Legal Notice & Privacy Policy

1. General Information

We process personal data (e.g., name, contact details, payment info) primarily to fulfill the rental agreement (Art. 6(1)(b) GDPR) and to comply with legal obligations (Art. 6(1)(c) GDPR).

2. Website Hosting & Booking Software

The public website is delivered via Cloudflare Pages (Cloudflare, Inc.). The separate booking system at amara.lodgify.com is provided by Lodgify (Codebay Solutions Ltd.). The providers process the technical data required to operate their respective services.

3. Payment Processing (Stripe & PayPal)

For payments, we use Stripe and PayPal. These providers act as independent Data Controllers for financial transactions and fraud prevention.

Third-Country Transfer: Usage includes the transfer of data to third countries (e.g., USA). This is secured by Standard Contractual Clauses (SCCs) and/or the EU-US Data Privacy Framework.

4. Contact by Email or Phone

When you contact us by email or phone, we process the details you provide in order to respond. Legal basis: Art. 6(1)(b) (pre-contractual measures) and Art. 6(1)(f) (legitimate interest) GDPR.

5. Legal Obligations & Guest Registration (Chekin)

Obligation: Under Spanish law (Real Decreto 933/2021), we are required to report guest data (including ID details) to the Ministry of the Interior (Ses.Hospedajes) within 24 hours of arrival.

Service Used: To fulfill this obligation and automate the check-in process, we use Chekin (Chekin Soluciones Digitales S.L.). Chekin acts as a Data Processor (Art. 28 GDPR), securely scanning ID documents and transmitting the required data to authorities.

6. Cookies & Google Analytics

We use Google Analytics 4 (GA4), a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, on our public website. Google Analytics helps us understand how our website is used, how visitors reach AMARA, and which content and booking paths are used. This may include page views, session and interaction data, the AMARA language edition used, approximate location information, and browser and device information.

Google Analytics is activated on our website only after you have given your consent. The legal basis is Art. 6(1)(a) GDPR together with the applicable rules on non-essential cookies. If you do not consent, the website, including links to our booking system, remains available. You may change or withdraw your choice at any time through the cookie settings with effect for the future.

After consent, Google Analytics may use first-party cookies including _ga to distinguish users and _ga_<container-id> to maintain session state. Google specifies a default lifetime of up to two years for these cookies, although browser restrictions or our configuration may shorten this period. User- and event-level data in our Google Analytics property is retained for 14 months.

Google may technically process an IP address during data collection, including to derive approximate geographical information. For users in the European Economic Area, Google states that the IP address is discarded before it is logged. Data may also be processed outside the European Economic Area in connection with the provision of Google Analytics. Depending on the processing involved, Google refers to safeguards including the EU-US Data Privacy Framework and Standard Contractual Clauses.

Our separately hosted booking system at amara.lodgify.com is provided by Lodgify and uses its own cookie and consent mechanism. If you accept analytics cookies there, Lodgify's native Google Analytics integration may send usage and booking events to the same AMARA Google Analytics property. Consent on the AMARA website and consent within the Lodgify booking environment are technically managed separately.

The trailer on our Verano Azul filming-locations page is embedded from YouTube (Google Ireland Limited) and is loaded only after you explicitly start it. Our internal guest guide also retrieves weather information from Open-Meteo. The privacy information described or linked in this section applies to these services.

7. AMARA Guest Guide access

Confirmed guests may open AMARA Experience by entering the booking holder’s first name and the arrival and departure dates. We compare these details server-side with the reservation held by Lodgify in order to provide the booked stay service (Art. 6(1)(b) GDPR). A successful check creates a necessary, encrypted, HttpOnly session cookie that contains no readable personal data and expires no later than the end of the departure day. The protected guide does not load Google Analytics. Access is checked again periodically and ends when the reservation is no longer confirmed, the stay period ends, or the guest closes the guide.

8. Your Rights

Subject to the applicable legal requirements, you have the right to access, rectification, erasure, restriction of processing, data portability and objection. Where processing is based on your consent, you may withdraw that consent at any time with effect for the future, without affecting the lawfulness of processing carried out before the withdrawal. You also have the right to lodge a complaint with a competent data protection supervisory authority, in particular the Spanish Data Protection Agency (Agencia Española de Protección de Datos – AEPD).

• Privacy Contact hola@amara-lodging.es