Privacy Policy

The data controller is the private individual owner of the property:

Evgeniy Kogan · Bödikerst. 2, D-50354 Hürth, Germany · evgeniy.kogan@outlook.de

Because data processing occurs in the context of private, irregular seasonal rentals, the appointment of a Data Protection Officer (DPO) is not required under Art. 37 GDPR.

The following categories of data may be processed when you contact us via the website or by email:

• Identity data: name, surname, copy of identity document (passport/ID), date of birth.
• Contact data: email address, phone number.
• Rental data: check-in/check-out dates, number of guests, special requests.
• Payment data: bank transfer details or payment confirmation (CVV and full card numbers are not stored).
• Technical data: IP address, browser type, pages visited — collected automatically by the web hosting provider.

• Performance of a rental contract (Art. 6(1)(b) GDPR): processing bookings, handing over keys, providing arrival information.
• Compliance with legal obligations (Art. 6(1)(c) GDPR): guest registration under Spanish law (Ley Orgánica 4/2015, RD 933/2021).
• Legitimate interests (Art. 6(1)(f) GDPR): property security and guest correspondence.
• Consent (Art. 6(1)(a) GDPR): sending informational materials if you have given consent.

Personal data is never sold or shared for commercial purposes. Data may be disclosed to:

• Spanish authorities (police, tax authorities) where required by law.
• Booking platforms (Airbnb, Booking.com, etc.) if the reservation was made through them; their own privacy policies apply.
• Hosting service providers solely for website operation, under a data processing agreement (Art. 28 GDPR).

The website is hosted on servers within the EEA. Where third-party booking platforms are used, data may be transferred to third countries subject to appropriate safeguards (Art. 46 GDPR).

• Rental-related data: 5 years from the end of the rental (Spanish statute of limitations).
• Guest registration data: 3 years under RD 933/2021.
• Payment records: 5 years under German tax law (§ 147 AO).
• Consent-based data: until consent is withdrawn.

You may exercise the following rights at any time by contacting the data controller:

• Right of access (Art. 15): obtain confirmation that your data is processed and receive a copy.
• Right to rectification (Art. 16): request correction of inaccurate data.
• Right to erasure (Art. 17): request deletion where legal grounds apply.
• Right to restriction (Art. 18): restrict processing in specified cases.
• Right to data portability (Art. 20): receive data in a machine-readable format.
• Right to object (Art. 21): object to processing based on legitimate interests.
• Right to withdraw consent: withdraw consent without affecting the lawfulness of prior processing.
• Right to lodge a complaint: Agencia Española de Protección de Datos (AEPD) — www.aepd.es, or Bundesbeauftragte für den Datenschutz (BfDI) — www.bfdi.bund.de.

This site may use technically necessary cookies for functionality. No analytical or marketing cookies are used without your explicit consent. A cookie banner will be displayed where required.

Technical and organisational measures are in place to protect personal data against unauthorised access, alteration or disclosure, including TLS/HTTPS encryption for data in transit.

This policy may be updated periodically. The current version with the date of last update is always available on this page.