Privacy Policy

Data Controller

• Name: ATENEA GALAICA (Chouciña Apartments)
• Tax ID: B36512812
• Address: Lugar Carballal 10, Bordons, 36966 Sanxenxo, Pontevedra, Spain
• Contact: choucinha.apartments@gmail.com | +34 690 130 332

Data we collect

To manage your booking we collect the following personal data:

• Full name of the lead guest
• Email address and contact phone number
• Identity document number (national ID, passport or equivalent) — required under Spanish law for the traveller register (Royal Decree 933/2021)
• Payment data: processed entirely by Stripe, Inc. We do not store card numbers or banking details on our servers

Purpose of processing

• Booking management: processing, charging the deposit (20%) and guest assistance during the stay
• Transactional communications: booking confirmation, arrival instructions (sent 48 h before check-in), reminders and cancellation or refund management
• Compliance with the legal obligation to submit the traveller register to Spanish Security Forces pursuant to Royal Decree 933/2021 and Galician tourist regulations

Legal basis for processing

• Performance of contract (Art. 6(1)(b) GDPR): processing is necessary to manage and fulfil the booking requested by the user
• Legal obligation (Art. 6(1)(c) GDPR): the traveller register is mandatory under Royal Decree 933/2021 and Galician Decree 12/2017

Data processors and international transfers

• Technology service providers (data processors under Art. 28 GDPR): Stripe, Inc. — payments, USA; Resend, Inc. — transactional email, USA; Vercel, Inc. — web hosting, USA; Supabase, Inc. — database, Frankfurt servers (EU). Transfers to the USA are covered by Standard Contractual Clauses approved by the European Commission
• Spanish Security Forces: traveller register data is submitted to the competent authorities as required by Royal Decree 933/2021. Legal basis: legal obligation (Art. 6(1)(c) GDPR)

Retention period

• Booking and billing data: 4 years from the booking date, to comply with tax and accounting obligations (Spanish General Tax Law 58/2003)
• Traveller register data: 1 year from the date of registration, pursuant to Royal Decree 933/2021

Your rights

You may exercise your rights of access, rectification, erasure ('right to be forgotten'), restriction of processing, data portability and objection, as well as the right not to be subject to solely automated individual decisions, under the terms of the GDPR and the Spanish Data Protection Act (LOPDGDD).

To exercise these rights, send an email to choucinha.apartments@gmail.com stating the right you wish to exercise and attaching a copy of your identity document. We will respond within a maximum of one month.

If you consider that the processing of your data does not comply with applicable regulations, you may lodge a complaint with the Spanish Data Protection Agency (AEPD), the competent supervisory authority: www.aepd.es

Data security

• All communications between your browser and our servers are encrypted via TLS/HTTPS. We implement appropriate technical and organisational security measures in accordance with Art. 32 GDPR
• Payment data is processed exclusively by Stripe, Inc., which is PCI DSS Level 1 certified. We never store card data on our servers