Privacy Policy

This Privacy Policy explains how Elevate Rest Marbella, S.L. processes personal data collected through https://chaletberezkamarbella.com (the "Website") and in connection with reservations at Chalet Berezka Marbella. It complies with:

• Regulation (EU) 2016/679 (GDPR);
• Spanish Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD);
• Law 34/2002 (LSSI-CE).

Data controller

Company: Elevate Rest Marbella, S.L.
Tax ID (NIF): B56287691
Address: Calle Generalife 9, 29660 Marbella (Málaga), Spain
Contact for data protection: info@chaletberezkamarbella.com

Personal data we process

We only process the data you give us or that is needed for the services you request:

• Reservations: name, phone number, email address, date and time, number of guests, preferred space and any comments you add.
• Private event enquiries: the same contact data, plus the type of event, date, number of guests, budget and details you share with us.
• Job applications: the data in your CV and covering message, and the position you apply for.
• Messages by email, phone or WhatsApp: your contact details and the content of your message.
• Website use: technical data such as IP address, device and browser. Analytics data is collected only if you accept analytics cookies. See the Cookie Policy.

We do not ask for special categories of personal data. Please do not include such data (for example, health information) in comments, unless it is needed for your visit, such as a food allergy you want us to know about. In that case we use it only to prepare your visit.

Purposes, legal bases and retention

Managing your reservation

• Legal basis: taking steps at your request before entering into a contract, and performing that contract (Art. 6(1)(b) GDPR).
• Retention: until your visit, and then for up to 12 months to handle any incidents or claims.

Prepayments and deposits for karaoke tables

• Legal basis: performance of the contract (Art. 6(1)(b) GDPR). Accounting and tax records are kept to comply with our legal obligations (Art. 6(1)(c) GDPR).
• Retention: for the periods required by law, generally 6 years.

Private event enquiries and proposals

• Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
• Retention: while we discuss your event. If no agreement is reached, for up to 12 months.

Answering your questions

• Legal basis: our legitimate interest in responding to people who contact us (Art. 6(1)(f) GDPR).
• Retention: until your question is resolved, and then for up to 12 months.

Job applications

• Legal basis: your consent, given when you send us your application (Art. 6(1)(a) GDPR).
• Retention: until the selection process ends. With your consent, we may keep your application for future openings for up to 12 months. You can withdraw your consent at any time.

Website analytics

• Legal basis: your consent, given through the cookie banner (Art. 6(1)(a) GDPR).
• Retention: as described in the Cookie Policy.

Security and operation of the Website

• Legal basis: our legitimate interest in keeping the Website secure and working (Art. 6(1)(f) GDPR).
• Retention: for the time needed for that purpose.

We do not make decisions based solely on automated processing, including profiling, that produce legal effects for you. We do not sell personal data.

Who receives your data

We only share data with service providers who process it on our behalf and under a data processing agreement, or when the law requires it:

• Webflow, Inc. — website hosting and website forms (USA).
• Google — website analytics (Google Analytics), only if you accept analytics cookies (EU / USA).
• MapTiler AG — the interactive map on the Website. When the map loads, MapTiler receives your IP address (Switzerland).
• Business email provider — our business email.
• A group company that manages recruitment — job applications sent to m.lagunina@bulldozer-sp.com.
• Banks and payment providers — processing of prepayments and deposits.
• Public authorities — when we are legally obliged to share data with them.

International transfers

Some providers may process data outside the European Economic Area:

• transfers to the USA are covered by the EU–US Data Privacy Framework or by Standard Contractual Clauses approved by the European Commission;
• Switzerland has an adequacy decision of the European Commission.

Minors

Under Spanish law, people over 14 can consent to the processing of their personal data. For children under 14, consent must be given by their parents or legal guardians. Reservations must be made by adults.

Your rights

You have the right to:

• access your personal data;
• rectify inaccurate or incomplete data;
• request deletion of your data;
• restrict processing;
• object to processing;
• data portability;
• withdraw your consent at any time, without affecting processing carried out before you withdrew it.

To exercise any of these rights, write to info@chaletberezkamarbella.com with the subject "Data protection" and tell us which right you want to exercise. If we cannot verify your identity, we may ask you for additional information. We will reply within one month.

If you believe your rights have not been respected, you can file a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).

Security

We apply appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access and alteration. The Website uses an encrypted connection (HTTPS).

Changes to this policy

We may update this Privacy Policy when our services or the law change. The date of the latest update is shown at the top of this page.