Privacy policy

At Nalah we process your personal data for one purpose only: to answer your enquiry. This page explains what we collect, why, for how long and how you stay in control, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018.

1. Data controller

2. What we collect

Only what you give us voluntarily through the contact form or by email. We do not buy lists, we do not obtain data from third parties and we do not profile anyone.

Data	Required	Purpose
Name	Yes	To address you
Email	Yes	To reply to you
Phone	No	Alternative contact, if you prefer
Check-in and check-out dates	No	To check availability
Number of adults and children	No	To assess the fit with the house
Type of stay and message	No	To prepare a useful answer

3. Why we use it and on what legal basis

• To answer your enquiry and handle a possible booking. Legal basis: your explicit consent when ticking the form checkbox (Art. 6.1.a GDPR) and pre-contractual measures taken at your request (Art. 6.1.b GDPR).
• To meet legal obligations arising from a confirmed booking, where applicable (Art. 6.1.c GDPR).

We will not send you marketing or newsletters, and we will not use your data for any purpose other than the one that prompted your enquiry.

4. How long we keep it

• If your enquiry does not lead to a booking: up to 12 months from the last contact, then deleted.
• If it leads to a booking: for the stay and the applicable statutory tax and accounting retention periods (6 years).
• You can ask us to delete it sooner at any time.

5. Who else can access your data

We do not sell or share your data. We do use service providers acting as processors, all of them with servers inside the European Union:

• Hostinger International Ltd. — website hosting.
• Our own infrastructure on a European server — receiving the form and storing the enquiry in our contacts database.
• OVH Hispano S.L.U. — mail server for the internal new-enquiry notification.

No international data transfers outside the European Economic Area take place.

6. Automated decisions

We make no automated decisions and build no profiles. Every enquiry is read and answered by a person.

7. Your rights

You may exercise the following rights at any time, free of charge:

• Access — find out what data of yours we hold.
• Rectification — correct inaccurate data.
• Erasure — ask us to delete it.
• Objection and restriction of processing.
• Portability — receive it in a structured format.
• Withdraw your consent at any time, without affecting the lawfulness of prior processing.

If you believe your request was not handled properly, you may lodge a complaint with the Spanish Data Protection Agency: www.aepd.es.

8. Security

The site is served entirely over HTTPS. The form exposes no credentials in the browser: the request is validated and stored server-side. Access to the contacts database is restricted and authenticated.

9. Changes to this policy

If we amend this policy we will publish the updated version here, with the date of the change shown in the page header.