1. Data controller
The controller is CJ PENEMAR SL (CIF B29698206), trading as Kingfisher Spain and Kingfisher Apartments. Address: Edificio Benal Beach, Avenida del Parque 1, 29630 Benalmádena Costa, Málaga, Spain. Privacy enquiries and rights requests may be sent to [email protected] or made by calling +34 952 440 659.
2. Personal data we collect
- Identity and guest-registration data: names, date and place of birth, gender, nationality, address, contact details, identity-document information, signature, relationship between guests and identity-verification material where required.
- Booking and stay data: dates, apartment, occupancy, preferences, booking reference, rate, communications, access and service records.
- Payment and security-deposit data: transaction status, payment references, card pre-authorisation status and fraud-prevention information. Full card data is normally handled by the relevant payment provider.
- Enquiry, marketing and service data: messages, consent choices, newsletter activity and support history.
- Website and consent data: IP address, device and browser information, security logs and the cookie preference stored on your device. If you choose Allow, analytics and advertising providers may also receive page-view, interaction, campaign, device and identifier data through Google Analytics, Google Ads and Meta Pixel.
3. Why we use data and our legal bases
- To answer enquiries, take and administer bookings, provide accommodation and guest services, process payments and manage access: performance of a contract or steps requested before a contract.
- To register travellers and provide information to competent authorities: compliance with Spanish legal obligations.
- To protect guests, apartments, payments and systems, prevent fraud and establish or defend claims: legitimate interests and legal obligations.
- To send essential booking, check-in and service communications: performance of the booking contract.
- To send newsletters or promotional messages: consent where required; consent can be withdrawn at any time.
- To operate necessary website functions and security: legitimate interests. With your consent, we use analytics and advertising measurement to understand website use and improve our marketing. Choosing Essentials only keeps those optional tools off.
4. Information required for a stay
Spanish accommodation providers must collect and communicate specified traveller and transaction information. If mandatory information, identity verification or the security-deposit pre-authorisation is not completed, we may be unable to complete check-in or provide access.
Data relating to children is collected from their parent, guardian or responsible adult only to manage the booking and comply with accommodation-registration duties.
5. Who receives personal data
- Booking, payment and communications providers used to administer reservations.
- Identity-verification, guest-registration, smart-access and guest-service providers used for check-in and the stay.
- BeSafe or its insurance partners when you select an insured rate or request insured assistance.
- StayNexus when you choose to use services delivered through its portal.
- Google, including Google Analytics and Google Ads, and Meta Platforms through Meta Pixel, only when you choose Allow for optional analytics and advertising.
- Hosting, IT security, email, professional advisory and support suppliers acting under appropriate obligations.
- Police, tourism, tax, courts and other public authorities where disclosure is legally required.
6. International transfers
Some service providers, including Google and Meta when optional analytics or advertising is allowed, may process information outside the European Economic Area. Where this occurs, we rely on an approved transfer mechanism or another legally recognised safeguard, such as an adequacy decision or standard contractual clauses, unless a statutory exception applies.
7. Retention
We retain data only for as long as needed for the relevant purpose and applicable legal, accounting, tax, accommodation-registration and claims periods. Unsuccessful enquiries are kept for a limited operational period. Marketing data is retained until consent is withdrawn or the contact becomes inactive, subject to a minimal suppression record where needed to respect an opt-out.
8. Your rights
Subject to the conditions in data-protection law, you may request access, rectification, erasure, restriction, portability or object to processing. You may withdraw optional cookie consent at any time through Cookie settings without affecting earlier lawful processing, and may object to direct marketing at any time.
Email [email protected] with enough information to identify your request. We may ask for proportionate proof of identity. You may complain to the Agencia Española de Protección de Datos (AEPD) if you believe your data-protection rights have not been respected.
9. Automated decisions
We do not make decisions producing legal or similarly significant effects about guests solely by automated means. Providers may use automated security or fraud signals, but material booking decisions can be reviewed by our team.
10. Security
We use organisational and technical measures intended to protect personal data against unauthorised access, loss, alteration or disclosure. No internet system is completely risk-free; please contact us promptly if you suspect that booking or access information has been compromised.
11. Third-party websites
Links to external booking, insurance, maps, social or guest-service sites are governed by those operators’ privacy notices. Please review them before providing personal data.
12. Policy updates
We may update this policy when our services, suppliers or legal obligations change. The latest version is published here with its effective date. Material changes will be highlighted where appropriate.