1. Data controller
In accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Law 3/2018 of 5 December on Personal Data Protection and the Guarantee of Digital Rights, the data controller is identified as follows: E.V.A. INCOMING SERVICES, S.L. Tax identification number (NIF): B01651777. Registered office: C/ El Remolino s/n, Urbanización Valdearenas, 14970 Iznájar (Córdoba), Spain. Establishment: Casa Baños de la Villa. Tourism classification: Superior Category Rural House. Andalusian Tourism Register number: CR/CO/00236. Address: C/ Real, 63, 14800 Priego de Córdoba (Córdoba), Spain. Telephone: +34 957 547 274. Email: tuhistoria@casabanosdelavilla.com. Website: https://casabanosdelavilla.com.
2. Personal data we may process
Depending on users' relationship with Casa Baños de la Villa, we may process the following categories: identification data, such as first and last names; contact details, such as telephone number and email address; information needed to manage a booking, purchase or information request; billing information needed to issue an invoice; information relating to communications with Casa Baños de la Villa; and technical and browsing data arising from website use, as described in the Cookie Policy. When payment is made through a payment gateway or virtual point-of-sale system, bank or card details are processed through the relevant payment service provider and its secure systems. Casa Baños de la Villa does not store complete payment card details.
3. Purposes of processing
Personal data may be processed for the following purposes: Enquiries and requests: managing enquiries, information requests and communications made by telephone, email, WhatsApp or other available contact channels. Booking and service management: managing requests, bookings, changes and cancellations relating to accommodation, Arab baths, massages, gift vouchers, experiences and other services offered by Casa Baños de la Villa. Provision of contracted services: managing the booked stay or service, contacting customers when necessary and meeting needs arising from the contractual relationship. Payments and billing: managing payments for contracted services, issuing invoices and complying with administrative, tax and accounting obligations. Customer service and complaints: dealing with post-purchase enquiries, incidents, requests and complaints. Website security and operation: ensuring the website's proper operation, maintenance and security and preventing fraudulent or unlawful use. Personal data will not be used for purposes incompatible with those for which it was collected.
4. Legal basis for processing
The legal basis depends on the purpose for which the data is used: performance of a contract or steps taken at the data subject's request before entering into a contract, where data is necessary to manage a service enquiry, booking or purchase; compliance with legal obligations, where processing is needed to fulfil tax, accounting, administrative, tourism or other legally enforceable obligations; and the data subject's consent, where processing depends on express authorisation, as may apply to certain optional features or processing activities. Where processing is based on consent, consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.
5. Source of data
Personal data is generally obtained directly from the person concerned when they make an enquiry or booking, purchase a service or contact Casa Baños de la Villa. Data may also be received from travel agencies, tour operators, booking platforms or other intermediaries when customers book through those channels. In such cases, only data necessary to manage the booking and properly provide the contracted service will be processed.
6. Recipients and service providers
Personal data will not be sold or disclosed to third parties for commercial purposes. To provide certain services, providers acting on behalf of E.V.A. INCOMING SERVICES, S.L. may access the data, including website hosting and maintenance providers; email and IT providers; booking engines and management platforms; payment system providers and financial institutions; technology providers needed to deliver services; and professional advisers where necessary. These providers may process data only in accordance with the controller's instructions and applicable data protection law. Data may also be disclosed to public administrations, authorities, courts or other bodies where legally required. Where using a technology provider involves an international data transfer, the safeguards required by European data protection law will be applied.
7. Retention periods
Personal data will be retained for as long as necessary to fulfil the purpose for which it was collected. Data relating to bookings, purchases, payments and billing will be retained throughout the customer relationship and subsequently for the periods required by tax, commercial and other applicable legislation. Data relating to enquiries or requests that do not result in a purchase will be retained for the time needed to address them and subsequently for a period reasonably necessary to address potential liabilities. After the relevant periods, data will be deleted or appropriately blocked where required by law.
8. Data subjects' rights
Data subjects may exercise the rights recognised by data protection law, particularly: Access: finding out which personal data is being processed. Rectification: requesting correction of inaccurate or incomplete data. Erasure: requesting deletion where legal requirements are met. Objection: objecting to processing in certain circumstances. Restriction: requesting that processing be restricted in cases provided for by law. Portability: receiving data in a structured format and transmitting it to another controller where applicable. Withdrawal of consent: withdrawing previously given consent at any time. To exercise these rights, contact: E.V.A. INCOMING SERVICES, S.L., Casa Baños de la Villa, C/ Real, 63, 14800 Priego de Córdoba (Córdoba). Email: tuhistoria@casabanosdelavilla.com. Requests must sufficiently establish the identity of the person concerned and specify the right they wish to exercise. If you consider that processing of your personal data does not comply with applicable law, you may lodge a complaint with the Spanish Data Protection Agency (AEPD).
9. Data security
E.V.A. INCOMING SERVICES, S.L. will apply appropriate technical and organisational measures to ensure a suitable level of security and protect personal data against unauthorised access, loss, alteration, disclosure or destruction. Providers involved in processing must also apply the security measures required of them.
10. Data supplied about other people
Anyone providing personal data about another person, for example to manage a joint booking, declares that they have sufficient legal grounds to do so and undertakes to inform that person of the disclosure and of this Privacy Policy.
11. Changes to the Privacy Policy
E.V.A. INCOMING SERVICES, S.L. may update this Privacy Policy where necessary due to regulatory changes, changes in the services provided or the introduction of new features or providers.