Privacy Policy

1. Data controller

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (hereinafter, the "GDPR"), and with Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD), users are informed that the controller of their personal data is:

• Controller: Ricardo Luri Bolinski
• Spanish tax number (NIF): 48668172B
• Address: Av. Juan Carlos I, 50, 03710 Calpe, Alicante, Spain
• Email: ambarbeachcalpe@gmail.com
• Telephone: +34 633 748 333

2. Personal data we collect

Depending on the purpose for which they are processed, the personal data we may collect are the following:

• Identification data: first name and surname, national ID/NIE/passport, nationality, date of birth.
• Contact data: postal address, email address, telephone number.
• Booking data: check-in and check-out dates, number of people who will occupy the property, stay preferences, method of payment.
• Data relating to the letting agreement: the tenant's habitual residence, nationality, the stated temporary purpose and any other data required to formalise the seasonal letting agreement (Art. 3 LAU).
• Browsing data: IP address, browser type, pages visited and data derived from cookies (see our Cookie Policy).

3. Purposes of the processing

The personal data provided by the user will be processed for the following purposes:

a) Managing the booking and formalising the seasonal letting agreement

To manage the booking request, formalise the seasonal letting agreement (Art. 3 LAU), process payment of the rent and the deposit, confirm the dates and give the tenant the information needed to collect and return the keys.

b) Compliance with tax and commercial obligations

To issue the corresponding invoices or receipts, declare income from property and comply with all other accounting and tax obligations applicable to the landlord.

c) Marketing communications (subject to consent)

To send offers, promotions and news about Ámbar Beach by email, only where the user has given express consent by ticking the relevant box during the booking process.

d) Handling enquiries and requests

To handle enquiries, requests or complaints made by the user through the available contact channels (email, telephone, WhatsApp or web form).

4. Legal basis for the processing

In accordance with Article 6 of the GDPR, the legal basis for processing personal data is as follows:

• Art. 6.1(b) GDPR — Performance of a contract: the processing is necessary to manage the booking and formalise the seasonal letting agreement (Art. 3 LAU) requested by the user.
• Art. 6.1(c) GDPR — Compliance with a legal obligation: the processing is necessary to comply with the accounting, tax and commercial obligations applicable to the landlord.
• Art. 6.1(a) GDPR — Consent of the data subject: for sending marketing communications, the processing is based on the user's freely given, specific, informed and unambiguous consent, which may be withdrawn at any time.
• Art. 6.1(f) GDPR — Legitimate interest: for handling enquiries and improving the service offered through the Website.

5. Data retention periods

Personal data will be retained for the following periods:

• Contractual and invoicing data: retained for 5 years from the end of the agreement, in compliance with the tax and commercial obligations in force (Spanish General Tax Act, Commercial Code).
• Data relating to the electronic signature of the agreement: retained for 6 years from signature, as contractual evidence under Article 1964 of the Spanish Civil Code.
• Marketing communication data: retained until the user withdraws consent or requests erasure of their data.
• Enquiry data: retained for as long as necessary to deal with the enquiry and, thereafter, for the statutory limitation periods applicable to any resulting liability.

Once those periods have elapsed, the data will be erased or, where applicable, blocked in accordance with the applicable legislation.

6. Recipients of the data

Personal data may be disclosed to the following recipients:

• Tax authorities: in compliance with the applicable tax obligations.
• Banks: solely to process the payments associated with the booking.
• Service providers: technology suppliers acting as processors (web hosting, email) with whom the corresponding data processing agreements have been signed in accordance with Article 28 of the GDPR.

No international transfers of data to countries outside the European Economic Area will take place, unless strictly necessary and subject to appropriate safeguards under Chapter V of the GDPR.

7. Rights of the data subject

In accordance with Articles 15 to 22 of the GDPR and Articles 12 to 18 of the LOPDGDD, users may exercise the following rights in relation to their personal data:

• Right of access (Art. 15 GDPR): to obtain confirmation as to whether their personal data are being processed and, if so, to access them.
• Right to rectification (Art. 16 GDPR): to request the correction of inaccurate or incomplete data.
• Right to erasure (Art. 17 GDPR): to request the deletion of their personal data where, among other reasons, the data are no longer necessary for the purposes for which they were collected.
• Right to restriction of processing (Art. 18 GDPR): to request the restriction of the processing of their data in certain circumstances.
• Right to data portability (Art. 20 GDPR): to receive the personal data provided in a structured, commonly used and machine-readable format, and to transmit them to another controller.
• Right to object (Art. 21 GDPR): to object to the processing of their personal data in certain circumstances, including profiling.
• Right not to be subject to automated decisions (Art. 22 GDPR): not to be subject to a decision based solely on automated processing which produces legal effects or significantly affects them.
• Right to withdraw consent: where the processing is based on consent, the user may withdraw it at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise any of these rights, users may contact the data controller through:

• Email: ambarbeachcalpe@gmail.com
• Postal mail: Av. Juan Carlos I, 50, 03710 Calpe, Alicante, Spain

The request must include the data subject's first name and surname, a copy of their identity document (national ID, NIE or passport) and a clear description of the right they wish to exercise. The controller will reply within a maximum of one month from receipt of the request.

8. Right to lodge a complaint with the supervisory authority

If users consider that the processing of their personal data infringes the legislation in force, they have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD):

• Website: www.aepd.es
• Postal address: C/ Jorge Juan, 6, 28001 Madrid, Spain
• Telephone: 901 100 099
  +34 91 266 35 17

9. Security measures

The data controller has adopted appropriate technical and organisational measures to ensure a level of security appropriate to the risk of the processing, in accordance with Article 32 of the GDPR. Those measures include:

• Encryption of communications using the HTTPS/TLS protocol.
• Restricted access control to personal data.
• Regular backups of the information.
• Periodic review and updating of the security measures implemented.
• Training and awareness for staff with access to personal data.

10. Changes to the Privacy Policy

The controller reserves the right to amend this Privacy Policy in order to adapt it to legislative or case-law developments or to business practice. Any amendment will be published on the Website. Users are advised to review this page periodically.

Last updated: May 2026.