Politique de confidentialité

La présente politique de confidentialité est disponible en anglais et en allemand. La version allemande fait foi.

With the following privacy policy we would like to inform you about the types of your personal data (hereinafter also referred to as "data") we process, for what purposes and to what extent. This privacy policy applies to all processing of personal data carried out by us in connection with the rental of the holiday apartment "CasaLuz" in Corralejo (Fuerteventura), in particular on our website www.casaluz-fuerteventura.info including the booking area (hereinafter collectively referred to as "online offer"). The terms used are not gender-specific. In case of doubt, the German version of this privacy policy prevails.

Last updated: October 2026

Controller

E-mail: mail@casaluz-fuerteventura.info
Phone: +49 155 60271172
Legal notice: Legal notice

Overview of processing operations

The following overview summarises the types of data processed and the purposes of their processing, and refers to the data subjects.

Types of data processed

• Inventory data
• Contact data
• Contract data
• Payment data
• Identity document and registration data
• Usage data
• Meta, communication and procedural data
• Log data

Categories of data subjects

• Prospective customers (interested parties)
• Guests (persons making a booking and fellow travellers)
• Communication partners
• Users

Purposes of processing

• Provision of contractual services and fulfilment of contractual obligations
• Compliance with statutory registration and retention obligations
• Communication
• Office and organisational procedures, accounting
• Security measures
• Provision of our online offer and user-friendliness
• Information technology infrastructure and error analysis
• Reach measurement

Relevant legal bases

Below you will find an overview of the legal bases of the GDPR on which we process personal data. Please note that in addition to the provisions of the GDPR, national data protection requirements may apply in your or our country of residence or domicile and at the location of the apartment (Spain).

• Consent (Art. 6(1)(a) GDPR) — The data subject has given consent to the processing of their personal data for one or more specific purposes
• Performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR) — Processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract
• Legal obligation (Art. 6(1)(c) GDPR) — Processing is necessary for compliance with a legal obligation to which the controller is subject
• Legitimate interests (Art. 6(1)(f) GDPR) — Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject

National data protection regulations in Germany: In addition to the data protection regulations of the GDPR, national data protection regulations apply in Germany. These include in particular the Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG). The BDSG contains special provisions, among others, on the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes and transmission, as well as automated decision-making in individual cases including profiling.

Regulations in Spain: As the apartment is located in Spain, Spanish regulations also apply to the accommodation, in particular the registration obligation for accommodation providers under Art. 25 of Ley Orgánica 4/2015 de protección de la seguridad ciudadana in conjunction with Real Decreto 933/2021, and additionally the Spanish data protection act (Ley Orgánica 3/2018, LOPDGDD).

Security measures

We take appropriate technical and organisational measures in accordance with the legal requirements, taking into account the state of the art, the implementation costs and the nature, scope, circumstances and purposes of the processing, as well as the varying probabilities of occurrence and the extent of the threat to the rights and freedoms of natural persons, in order to ensure a level of protection appropriate to the risk.

The measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as access, input, disclosure, availability and separation concerning the data. Identity document and registration data can only be accessed by persons who need it to handle the stay; access to the administration area is additionally protected by two-factor authentication. Furthermore, we have established procedures that ensure the exercise of data subjects' rights, the erasure of data and responses to threats to the data. We also take the protection of personal data into account as early as the development or selection of hardware, software and procedures, in accordance with the principle of data protection by design and by default.

Securing online connections using TLS/SSL encryption technology (HTTPS): To protect the data of users transmitted via our online services from unauthorised access, we use TLS/SSL encryption technology. When a website is secured by an SSL/TLS certificate, this is signalled by the display of HTTPS in the URL.

Transmission of personal data

In the course of our processing of personal data, it may happen that the data is transmitted to other bodies, companies, legally independent organisational units or persons, or that it is disclosed to them. Recipients of this data may include, for example, service providers commissioned with IT tasks or authorities to which we are legally obliged to transmit data (see "Guest registration"). In such cases, we observe the legal requirements and, in particular, conclude corresponding contracts or agreements with service providers that serve to protect your data.

