Privacy Policy

Website	Home
Accommodation name	Palmera Apartment – La Mata
Accommodation address	C/ Tiburón 7, 2º H, Torre La Mata, 03188 Torrevieja, Alicante, Spain
Tourism registration number	VT506111A
Effective from	4 June 2026

1. Data controller details

Data controller	Pálfi Sándor
Service	Booking and use of Palmera Apartment – La Mata
Accommodation address	C/ Tiburón 7, 2º H, Torre La Mata, 03188 Torrevieja, Alicante, Spain
Tourism registration number	VT506111A
Privacy contact	spalfi@netquality.hu
General website contact	info@palmeraapartment.com
Phone	+36 20 967 2658
Website	Home
Correspondence address	2013 Pomáz, Somogyi-Bacsó utca 7.

2. Purpose and scope of this notice

This notice explains which personal data the Controller processes in connection with the Palmera Apartment website, enquiries, newsletter subscriptions, bookings, stays, payments, invoicing, complaints and cookies.

This notice applies to website visitors, enquirers, newsletter subscribers, booking applicants and guests.

Marketing processing takes place only with separate consent. Booking details alone are not used for newsletters, mailings or Facebook/Meta advertising communications unless the guest has given separate prior consent.

3. Data-processing principles

We process only data necessary for communication, bookings, accommodation services, invoicing, legal obligations or consent-based marketing.
We do not sell data or use it for purposes the guest would not expect.
You may opt out of newsletters, mailings, remarketing and Facebook/Meta advertising processing, or withdraw consent, at any time.
Data required for mandatory official reporting may be sent to the competent authorities in accordance with applicable law.
We protect data through reasonable technical and organisational measures.

4. Specific processing activities

4.1 Website enquiries

Purpose	Answering enquiries and handling requests for quotations or other messages.
Data processed	Full name, email address, message content and, where supplied, phone number and other information voluntarily provided in connection with the enquiry.
Legal basis	Steps prior to entering into a contract and the legitimate interest in handling and documenting enquiries.
Retention period	Up to one year after the matter is closed, unless the correspondence leads to a booking or legal claim.
Recipients / data transfers	Hosting provider, website operator, email provider and, where necessary, persons assisting the Controller.

4.2 Booking management

Purpose	Processing booking requests, checking availability, confirmation, communication and management of guest numbers and length of stay.
Data processed	First name, surname, email, phone number, arrival and departure dates, number of guests and accommodation units, address, city, postcode, country and other booking notes.
Legal basis	Performance of a contract and steps prior to entering into a contract.
Retention period	For the period needed to fulfil the booking and subsequently to pursue civil claims. Billing and official-reporting data are retained for the applicable statutory periods.
Recipients / data transfers	Booking system, website operator, email provider and, where necessary, persons assisting with accommodation management.

4.3 Guest registration and official reporting

Purpose	Compliance with statutory guest-registration, security or tourism reporting obligations associated with use of the accommodation.
Data processed	Guest data required by law, including in particular name, birth details, nationality, address or habitual residence, travel or identity document details, arrival and departure times, signature and, for minors, legally required accompanying-person or relationship information. We request only data actually needed.
Legal basis	Compliance with a legal obligation.
Retention period	For the time needed to fulfil mandatory reporting and for the retention period required by applicable law.
Recipients / data transfers	Competent Spanish authorities, tourism or public-security registration systems and service providers assisting with their management.

4.4 Payments, advance payments, earnest-money deposits and invoicing

Purpose	Receiving payments, recording advance payments or earnest-money deposits, issuing receipts and invoices, and bookkeeping.
Data processed	Name, billing address, email, amount paid, payment method, bank account number and transaction details for bank transfers, and other invoicing data.
Legal basis	Performance of a contract and compliance with a legal obligation.
Retention period	The retention period required by accounting and tax rules. Payment correspondence not used for invoicing may be retained for the period needed to pursue civil claims.
Recipients / data transfers	Bank, payment provider, accountant, invoicing software, tax authority or other competent authority.

4.5 Newsletters and marketing communications

Purpose	Sending newsletters, mailings, offers, news, discounts and booking opportunities to people who have separately consented. With consent, data supplied for marketing may also be used for Facebook/Meta advertising, remarketing or custom audiences.
Data processed	Name, email, subscription time, consent record, unsubscribe time and basic enquiry or booking details. Facebook/Meta advertising may involve website visit events, cookie identifiers and pixel events, and, with separate consent, email or phone number for audience matching.
Legal basis	Consent, which may be withdrawn at any time without affecting the lawfulness of processing before withdrawal.
Retention period	Until consent is withdrawn or the person unsubscribes. For Facebook/Meta advertising audiences: until the audience is deleted, consent is withdrawn or the retention period configured in Meta’s advertising system expires. Minimal data needed to demonstrate unsubscription may be kept longer.
Recipients / data transfers	Newsletter system, email provider and Meta Platforms Ireland Limited / Meta Platforms, Inc. when Facebook or Instagram advertising, Meta Pixel, remarketing or custom audiences are used.

