Privacy statement

What we process and why

• Requests and contact: your name, email address, phone number (if you give it), the dates you want, the number of guests and your message. We use these to answer you and prepare a quote. Legal basis: the steps needed to enter into a contract.
• Quote, booking and invoice: the same data plus the quoted amount, your acceptance and the invoice number. Legal basis: the rental agreement and our legal duty to keep invoices.
• Email: the emails we send you and your replies are kept with your request so we can look back at the conversation.
• Guest registration: for every traveller, name, sex, date of birth, nationality, document type and number, address, phone number and, for the person booking, email address and payment method. Spanish law (Real Decreto 933/2021) requires us to record these details and report them to the Ministerio del Interior. Legal basis: that legal obligation. Document numbers and payment details are stored encrypted.
• Security: to slow down abuse of the forms and the admin area, we briefly keep your IP address and email address when an attempt is made. Legal basis: our legitimate interest in protecting the site.
• Activity log: when you accept a quote or fill in the registration form, we record when this happened and from which IP address. In the admin area we log sign-in attempts and actions. Legal basis: our legitimate interest in being able to trace what happened if something goes wrong.
• Visitor statistics: only if you click Accept in the cookie notice, we use Google Analytics to see how the site is used. Legal basis: your consent, which you can withdraw at any time by clearing this site's cookies.

Who we share data with

We do not sell data. The following parties process data on our behalf or receive it because the site uses them:

• Vercel (USA): hosting of the site and storage of images. Transfer covered by the EU-US Data Privacy Framework.
• Neon: the database holding requests, bookings and registrations.
• Brevo (France): sending our emails and receiving your replies.
• Google: Google Analytics, only after you accept in the cookie notice. The video on the home page comes from YouTube; when it loads, Google receives your IP address. Transfer covered by the EU-US Data Privacy Framework.
• Open-Meteo: the weather widget fetches the temperature; your IP address is sent, nothing else.
• Ministerio del Interior (Spain): we report the guest registration there, as the law requires.

How long we keep data

• Requests without a booking and the related email: 2 years after the requested departure date, or after the request if no dates were given.
• Bookings with an invoice: 7 years after the invoice date, because of the tax retention duty.
• Guest registration: 3 years after departure, as Spanish law requires; it is then deleted automatically.
• IP and email address for security: 24 hours at most.
• Activity log, with IP address: 12 months.
• Statistics in Google Analytics: according to the Google Analytics settings.

Cookies

The site itself only sets cookies needed to work, such as your language and your cookie choice. Google Analytics sets cookies only after you click Accept. If you choose Essential only, Analytics stays off.

Your rights

You can ask us which data we hold about you, have it corrected or deleted, and object to a processing. Data we must keep by law, such as the guest registration and invoices, cannot be deleted earlier. Send your request to hola@casapollo.com; we reply within a month.

If you disagree with how we handle your data, you can complain to a supervisory authority: in Spain the Agencia Española de Protección de Datos, or the authority in your own country.

Changes

This statement was last updated on 7 September 2026. If anything changes, we update this page.