General information on data storage and erasure

We erase personal data that we process in accordance with the statutory provisions as soon as the underlying consents are revoked or there are no further legal bases for the processing. This concerns cases in which the original purpose of the processing no longer applies or the data is no longer required. Exceptions to this rule exist where statutory obligations or special interests require longer storage or archiving of the data.

In particular, data that must be retained for commercial or tax law reasons, or whose storage is necessary for legal prosecution or to protect the rights of other natural or legal persons, must be archived accordingly. Where several statements on the retention period or erasure deadlines of a piece of data exist, the longest period always applies.

Retention and erasure of data: The following general periods apply:

• 10 years — retention period for books and records, annual financial statements, inventories, management reports, opening balance sheets, booking vouchers and invoices (§ 147(3) in conjunction with (1) nos. 1, 4 and 4a AO, § 14b(1) UStG, § 257(1) nos. 1 and 4, (4) HGB)
• 6 years — other business documents: received commercial or business letters, reproductions of sent commercial or business letters, and other documents insofar as they are relevant for taxation (§ 147(3) in conjunction with (1) nos. 2, 3, 5 AO, § 257(1) nos. 2 and 3, (4) HGB)
• 3 years — identity document and registration data of guests under the Spanish registration obligation for accommodation providers (Real Decreto 933/2021)
• 3 years — data required to consider potential warranty and damage claims or similar contractual claims, stored for the duration of the regular statutory limitation period of three years (§§ 195, 199 BGB)

Rights of data subjects

As a data subject, you are entitled to various rights under the GDPR, which arise in particular from Art. 15 to 21 GDPR:

• Right to object: You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions. Where personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing
• Right to withdraw consent: You have the right to withdraw consent granted at any time with effect for the future
• Right of access: You have the right to request confirmation as to whether data in question is being processed and to obtain information about this data as well as further information and a copy of the data in accordance with the legal requirements
• Right to rectification: You have the right to request the completion of data concerning you or the rectification of incorrect data concerning you
• Right to erasure and restriction of processing: You have the right to request that data concerning you be erased without delay, or alternatively to request a restriction of the processing of the data
• Right to data portability: You have the right to receive data concerning you that you have provided to us in a structured, commonly used and machine-readable format, or to request its transmission to another controller
• Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or the place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR

Booking and payment

In the booking area of our online offer you can book the apartment directly with us. For this purpose we process the information you provide in the booking form: first name, surname(s), e-mail address, phone number and address of the person making the booking, travel dates, number of guests, chosen cancellation policy, any discounts granted and your language. Mandatory fields are marked as such in the form; without them we cannot accept the booking. No personal data is processed to display available dates in the calendar.

After you submit the form, your booking is initially a reservation: the dates are reserved for you and you receive an e-mail with the payment information. Payment is made by bank transfer. As soon as the payment (or the deposit) has reached us, we confirm the booking as binding and inform you by e-mail. We store the payment status, the payment deadlines and the time the payment was received; if payment is not received within the period stated in the e-mail, the booking is cancelled. We only receive details of your bank account insofar as they are included in the transfer. We also inform you of changes to and cancellations of your booking by e-mail.

Invoices: We issue an invoice for your stay, which we send to you by e-mail. It contains the name and address of the invoice recipient, a tax number if applicable, the e-mail address, and the services booked and amounts. We retain invoices for the duration of the statutory retention obligations.

Types of data processed: Inventory data (e.g. name, address); contact data (e-mail address, phone number); contract data (travel dates, number of guests, prices, cancellation policy, booking reference); payment data (payment status, payment deadline, receipt of payment, invoice data).
Data subjects: Prospective customers; guests.
Purposes: Provision of contractual services and fulfilment of contractual obligations; communication; office and organisational procedures, accounting.
Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR); legal obligation (Art. 6(1)(c) GDPR) for the retention of invoices and booking records.

