Privacy policy

1. Data controller

• Controller: Bantour Sun Spain, S.L.
• CIF (tax ID): B54728811
• Address: Calle Cuba 8, 03530 La Nucía (Alicante), Spain
• Email for data protection matters: reservas@apart-benidorm.es
• Phone: +34 671 89 30 96

This policy explains how we process the personal data of visitors to the website apart-benidorm.es and of the customers and guests of Apartamentos Anfiteatro, in accordance with Regulation (EU) 2016/679 (GDPR) and Ley Orgánica 3/2018 (LOPDGDD, the Spanish Data Protection Act).

2. What data we process

• Booking data: first name and surname, email address, telephone number, country, language, expected arrival time, number of adults and children, dates, apartment, price and any message the Customer sends us.
• Guest registration data: the data required by law for each guest (first name and surname, type and number of identity document, date of birth, nationality, address and other mandatory data).
• Payment data: amount, date, method and status of the payment and the Stripe transaction reference. We do not store the details of bank cards or other payment methods.
• Communications: the messages we exchange by email, telephone or WhatsApp.
• Technical data: IP address, date and time of the booking and technical server logs, which are necessary for the security of the website and the prevention of abuse.
• Browsing data: statistical data obtained through Google Analytics, as described in the Cookie policy.

3. Why we process them and on what legal basis

• Managing the booking and the stay (confirmation, communication with the Customer, handover of the apartment, payment, changes and cancellations). Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
• Guest registration and reporting to the authorities, as well as accounting and tax obligations. Legal basis: compliance with legal obligations (Art. 6(1)(c) GDPR; Real Decreto 933/2021).
• Handling enquiries and complaints. Legal basis: performance of the contract or pre-contractual measures taken at the request of the data subject.
• Website security and fraud prevention (for example, attempt limits and technical logs). Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Website usage statistics. Legal basis: as described in the Cookie policy.

We do not use the data to send advertising, nor do we create profiles for commercial purposes.

4. Mandatory data

The data marked as mandatory in the booking form and the guest registration data are required. Without them we cannot complete the booking or accommodate the guests.

5. To whom we disclose the data

• Authorities: guest registration data are reported to the Ministry of the Interior (Ministerio del Interior) and to the law enforcement agencies (Fuerzas y Cuerpos de Seguridad), as required by law.
• Providers acting on our behalf (data processors): online guest registration service, email provider, and technical and website hosting services. They only access the data necessary to provide their service and are obliged to protect them.
• Owner of the apartments, who provides the accommodation service and on whose behalf we manage the bookings: receives the booking and guest data necessary to provide the accommodation and to comply with their legal obligations.
• Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland): processes payments and refunds. It receives the name, email address, amount and payment method details. For fraud prevention and compliance with its legal obligations, Stripe also acts as an independent controller, in accordance with its own privacy policy.
• Booking.com: to prevent double bookings, calendar availability is synchronised with Booking.com. Only the occupied dates are transmitted, without any personal data of the guests.
• Google: browsing data for statistical purposes, in accordance with the Cookie policy.

We do not sell or transfer personal data to third parties for any other purpose.

6. International transfers

The website and the booking system run on our own servers located in Spain. The use of Google Analytics and Stripe may involve data transfers to the United States; Google LLC and Stripe, Inc. participate in the EU-U.S. Data Privacy Framework and apply the safeguards provided for in the GDPR.

7. Retention periods

• Booking data: for the duration of the contractual relationship and, thereafter, for the limitation periods of any possible claims.
• Guest registration data: three years, in accordance with Real Decreto 933/2021.
• Accounting and tax records: the periods established by commercial and tax legislation.
• Bookings started but not paid: deleted automatically after 30 days.
• Technical security logs: the reasonable time necessary to ensure security, normally no more than 60 days.

8. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability by writing to reservas@apart-benidorm.es, stating which right you wish to exercise. We may ask you to verify your identity.

If you consider that we have not handled your request properly, you may lodge a complaint with the Agencia Española de Protección de Datos (www.aepd.es), the Spanish data protection authority.

9. Security

We apply appropriate technical and organisational measures: encrypted connection (HTTPS), restricted access to the booking system with a password and two-factor authentication, encrypted backups and access control to the server.

10. Changes to this policy

We may update this policy to adapt it to legal or operational changes. The version in force is always the one published on this page.