Privacy policy.

1. Data controller

• Identity: Adrián Ruano García (hereafter "Doble-R")
• Address: Calle Comandante Salvador Carrasco Nº 9, 29400 Ronda
• Email: Casaruraldoble.r@gmail.com
• Phone: +34 627 52 36 21

2. Purposes of processing

We process the personal data you provide us for the following purposes:

• Booking and enquiry management: replying to your queries via email, WhatsApp or phone, formalising your booking and maintaining the necessary communication during your stay.
• Legal obligations: communicating guest data to the competent authorities (traveller registry) under current Spanish regulations.
• Website usage analysis: through Google Analytics 4 (only if you give consent in the banner) and Umami Analytics (fully anonymous, no cookies or personal data, no consent required). See details in our Cookie Policy.
• Marketing communications: only with your express consent, to inform you about news, offers or events.

3. Legal basis

• Contract performance: to manage your booking and provide accommodation services.
• Legal obligation: traveller registry, invoicing and tax obligations.
• Consent: for non-essential cookies and marketing communications.
• Legitimate interest: to ensure security and improve user experience.

4. Data retention

Data will be retained for as long as necessary to fulfil the purpose for which it was collected and to determine possible liabilities. Traveller registry data is retained for the legally established period (usually 3 years). Accounting and tax data is retained for the periods provided by applicable tax legislation.

5. Recipients

As a general rule, we do not share your data with third parties, except:

• Competent authorities when required by law (e.g. traveller registry with the Spanish Ministry of Interior).
• Service providers necessary for site operations, acting as data processors under our instructions and with appropriate safeguards:
  • Hostinger (website hosting) — servers in the EU.
  • Google LLC (Google Analytics 4, only with your consent) — servers in the US, under the EU-US Data Privacy Framework.
  • Umami Software, Inc. (Umami Analytics, fully anonymous data) — servers in the EU.
  • Meta Platforms Ireland Ltd. (WhatsApp Business, if you contact us via WhatsApp) — under WhatsApp's privacy policies.

6. International transfers

Some of our technology providers may be located outside the European Economic Area (EEA), specifically in the United States. In such cases, we ensure appropriate safeguards under the GDPR are in place:

• Google LLC (Google Analytics): transfer under the EU-US Data Privacy Framework, recognised by the European Commission as an adequate transfer mechanism (Adequacy Decision of 10 July 2023).
• Meta Platforms Ireland Ltd. (WhatsApp): data is managed under Meta's privacy policies, in accordance with applicable law.

All other providers processing your personal data operate within the EEA.

7. Your rights

You may exercise the following rights at any time:

• Access: to know what data we hold about you.
• Rectification: to correct inaccurate data.
• Erasure: to delete your data when it is no longer needed.
• Objection: to object to the processing.
• Restriction: to request that we limit the processing.
• Portability: to receive your data in a structured, commonly used format.
• Withdrawal of consent: when based on consent, you may withdraw it at any time.

To exercise these rights, email Casaruraldoble.r@gmail.com stating the right you wish to exercise and attaching a copy of your ID document. You also have the right to file a complaint with the Spanish Data Protection Agency (www.aepd.es).

8. Security

We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss or destruction. We review these measures periodically to maintain a security level appropriate to the risk.

9. Changes to this policy

We may update this policy when legal or operational changes occur. We recommend checking it periodically. The last update date appears at the top of this document.