Protection of the booking form against abuse (ALTCHA)

To protect the booking form against automated requests – for example programs that block the calendar or trigger e-mails to third-party addresses – we use the open-source software ALTCHA. ALTCHA works with a so-called proof of work: when the form is opened, your browser fetches a computing task from our server and solves it in the background while you fill in the form. The result is submitted with the booking and verified by our server. ALTCHA runs entirely on our own infrastructure: no data is transmitted to third parties – including the provider of ALTCHA – no cookies are set and no information is stored on or read from your device. Your behaviour on the page (e.g. mouse or scroll movements) is not evaluated. Consent under Section 25(1) TDDDG or Art. 22.2 LSSI-CE is therefore not required.

The computing task contains no personal data. To prevent a result from being used more than once, we store an identifier of the solved task in the memory of our server until it expires (at most 30 minutes). In addition, we limit the number of booking requests: for this purpose we process your IP address in the memory of our server for at most one hour (request counter) and use the e-mail address entered in the form to check whether an open reservation already exists and how many bookings have been received in the last 24 hours. Names in the form may only contain letters and common punctuation, so that our e-mails cannot be used to send third-party content.

Types of data processed: Meta, communication and procedural data (e.g. IP address, time of the request); contact data (e-mail address, only to check for open reservations).
Data subjects: Users; prospective customers.
Purposes: Security measures; protection against abuse (spam, blocking of the calendar).
Storage period: identifier of the solved task at most 30 minutes, request counter per IP address at most one hour, in memory only.
Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

Guest account "My booking"

With your first booking we create a guest account under your e-mail address; there is only one account per e-mail address. It allows you to view your bookings and, where the booking conditions permit, to change or cancel them. You sign in without a password using a sign-in link or a one-time code that we send to your e-mail address; the link is valid for 30 minutes, the code for 10 minutes.

For the account we store your name, your e-mail address, your preferred language and the time it was created. After signing in, a session is maintained for up to 7 days; for this purpose we store the IP address, the browser identifier (user agent) and the time of the session on our server. This serves to protect your account against misuse and unauthorised use. On request we delete your guest account, unless statutory retention obligations for associated bookings prevent this.

Types of data processed: Inventory data; contact data; contract data; meta, communication and procedural data (IP address, user agent, timestamps); log data.
Data subjects: Guests; users.
Purposes: Provision of contractual services; security measures; provision of our online offer and user-friendliness.
Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR); legitimate interests (Art. 6(1)(f) GDPR).

Guest registration (registration obligation in Spain)

As an accommodation provider in Spain, we are legally obliged to record the data of all guests, transmit it to the Spanish Ministry of the Interior and retain it (Art. 25 Ley Orgánica 4/2015 in conjunction with Real Decreto 933/2021). For this purpose, after the booking we send you a personal registration link through which you enter the data of all travellers. The link is valid until 7 days after departure.

For each guest we record in particular first name, surname(s), date of birth, nationality, type and number of the identity document, where applicable the document's support number, as well as address and contact details. We transmit this information together with the booking reference and the dates of arrival and departure to the SES.Hospedajes platform of the Secretaría de Estado de Seguridad (Ministry of the Interior, Spain). We also use this information to create the legally required registration form as a PDF.

Instead of entering the data manually, you can upload photos or PDFs of the front and back of your identity document. This is voluntary; the photos are used solely to take over and check the required information. They are not passed on to third parties and are only accessible to the persons entrusted with handling the stay. You can have the photos removed at any time and provide the information manually instead.

Types of data processed: Inventory data; contact data; identity document and registration data (document type, document number, support number, date of birth, nationality, identity document photos if provided); contract data (booking reference, travel dates); meta, communication and procedural data (time and status of the transmission).
Data subjects: Guests (persons making a booking and fellow travellers).
Recipient: Secretaría de Estado de Seguridad, Ministry of the Interior, Spain (SES.Hospedajes).
Purposes: Compliance with statutory registration and retention obligations.
Retention period: three years from the end of the stay (Real Decreto 933/2021), after which the data including the identity document photos is deleted.
Legal bases: Legal obligation (Art. 6(1)(c) GDPR); for the voluntary upload of identity document photos, your consent (Art. 6(1)(a) GDPR).

