Privacy policy

1. Identity of the data controller

The controller of the personal data collected through the Nura Stays website and its associated services is:

• Trading name: Nura Stays
• Owner: Marcos Bolufer Cardona
• Tax ID (NIF/CIF): 53218523-L
• Address: C/ Forn 17, 2 — 03730 Xàbia/Jávea (Alicante), España
• Tourism licences (EGVT): Villa La Renda [PENDIENTE: nº EGVT Villa La Renda] · Casa Calma [PENDIENTE: nº EGVT Casa Calma]
• Data protection contact: partners@nurastays.com
• Contact phone: +34 658 026 219

2. Information we collect

To deliver our specialised asset management and hospitality services, we process the following categories of data:

• Owners (asset management): full name, contact details, property address, ownership documentation and financial data relating to rental history or performance, in order to carry out profitability audits.
• Guests (travellers): full name, ID card or passport details (mandatory for the Spanish traveller register), email, phone number and payment data.
• Website users: IP address, browser type and browsing behaviour collected through cookies to optimise the digital experience.

3. Legal bases and purposes of processing

In accordance with Article 6 GDPR, we process data on the basis of:

1. Performance of a contract (Art. 6.1.b): to manage holiday bookings and fulfil property management agreements with owners.
2. Compliance with legal obligations (Art. 6.1.c): in particular, reporting guest data to the Spanish State security forces under the traveller registration rules.
3. Consent of the data subject (Art. 6.1.a): to send our downloadable guide and commercial communications about our asset management services.
4. Legitimate interest (Art. 6.1.f): to carry out profitability audits and keep our digital platforms secure.

4. Data retention periods

• Traveller data (mandatory register): 3 years from the end of the stay.
• Tax and invoicing data: 6 years, under Article 30 of the Spanish Commercial Code.
• Owner contract data: the term of the management agreement plus the statutory limitation periods.
• Leads and marketing: until you withdraw consent or ask to be removed.

5. Recipients and processors

Your data may be handled by providers required for our activity, acting as processors under an Article 28 GDPR agreement: [PENDIENTE: listado de encargados del tratamiento (PMS, pasarela de pago, plataformas, analítica)]. We also report traveller data to the Spanish State security forces where the law requires it. Data is not disclosed to third parties for other purposes without your consent, unless legally required.

6. International data transfers

Some of our technology providers (for example, distribution and analytics platforms) may be located outside the European Economic Area. In those cases we ensure appropriate safeguards are in place, such as the standard contractual clauses approved by the European Commission.

7. Your rights (access, rectification, erasure, objection, portability and restriction)

You may exercise your rights of access, rectification, erasure, objection, portability and restriction of processing by writing to partners@nurastays.com or calling +34 658 026 219. Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out beforehand. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es if you believe the processing does not comply with the applicable rules.

8. Security measures

We apply appropriate technical and organisational measures to guarantee the confidentiality, integrity and availability of the personal data we process, and we review our internal procedures regularly.