Your data.
Clearly explained.
This policy explains what personal information may be processed when you visit San Blas Stay, ask about availability or contact us, why it is used and what rights you have.
Who is responsible for your data?
The data controller for personal information processed through sanblasstay.com is Sergio Miguel Mora, NIF 48351755M, Avenida Doctor Rico 6, 03005 Alicante, Spain.
For privacy questions or to exercise your rights, contact hello@sanblasstay.com.
No Data Protection Officer has been appointed because the current nature and scale of the processing carried out through this website do not require one.
What data may be processed?
Depending on how you use the website, the following categories of personal data may be processed:
- Identification and contact data, such as your name, email address, telephone number or WhatsApp number.
- Information about your requested stay, such as arrival and departure dates, number of guests, reason for the temporary stay and any message you choose to provide.
- Communications you send by email, WhatsApp or other contact channels.
- Technical and security information generated when accessing the website, such as IP address, device, browser, basic server logs and related technical data.
- Analytics, advertising or cookie-related information when you have consented to the relevant non-essential technologies.
- Records of your cookie and privacy preferences where necessary to remember or demonstrate your choices.
Why is your data used?
To respond to your dates, questions and accommodation enquiry.
To provide conditions, price and the information needed before a possible agreement.
If a stay is agreed, to manage communications, documentation and obligations connected with it.
To maintain technical security, prevent abuse and diagnose operational problems.
With consent, to measure visits and understand how the website is used, for example through Google Analytics.
If advertising tools are added, they will be activated only where the relevant consent or other lawful basis applies.
What is the legal basis?
The legal basis depends on the activity:
- Steps requested before entering into a contract: when you ask about dates, price or conditions for a possible stay, processing may be necessary to take steps at your request before a possible agreement.
- Performance of a contract: if a stay is later agreed, processing may be necessary to manage that contractual relationship.
- Legal obligations: certain information may need to be processed or retained where Spanish or EU law requires it.
- Legitimate interests: limited technical processing may be carried out where necessary to secure, maintain and protect the website, provided those interests do not override your rights.
- Consent: non-essential analytics, advertising technologies and any optional marketing activity that requires consent will only be used after an appropriate choice by the user.
You may withdraw consent at any time for processing that relies on consent. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
How the availability form works
The current availability form on sanblasstay.com is designed to prepare a WhatsApp enquiry. When you complete the form, the information is used in your browser to generate a pre-filled WhatsApp message.
The website does not currently operate an independent booking database or payment system through that form. The enquiry reaches San Blas Stay when you choose to send the prepared message through WhatsApp.
Once you use WhatsApp, that service processes information under its own terms and privacy arrangements.
Analytics, advertising and cookies
San Blas Stay intends to use Google Analytics and may use other measurement or advertising technologies in the future. These technologies can involve identifiers, device information, browsing behaviour and other online data.
Non-essential analytics or advertising technologies that require consent should not be activated before you make the relevant choice through the cookie consent system. You should be able to accept or reject non-essential categories and change your preferences later.
Detailed information about the technologies actually enabled, their providers, purposes and retention periods will be maintained in the Cookie Policy.
Who may receive your data?
Personal data is not sold. Information may be accessible to service providers only where this is necessary for the operation of the website, communications, analytics, security or a requested stay.
Depending on the services you choose or consent to, recipients or categories of recipients may include:
- website hosting, maintenance and technical service providers;
- email and communications providers;
- WhatsApp / Meta when you choose to communicate through WhatsApp;
- Google or other analytics providers where the relevant analytics consent has been given;
- advertising platforms if such services are added and lawfully enabled;
- professional advisers where reasonably necessary;
- public authorities, courts or law-enforcement bodies where disclosure is required by applicable law.
International data transfers
Some third-party technology or communications providers may process personal data outside the European Economic Area or make data accessible from other countries.
Where an international transfer is subject to the GDPR, it should rely on a valid transfer mechanism such as an applicable adequacy decision, standard contractual clauses or another safeguard recognised by data-protection law. The relevant provider’s documentation may provide additional information about the mechanism it uses.
How long is information kept?
Personal data is kept only for as long as reasonably necessary for the purpose for which it was collected and, where applicable, for the periods needed to comply with legal obligations or deal with possible claims.
- Unsuccessful or general accommodation enquiries are normally deleted or anonymised when they are no longer useful, generally within 12 months after the last meaningful contact, unless a longer period is justified.
- If a stay is agreed, relevant contractual, communication and legally required records may be kept for the duration of the relationship and afterwards for applicable legal limitation or record-keeping periods.
- Technical security logs are kept only for a proportionate period appropriate to security and troubleshooting.
- Analytics and cookie-related retention depends on the technology and the preference selected by the user; details will be stated in the Cookie Policy or consent tool.
Your privacy rights
Under applicable data-protection law, you may have the following rights depending on the circumstances:
To exercise a right, email hello@sanblasstay.com. Please identify the right you wish to exercise and provide enough information to verify your identity and locate the relevant data.
You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos — AEPD) if you believe your personal data has been processed contrary to applicable law.
Automated decisions and profiling
San Blas Stay does not currently make decisions about accommodation requests solely by automated means in a way that produces legal or similarly significant effects for the user.
Analytics and advertising tools may create statistical segments or online measurement information when enabled, but they are not used by San Blas Stay to make an automatically binding decision on whether a stay is accepted.
Children and family stays
The property may be suitable for family stays, but the website’s enquiry and contact channels are intended to be used by adults. Minors should not independently send personal information through the website.
If information about a minor becomes necessary in connection with a confirmed stay or a legal requirement, it should be provided by the appropriate parent, guardian or authorised adult and only to the extent necessary.
Security
Reasonable technical and organisational measures are used to protect personal information against accidental loss, unauthorised access, alteration or disclosure, taking into account the nature and scale of the processing.
No internet service can guarantee absolute security. Users should also protect their own devices, accounts and communications, and avoid sending unnecessary confidential information through public contact channels.
Changes to this Privacy Policy
This policy may be updated when the website, the services, the technologies used or the applicable legal requirements change. The current version will always be published on this page.
Last updated: 26 August 2026.