Privacy policy

In accordance with Article 13 of the General Data Protection Regulation (Regulation EU 2016/679) and Spanish Organic Law 3/2018, this page explains how we handle the personal data collected through this website.

1. Who the data controller is

• Controller: PUB DADA, S.L. (tax ID B20538112), trading as Apartamentos Dada.
• Address: Balea Kalea, 4 bajo, 20800 Zarautz (Gipuzkoa), Spain.
• Email: info@apartamentosdada.com
• Telephone: +34 688 72 38 41

No data protection officer has been appointed, as none of the circumstances set out in Article 37 of the Regulation applies.

2. What data we collect

When you make a booking: first name and surnames, country, telephone, email address, postal address (street, town, postcode and province), number of guests split into adults and minors, the dates and apartment chosen, optional services, and any notes you wish to add. The identity document is optional on the form: if you do not provide it, it is requested on arrival.

If you book on behalf of someone else, we also collect the first name, surname and email address of the person who will be staying.

When you use the contact form: name, email address and the content of your message.

In both cases: the language you are browsing in and the IP address the form was sent from.

We do not collect any payment data. This website does not take payments: they are handled by the agency through its own means, outside this site.

3. What we use it for, and on what legal basis

Purpose	Legal basis
Managing your booking and your stay: confirming it, sending you the email with the price and payment methods, arranging the key handover and dealing with any issues	Performance of the accommodation contract and pre-contractual steps at your request
Answering the enquiries you send through the contact form	Your consent, or pre-contractual steps if you are asking about a booking
Sending you information about offers and news	Your consent, given by voluntarily ticking the relevant box on the form. You can withdraw it at any time
Preventing fake or automated bookings: we store the IP address and limit the number of bookings and messages per hour	Legitimate interest in protecting the availability of the calendar. Booking is free of charge, and without this measure anyone could block it
Complying with tax, accounting and guest registration obligations	Legal obligation

No automated decisions are taken and no profiling is carried out with your data.

4. Who we share it with

With the agency that manages the stay: EGONA ZARAUTZ, S.L. (tax ID B-75137778), C/ Iturribidea 6 bajo, 20800 Zarautz (Gipuzkoa). It receives your booking data because it handles payment, key handover, the deposit, the guest register and any issues. It has its own privacy policy for what it does on its own account.

With the competent authorities, where required by the guest registration rules (Royal Decree 933/2021) or any other legal obligation.

In addition, the following act as data processors, each under its own contract:

• Cloudflare — website hosting and form processing.
• Supabase — the database where bookings and messages are stored (project hosted in the Ireland region).
• Google — an internal spreadsheet that each booking is copied to for day-to-day work.
• Resend — sending emails (project hosted in the Ireland region).
• IONOS — domain and email accounts.

Beyond this, we do not sell, transfer or exchange your data with anyone.

Where your data is stored. The database holding bookings and messages, and the sending of emails, are hosted in the European Union (Ireland region). Cloudflare and Google are US providers and may process data outside the European Economic Area; where that happens, the transfer relies on the safeguards in Chapter V of the Regulation (the EU-US Data Privacy Framework and standard contractual clauses).

5. How long we keep it

• Booking data: for the duration of the stay and afterwards, for as long as liabilities may arise from the contract. Documents with tax and accounting relevance are kept for the periods set by law, between four and six years.
• Contact form enquiries: one year from the last communication, unless they lead to a booking.
• Data used to send you commercial information: until you withdraw your consent or ask us to stop writing to you.
• IP address: only as long as needed to detect abuse, and in no case longer than twelve months.

6. Your rights

You may exercise your rights of access, rectification, erasure, restriction of processing, objection and portability, and withdraw any consent you have given at any time, without affecting the lawfulness of processing carried out beforehand.

To do so, write to info@apartamentosdada.com attaching a copy of your identity document, or to the postal address given in section 1.

If you believe your request has not been dealt with properly, you may lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan, 6, 28001 Madrid, www.aepd.es).

7. Security

We apply the technical and organisational measures needed to protect your data. In particular, the database is not accessible from the browser: only the server writes to it, using credentials that never leave it, and personal data is only viewed from the administration panel by the people who manage the bookings. All communication with this website is encrypted.

8. Cookies

This website does not use cookies. It also carries no analytics tools, tracking pixels or social media buttons that track your visit, and it stores nothing in your browser. That is why you will not see a cookie banner: there is nothing to consent to.

9. Minors

This website is not aimed at minors. You must be of legal age and have the capacity to enter into a contract in order to book. The data of any minors staying at the apartment is provided by the adult making the booking, under their responsibility.

10. Changes to this policy

This policy may be updated if the website’s services or the applicable legislation change. The date of the last review appears at the top of the page.