Legal
Privacy policy
Last updated: 15 October 2026
Discretion is the heart of our service, and it applies to your data too. This policy explains, in plain language, what personal data we collect, why, who sees it and what rights you have under the EU General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD), and, for guests in the United Kingdom, the UK GDPR.
1. Who is responsible for your data
- Data controller
- [legal name of the business — to be completed], trading as Alba Zas
- Tax ID (NIF/CIF)
- [NIF / CIF — to be completed]
- Address
- [registered address — to be completed]
- Privacy contact
- alba@albazas.com
2. What we collect
- What you tell us in a request: your name and email address, a phone number if you give one, what you write about your stay, and, if you tell us, the name of the person who introduced you.
- What you share while we arrange a stay: details needed to deliver the services you ask for, such as travel times, guest names and preferences.
- Health details, only once a stay is planned: please leave them out of the request form. Dietary requirements or allergies can reveal health information; we ask for them privately, use them only to keep you safe and well looked after, and only with your explicit consent, which you can withdraw at any time.
- Technical data: when you visit the website, our hosting provider processes your IP address and basic request information to deliver pages and protect the service. The photographs are fetched by our own servers, so your browser does not connect to any other company to show them. We do not run analytics, advertising or tracking on this website, and it sets no cookies.
If someone introduced you, we hold their name only to know how you came to us; we tell them nothing about your request. We do not knowingly collect data from anyone under 18. Our services are intended for adults.
3. Why we use it, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Reading and answering your request, and holding the private call | Steps you ask us to take before a contract (Art. 6(1)(b)) |
| Planning, booking and delivering the services you choose | Performance of our contract with you (Art. 6(1)(b)) |
| Noting who introduced you | Our legitimate interest in knowing how guests come to us, as the house works by introduction (Art. 6(1)(f)) |
| Using dietary or health information you share | Your explicit consent (Art. 9(2)(a)) |
| Keeping invoices and records required by law | Legal obligation (Art. 6(1)(c)) |
| Keeping the website secure and working | Our legitimate interest in a safe, reliable service (Art. 6(1)(f)) |
Your name and an email address are needed for us to reply; everything else is optional. We never sell your data, never use it for advertising, and never publish guest names, images or itineraries. We do not send newsletters or marketing by email; should that ever change, we would ask you first, separately, with a box left unticked. We do not make decisions about you by automated means alone.
4. Who receives it
- Providers of the services you ask for, such as villa owners, yacht and aviation operators, drivers and restaurants, receive only what they need to deliver that service, and only when you ask us to arrange it.
- Our technical providers, acting on our instructions under a data processing agreement: website hosting and content delivery, and delivering the request form to our inbox (Cloudflare), and the company that hosts that inbox: [the provider that hosts our mailbox — to be completed]. They may not use your data for their own purposes.
- WhatsApp, only if you choose to write to us there; WhatsApp (Meta) then handles your messages under its own terms.
- Authorities, only when the law requires it.
Some technical providers are based outside the European Economic Area, for example in the United States. Where data leaves the EEA, it is protected by an adequacy decision (such as the EU–US Data Privacy Framework) or by the European Commission’s standard contractual clauses.
5. How long we keep it
- Requests that do not lead to a stay: [how long unanswered requests are kept — to be completed], then deleted.
- Guest records: for as long as you remain a guest or member, then for as long as the law requires us to keep them (for example, accounting records must generally be kept for six years under the Spanish Commercial Code).
- Dietary and health details: only for the stay they relate to, unless you ask us to remember them.
6. Your rights
You can ask us at any time to access, correct or delete your data, to restrict or object to how we use it, or to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time without affecting what was done before. Write to alba@albazas.com; we will reply within one month. If we need to confirm who you are, we will ask for no more than that requires.
If you believe we have not handled your data properly, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos), to the authority in your country of residence or, in the United Kingdom, to the Information Commissioner’s Office.
7. Security
Your data is shared with as few people as possible, sent over encrypted connections, and kept only with providers bound by confidentiality. We are glad to sign your own non-disclosure agreement.
8. Changes to this policy
If we change how we use personal data, we will update this page and its date. Significant changes will be communicated to guests directly.