Bookings via booking platforms and calendar synchronisation

The apartment is also offered via booking platforms such as Booking.com and Airbnb. If you book via such a platform, the respective platform operator is itself responsible for the processing of your data on its platform, and its privacy policy applies. We process the information we receive from the platform about your booking in order to carry out your stay and to comply with the registration obligation described above.

To prevent double bookings, we synchronise the occupancy with the platforms using calendar files (iCal). Only occupied periods and a booking reference are exchanged, no names or contact details of guests.

Types of data processed: Inventory data; contact data; contract data.
Data subjects: Guests.
Purposes: Provision of contractual services; compliance with statutory registration obligations.
Legal bases: Performance of a contract (Art. 6(1)(b) GDPR); legal obligation (Art. 6(1)(c) GDPR).

Sending e-mails

We send e-mails that are necessary to handle your booking and your guest account, e.g. booking confirmations, notices of changes, cancellations and payment deadlines, invoices, registration links and sign-in links and codes. We do not send advertising e-mails or newsletters. For sending, we use the e-mail service of STRATO GmbH (see "Strato"), which processes contact and meta data (e.g. e-mail address, time of dispatch) as well as the content of the e-mails on our behalf.

Types of data processed: Contact data; content data; meta, communication and procedural data.
Data subjects: Guests; users.
Purposes: Provision of contractual services; communication.
Legal bases: Performance of a contract (Art. 6(1)(b) GDPR); legitimate interests (Art. 6(1)(f) GDPR).

Provision of the online offer and web hosting

We process the data of users in order to be able to provide them with our online services. For this purpose, we process the IP address of the user, which is necessary to transmit the content and functions of our online services to the user's browser or device. We deliver fonts and all other content of the website from our own server; no content from third-party providers is loaded when you visit our pages.

Types of data processed: Usage data; meta, communication and procedural data (IP addresses, time information, identification numbers); log data.
Data subjects: Users.
Purposes: Provision of our online offer and user-friendliness; information technology infrastructure; security measures.
Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

Collection of access data and log files

Access to our online offer is logged in the form of so-called "server log files". Server log files may include the address and name of the web pages and files accessed, the date and time of access, the volume of data transferred, notification of successful access, browser type and version, the user's operating system, referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider. Secret parts of links (e.g. registration and sign-in links) are masked before logging. Server log files are used, on the one hand, for security purposes (e.g. to defend against attacks) and, on the other, to ensure the utilisation and stability of the servers. The log data is stored centrally on servers of STRATO GmbH (see "Strato"). Legal bases: Legitimate interests (Art. 6(1)(f) GDPR). Erasure of data: Log file information is stored for a maximum of 30 days and then deleted or anonymised. Data that must be retained for evidentiary purposes is exempt from erasure until the respective incident has been finally clarified.

Hetzner

To provide our online offer, we use storage space, computing capacity and software of the service provider Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Hetzner processes the data on our behalf as a processor. Legal bases: Legitimate interests (Art. 6(1)(f) GDPR). Website: https://www.hetzner.com; privacy policy: https://www.hetzner.com/de/legal/privacy-policy/.

Strato

To send our e-mails and to store log data centrally, we use servers and services of STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. In doing so, Strato processes contact, content, meta and log data (e.g. e-mail address, content and time of dispatch, server log files) on our behalf as a processor. Legal bases: Legitimate interests (Art. 6(1)(f) GDPR). Privacy policy: https://www.strato.de/datenschutz/.

Error analysis (GlitchTip)

To detect and fix technical errors in our online offer, we use the open-source software GlitchTip, which we operate on our own infrastructure. If an error occurs in the browser or on the server, an error report is transmitted to GlitchTip. It contains the error description, the page concerned (without URL parameters; secret parts of links are masked), time, browser, operating system and device type. Form contents, cookies and details of your guest account are not transmitted. The data is not passed on to third parties and is only stored for as long as it is needed to fix the error.

