Civil / Policía via SES.HOSPEDAJES) where the law requires it.
• Cleaning or maintenance staff only receive what they need for your stay (e.g. arrival time). [TO CONFIRM]

We never sell your data. Some providers (e.g. Google) may process data outside the EEA; such transfers rely on the EU-US Data Privacy Framework or standard contractual clauses.

6. How long we keep it

• Enquiries that do not lead to a booking: up to 12 months. [TO CONFIRM]
• Booking and invoice data: as long as tax and accounting law requires (generally 6 years in Spain).
• Traveller registration data: 3 years, as required by Spanish law.
• Analytics data: 14 months (GA4 setting).

7. Your rights

Under the GDPR and the Spanish LOPDGDD (Ley Orgánica 3/2018) you have the right to access, rectify, erase, restrict or object to processing, to data portability, and to withdraw consent at any time. Email info@fincahero.es; we reply within one month. You may also complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD), or the authority in your own EU country.

8. Security

The site uses HTTPS. We keep personal data limited to what we need and protect access with strong passwords and two-factor authentication where available.

9. Changes to this policy

We may update this policy. The date at the top shows the latest version.

This text is a practical template and not legal advice. [TO CONFIRM]