1. Data controller

• Controller: Mateos & Föhrenbach S.L. (Casasol Holiday)
• Tax ID (NIF): B93304418
• Address: Calle Los Huertos 78, 29780 Nerja (Málaga), Spain
• Phone: +34 952 52 6248
• Email: info@nerjaholidayrentals.com

This policy explains how we process the personal data of guests, people who contact us, subscribers and property owners, in accordance with Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 on Data Protection and Guarantee of Digital Rights (LOPDGDD) and Spanish Law 34/2002 on Information Society Services (LSSI-CE).

2. What data we process and where it comes from

We obtain your data directly from you, through our website, forms, email, phone or WhatsApp, or from the online booking platform (OTA) you booked through, such as Booking.com, Airbnb or others.

Category	Data
Identification and contact	Full name, email, phone, address, country
Booking and stay	Property, dates, number of guests, special requests, communications
Guest registration	Type and number of identity document, nationality, date of birth, relationship to minors and any other data required by Royal Decree 933/2021, for all guests
Payment and deposit	Transaction and payment method details (bank transfer, card or PayPal) and security deposit details. Full card details are processed directly by the payment provider, not by Casasol
Browsing	IP address and website usage data, as described in our Cookie Policy
Property owners	Contact, identification, tax and bank details, and details of the managed property

We do not process special categories of data, unless you voluntarily provide information needed for your stay (for example, accessibility needs).

3. Why we use your data, on what legal basis and for how long

Purpose	Legal basis	Retention period
Managing your booking, stay, payments and guest support	Performance of a contract (Art. 6.1.b GDPR)	For the duration of the relationship and then the limitation period for legal claims (up to 5 years)
Managing the security deposit	Performance of a contract	Until the deposit is settled and then the limitation period for legal claims
Guest registration and reporting to the Spanish Ministry of the Interior	Legal obligation (Art. 6.1.c GDPR; Royal Decree 933/2021)	3 years
Invoicing, accounting and tax obligations	Legal obligation	6 years (Spanish Commercial Code)
Answering enquiries and quote requests	Consent when you contact us and pre-contractual steps	Up to 1 year from the last communication
Sending offers on similar properties to previous guests	Legitimate interest (Art. 21.2 LSSI-CE)	Until you unsubscribe; you can object in every email
Sending the newsletter to subscribers	Consent	Until you unsubscribe
Managing our relationship with property owners	Performance of a contract and legal obligations	For the duration of the contract and the applicable legal periods afterwards
Web analytics and advertising through cookies	Consent	As set out in the Cookie Policy

We do not make automated decisions with legal effects on you. Where processing is based on consent, you may withdraw it at any time, without affecting prior processing.

4. Who we share your data with

We do not sell your data. We only share it in the following cases:

• Public authorities, where required by law: the Spanish Ministry of the Interior and law enforcement (guest registration), the Spanish Tax Agency and the courts.
• The property owner, to the extent necessary for the rental, as Casasol acts as an intermediary.
• Online booking platforms (OTAs), such as Booking.com, Airbnb or others, when the booking is made through them. Each platform processes data as a controller under its own privacy policy.
• Payment providers: banks and card terminals for card payments and bank transfers, and PayPal when you choose this method. PayPal processes data as a controller under its own policy.
• Swikly, the platform we use to manage the security deposit. One week before your arrival you will receive a link to complete it.
• Service providers processing data on our behalf (processors), under contracts that guarantee confidentiality and security: booking management software (Avantio), web hosting, email tools, tax and accounting advisers, and analytics and advertising services (Google, Meta) subject to your cookie consent.

5. International transfers

Some providers, such as Google, Meta or PayPal, may process data outside the European Economic Area, mainly in the United States. In those cases, the transfer is covered by the EU-US Data Privacy Framework or by the Standard Contractual Clauses approved by the European Commission.

6. Your rights

You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, and withdraw your consent.

To do so, write to info@nerjaholidayrentals.com or to Calle Los Huertos 78, 29780 Nerja (Málaga), Spain, stating which right you wish to exercise. We will only ask for proof of identity if we have reasonable doubts about who you are. We will reply within one month.

If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

7. Security, minors and changes to this policy

Security. We apply appropriate technical and organisational measures to protect your data, such as SSL encryption on our website and restricted access to information. If a security breach occurs that poses a high risk to your rights, we will inform you without undue delay.

Minors. Only persons aged 14 or over may consent to the processing of their data (Art. 7 LOPDGDD). You must be of legal age to make a booking. Data of minors staying in our properties is processed solely to comply with guest registration requirements.

Changes. We may update this policy due to legal changes or changes in our services. The current version will always be published on this page and, if the changes are significant, we will let you know.

Last updated:2026.