This site presents the apartment, has an enquiry form and links out to an external booking service. There are no user accounts. Apart from an enquiry you send yourself, the only data we may process is anonymous visit statistics, and only if you agree to it.
1. Data controller
The data controller is the owner of the Gold & Gris apartment, Intempo Sky Resort, Av. de Mejico 7, 03502 Benidorm, Spain. Contact: [email protected].
2. What data we process and why
Visit statistics (Google Analytics 4) - only after you click "Accept" in the cookie notice. Google Analytics collects anonymised traffic information: country, device and browser type, referral source, pages viewed, time on site and clicks on the booking link. Google truncates the IP address before storing it. We do not link this data to your identity and do not use it for advertising or profiling. Legal basis: your consent (Art. 6(1)(a) GDPR, Art. 22.2 of Spanish Law 34/2002, LSSI). If you click "Reject", Google Analytics does not run at all.
Server logs (Cloudflare) - our hosting provider keeps standard technical logs (IP address, browser, request time) for security and diagnostics. Basis: our legitimate interest (Art. 6(1)(f) GDPR) in keeping the site working and secure.
Enquiry form and e-mail - if you send an enquiry through the form on this site (name, e-mail, optional phone, number of guests, stay dates, message) or write to us by e-mail, we process that data to reply and arrange the stay (Art. 6(1)(b) GDPR - steps prior to a contract). The form delivers the message to our mailbox through the Formspree service. Paid bookings are handled by Booking.com under its own privacy policy.
3. Recipients
Google Ireland Ltd. (Ireland) and Google LLC (USA) - Google Analytics 4, only with your consent. Transfers to the USA rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework, under which Google is certified. Google privacy policy.
Cloudflare, Inc. (USA) - hosting and CDN. Transfers rely on the EU-US Data Privacy Framework. Cloudflare privacy policy.
Formspree, Inc. (USA) - delivery of form messages to our mailbox. Transfers rely on the EU-US Data Privacy Framework. Formspree privacy policy.
We do not sell data and do not pass it on to anyone for marketing.
4. Cookies
Necessary (no consent needed): gg-cookie-consent - your choice in the cookie notice, stored in browser localStorage until you clear site data; __cf_bm (Cloudflare) - distinguishes people from bots, 30 minutes.
Analytics (consent only): _ga and _ga_* (Google Analytics) - browser and session identifier, valid for up to 2 years.
Marketing: none.
You can withdraw consent or change your choice at any time: open cookie settings or clear this site's data in your browser.
5. Retention
Google Analytics data: 14 months (retention setting in our account), after which Google deletes it automatically. Cloudflare logs: per Cloudflare's policy, normally a few days. Enquiries and e-mail correspondence: until the matter is closed, at most 12 months after the last contact; if a stay follows, for as long as tax and tourist-rental rules require.
6. Your rights
You have the right to access, rectify and erase your data, to restrict processing, to data portability, to object, and to withdraw consent at any time (withdrawal does not affect processing carried out before it). Write to [email protected]; we reply within 30 days at the latest.
You also have the right to lodge a complaint with a supervisory authority. For this site that is the Spanish Agencia Española de Protección de Datos (aepd.es); you may also contact the authority in your own country, such as the ICO in the UK.
7. Changes
When the scope of processing or the law changes, we update this document and the date in the header.