4.6 Complaints and legal claims

Purpose	Handling guest complaints, investigating service-quality concerns and bringing or defending legal claims.
Data processed	Name, contact details, booking information, complaint content, related documents, photos, payment and communication records.
Legal basis	Legal obligations and legitimate interests in handling complaints and pursuing or defending legal claims.
Retention period	After the complaint is closed, until the applicable statutory or claims limitation period expires.
Recipients / data transfers	Legal representative, accountant, insurer, competent authority or court, where necessary.

4.7 Website operation, security and logs

Purpose	Secure website operation, troubleshooting, prevention of misuse and technical administration.
Data processed	IP address, browser information, visit time, technical logs and cookie-consent preferences.
Legal basis	Legitimate interest in secure, stable website operation; consent for non-essential cookies.
Retention period	Technical logs are retained according to the hosting provider’s settings, generally for a short period. Cookie consent is retained for the validity period of the setting.
Recipients / data transfers	Hosting provider, web developer, website administration provider and cookie-management provider.

5. Processors and data transfers

The Controller may use processors in the following categories to operate the service.

Hosting and website administration	Website operation, technical logs and transmission of form data.
Booking system / WordPress plugin	Management of booking requests, guest information and dates.
Email provider	Communication, confirmations and complaints.
Newsletter system	Sending newsletters, mailings, offers and marketing emails based solely on consent.
Bank / payment provider	Processing payments of advance payments, earnest-money deposits or the final balance.
Accountant / invoicing software	Invoicing, bookkeeping and compliance with tax obligations.
Authorities	Guest registration and tourism or public-security reporting required by law.
Meta / Facebook advertising system	Consent-based management of marketing cookies, Meta Pixel, remarketing, Facebook/Instagram advertising and custom audiences.

Personal data is not sold. Transfers to third countries may occur if a service provider uses infrastructure or subcontractors outside the EU.

6. Data subject rights

The data subject may request the following from the Controller:

information on whether we process their personal data;
access to their personal data;
rectification of inaccurate data;
erasure where the legal conditions are met;
restriction of processing;
data portability, where applicable;
the right to object to processing based on legitimate interests;
withdrawal of consent at any time where processing is based on consent.

Requests to exercise rights may be submitted using the Controller’s contact details. Before fulfilling a request, the Controller may take reasonable steps to verify the applicant’s identity.

Withdrawal of consent does not affect the lawfulness of processing before withdrawal.

7. Remedies

For privacy questions or complaints, you should first contact the Controller.

Controller’s email	spalfi@netquality.hu
Website contact email	info@palmeraapartment.com
NAIH	Hungarian National Authority for Data Protection and Freedom of Information; website: https://www.naih.hu/; email: ugyfelszolgalat@naih.hu; address: 1055 Budapest, Falk Miksa utca 9-11.
Spanish data protection authority	AEPD – Agencia Española de Protección de Datos. For data-processing matters in Spain, the data subject may also lodge a complaint with the Spanish data protection authority.

8. Cookie notice

A cookie is a small data file that a website may place in a visitor’s browser. Cookies may ensure website operation, remember preferences, measure statistics or display marketing advertisements.

The website uses a cookie-consent management panel. Non-essential cookies, such as analytics and advertising cookies, may be used only with the visitor’s consent.

Essential cookies	These are required for basic website functions, such as security, sessions or consent preferences. They generally cannot be disabled on the website because it would not work correctly without them.
Functional cookies	These may support convenience features, such as remembering settings or enabling external tools. Consent is required unless they are strictly necessary.
Analytics cookies	These may provide visitor and usage statistics and are used only with consent. Analytics can help improve the website and booking process.
Advertising cookies	These may be used for personalised Facebook/Meta and other online advertisements, remarketing or advertising audiences based on previous visits, interests or consent-based marketing data. They are used only with separate consent.

8.1 Cookies for newsletters, mailings and Facebook/Meta advertising

With separate consent, Palmera Apartment may use newsletter and mailing-list data to send offers, news, discounts and booking opportunities. Such data may include name, email, the fact and time of consent and basic enquiry or booking details.

For Facebook/Meta advertising, the website may measure visitor events using Meta Pixel or another advertising tracking code and, with consent, create remarketing or custom audiences. This may help visitors see Palmera Apartment offers on Facebook, Instagram or Meta’s advertising network.

Email addresses or phone numbers may be used for Facebook/Meta audience matching only with the data subject’s separate consent. Consent can be withdrawn at any time, and non-essential cookies can be rejected or changed in the cookie panel.

Visitors can accept, reject or change non-essential cookies in the cookie panel. Cookies can also be deleted or blocked in browser settings, although this may limit some website functions.