Privacy policy

1. Data controller

BEMIRMA S.L., owner of Apartamentos ELMA1 · Tax ID B60335387 · C/ Calatrava 25, sótano, 08017 Barcelona (España) · Phone +34 609 37 86 46 · Email [email protected]. No Data Protection Officer has been appointed as the conditions of Article 37 GDPR do not apply; for any privacy matter, please contact the email address above.

2. Applicable law

Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD) and implementing legislation.

3. Purposes, legal basis and retention

• Responding to enquiries and requests (contact form, phone, email): legitimate interest of the controller in replying to those who make contact (art. 6.1.f GDPR). Retention: up to 1 year from the last communication, unless it leads to a booking.
• Managing the booking and the stay: performance of a contract or pre-contractual measures (art. 6.1.b GDPR). Retention: for the duration of the contract and thereafter, blocked, for the limitation periods of liability (generally up to 6 years for commercial obligations and 4–5 years for tax purposes).
• Complying with the obligation to keep records of and report traveller data to the competent authorities (Spanish Royal Decree 933/2021 and public-security legislation): compliance with a legal obligation (art. 6.1.c GDPR). Retention: 3 years, as required by that rule.
• Complying with tax, accounting and invoicing obligations: legal obligation (art. 6.1.c GDPR). Retention: the legally required periods.
• Sending marketing about the controller's own similar services to customers: legitimate interest (art. 21.2 LSSI); you may object at any time and in each communication.

4. Data processed and its source

Identification and contact data, booking and stay data (dates, occupants, preferences), ID-document data of occupants required by hospitality rules, and payment data processed directly by the payment gateway provider. Data comes from the data subject or, where the booking is made through third-party platforms (e.g. online travel agencies), from those platforms.

5. Whether data must be provided

Data marked as mandatory in the forms and data required for traveller registration are necessary to manage the booking and comply with legal obligations; failure to provide it will prevent the booking from being made or maintained.

6. Recipients and international transfers

• Competent public authorities and law-enforcement bodies, in compliance with the obligation to report hospitality data.
• Tax authorities and banks, to comply with legal obligations and manage payments.
• Providers delivering services to the controller (booking engine and channel manager, payment gateway, web hosting, communication and analytics tools), acting as processors under an Article 28 GDPR agreement.
• No international data transfers are envisaged; should any provider involve them, they would be made under an adequacy decision or appropriate safeguards (standard contractual clauses) under Chapter V GDPR.

7. Automated decisions

No automated decisions are made and no profiling with legal or significant effects on the user is carried out.

8. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction of processing, portability and not to be subject to automated decisions, and withdraw any consent given, by writing to BEMIRMA S.L., C/ Calatrava 25, sótano, 08017 Barcelona (España), or to [email protected], stating the right you wish to exercise and enclosing a copy of an identity document. If you believe the processing does not comply with the law, you may lodge a complaint with the Spanish Data Protection Agency (https://www.aepd.es).

9. Security measures and minors

The controller applies appropriate technical and organisational measures under Articles 24, 25 and 32 GDPR. Persons providing data through the website declare that they are over 14; registering minors below that age requires the consent of their parents or guardians.

Last updated: September 2026. The Spanish version prevails.