Privacy Policy

Last updated: August 2026

This Privacy Policy explains how Orsolya Horváth, operating as The Estepona Collection ("we", "us", "our"), collects, uses, and protects your personal data when you visit our website or make a booking with us. We are committed to protecting your privacy in accordance with the General Data Protection Regulation (GDPR) and Spanish data protection law.

1. Who We Are

The Estepona Collection is a private short-term rental operation managed by Orsolya Horváth, based in Estepona, Málaga, Spain. For any privacy-related matters, you can contact us at theesteponacollection@gmail.com.

2. What Data We Collect

We collect the following personal data when you make a booking or enquiry:

• First and last name
• Email address
• Number of guests
• Arrival and departure dates
• Payment information (processed securely by Stripe — we do not store card details)
• Any additional information you provide when contacting us

We also collect standard technical data when you visit our website, including IP address, browser type, and pages visited, via cookies and analytics tools.

3. How We Use Your Data

We use your personal data to:

• Process and confirm your booking
• Send you pre-arrival information and check-in instructions
• Communicate with you before, during, and after your stay
• Comply with legal obligations (including tourist registration requirements under Spanish law)
• Improve our website and services

We do not sell your personal data to third parties or use it for unsolicited marketing.

4. Legal Basis for Processing

We process your data on the following legal grounds:

• Contract performance — processing is necessary to fulfil your booking
• Legal obligation — we are required by Spanish law to register guest details with local authorities
• Legitimate interests — improving our service and communicating with past guests
• Consent — where you have explicitly agreed, for example to receive future offers

5. Third Parties We Share Data With

We share your data only where necessary:

• Stripe — payment processing (their privacy policy applies to payment data)
• Smoobu — booking and channel management software
• Resend — transactional email delivery
• Spanish authorities — as required by law for tourist registration

All third-party processors are GDPR-compliant.

6. How Long We Keep Your Data

We retain booking data for a minimum of 5 years to comply with Spanish tax and legal requirements. After this period, data is securely deleted.

7. Your Rights

Under GDPR, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data (where no legal obligation requires us to retain it)
• Object to or restrict certain processing
• Data portability
• Lodge a complaint with the Spanish Data Protection Authority (AEPD) at www.aepd.es

To exercise any of these rights, contact us at theesteponacollection@gmail.com.

8. Cookies

Our website uses essential cookies to function correctly. We may also use analytics cookies to understand how visitors use our site. You can manage cookie preferences via our Cookie Policy.

9. Security

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. Payment data is handled exclusively by Stripe using industry-standard encryption.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The date at the top of this page indicates when it was last revised. Continued use of our website constitutes acceptance of any changes.

11. Contact

For any privacy-related questions or to exercise your rights, please contact us at theesteponacollection@gmail.com.