Data controller: Juan Manuel Márquez Gil
Spanish tax ID: 25599308-D
Address: Calle Molino de Alarcón s/n, 29400 Ronda (Málaga), España
Email: spa@casadelhammam.com
Phone: +34 627 59 68 47
What data we process and why
We only process the data you provide. We do not buy databases or obtain your data from third parties.
Gift voucher purchases
- Data: first and last name, billing address, email address and telephone number.
- Purpose: to manage your order, issue and send your voucher, keep accounts and provide after-sales service.
- Legal basis: performance of the sales contract (Article 6(1)(b) GDPR) and compliance with legal tax and accounting obligations (Article 6(1)(c)).
- Retention: for the duration of the business relationship and subsequently for the statutory limitation periods, which are up to six years for tax and commercial matters.
Enquiries and bookings by email or telephone
- Data: the information you include in your message or provide during the call, usually your name, contact details and reason for the enquiry.
- Purpose: to respond to your request and manage the booking.
- Legal basis: your consent and steps taken at your request before entering into a contract.
- Retention: for the time needed to handle your request and, if it does not lead to a purchase, for a maximum of one year.
Website browsing
- Data: your IP address and technical browsing data needed to operate and protect the website.
- Purpose: to operate the website, maintain your shopping basket and ensure protection against attacks.
- Legal basis: our legitimate interest in keeping the website operational and secure.
Sources of visits that lead to purchases
- Data: the page or search engine from which you reached our website.
- Purpose: to understand in aggregate how customers find us and improve our online presence.
- Legal basis: your consent, which we request through the cookie notice on your first visit. If you do not consent, this information is not collected and the rest of the website works normally.
- Retention: 6 months.
We do not make automated decisions
We do not carry out profiling or make automated decisions that could affect you.
We do not send advertising
We do not currently send marketing messages or newsletters. If we wish to do so in future, we will ask for your express consent, which you may withdraw at any time.
Who else accesses your data
Your data is not disclosed to third parties unless required by law. The following necessary service providers do have access, always under a data processing agreement:
- The web hosting provider, which hosts the website and its database.
- The bank and Redsys payment gateway, to process card payments. We never have access to your card details: you enter them directly in the bank’s secure environment.
- The email service provider, to deliver your order notifications and voucher.
- The tax and accounting adviser, for invoicing purposes.
International transfers
We do not transfer data internationally outside the European Economic Area.
All fonts and resources on this website are served from our own server, so browsing does not disclose your IP address to external providers.
Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time, and withdraw any consent you have given.
To do so, write to spa@casadelhammam.com or the postal address above, identifying yourself appropriately and stating which right you wish to exercise. We will reply within one month.
If you believe we have not handled your request correctly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es), C/ Jorge Juan 6, 28001 Madrid.
Security
We apply the technical and organisational measures needed to protect your data. The website uses an encrypted connection (HTTPS) and safeguards against unauthorised access.