Types of data processed: Usage data; meta, communication and procedural data; log data.
Data subjects: Users.
Purposes: Information technology infrastructure and error analysis; security measures.
Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

Web analytics and reach measurement

Web analytics (also referred to as "reach measurement") serves to evaluate the visitor flows of our online offer. It allows us, for example, to recognise at what time our online offer or its content is used most frequently, via which pages visitors find us and which areas require optimisation. As part of web analytics we do not store any clear-text data of users (such as names or e-mail addresses) and do not create profiles of individual visitors.

Types of data processed: Usage data; meta, communication and procedural data.
Data subjects: Users.
Purposes: Reach measurement; provision of our online offer and user-friendliness.
Security measures: Pseudonymisation of the IP address (no storage in clear text).
Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

Umami (cookieless)

We use the self-hosted open-source web analytics software Umami for reach measurement. Umami runs on our own infrastructure (stats.tayho.solutions); the measurement requests are delivered via our own domain and forwarded to that server by us. The data collected is processed exclusively by us and is not shared with third parties.

Umami does not set cookies and neither stores information on your device nor reads information from it. For that reason no consent under Section 25(1) TDDDG or Art. 22.2 LSSI-CE is required. Your IP address is not stored: it is only used transiently, together with the browser identifier (user agent) and a secret key, to calculate a pseudonymous identifier which changes daily and cannot be traced back to you. Recorded are, in particular, the pages accessed, the referring page, the time of access, the approximate origin derived from the IP address (country/region), device type, screen size, browser, operating system and language setting.

You can object to the measurement at any time: if the "Do Not Track" setting is enabled in your browser, no data is collected.
Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

Use of cookies

Cookies are small text files or other storage records that store information on end devices and read information from them. We only use technically necessary cookies and no cookies for analytics, tracking or advertising purposes:

• Language selection (i18n_locale) — stores the chosen language for the website and the booking area
• Sign-in — session cookie after signing in to the guest account or the administration area, valid for up to 7 days or until you sign out
• Appearance (theme) — stores the chosen light or dark appearance in the booking area if you change it

Notes on the legal basis: Storing and reading these cookies is strictly necessary to provide the service you have expressly requested (Section 25(2) no. 2 TDDDG and Art. 22.2 LSSI-CE); no consent is required for this. The associated processing is based on our legitimate interests (Art. 6(1)(f) GDPR) or the performance of a contract (Art. 6(1)(b) GDPR). You can delete cookies at any time in your browser settings; without the session cookie, however, it is not possible to sign in to the guest account.

No cookies are set for reach measurement with Umami (see above). We do not use any third-party tracking services and do not embed maps, videos or fonts from third-party providers.

Links to Google Maps

On our website we link to Google Maps to show the location of the apartment and places in the surrounding area. These are simple links, not embedded maps: no data is transmitted to Google when you visit our pages. Only when you click on such a link do you switch to a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to which its privacy policy applies: https://policies.google.com/privacy.

Contact and enquiry management

When you contact us (e.g. by e-mail, telephone or by post) and in the context of existing bookings, the information of the enquiring persons is processed insofar as this is necessary to answer the contact enquiries and any requested measures. We use this data exclusively for the stated purpose of contacting and communicating with us.

Types of data processed: Inventory data; contact data; content data; meta, communication and procedural data.
Data subjects: Communication partners; prospective customers; guests.
Purposes: Communication; office and organisational procedures.
Legal bases: Legitimate interests (Art. 6(1)(f) GDPR); performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR).

Amendment and update

We ask you to inform yourself regularly about the content of our privacy policy. We adapt the privacy policy as soon as changes to the data processing we carry out make this necessary. We will inform you as soon as the changes require an act of cooperation on your part (e.g. consent) or other individual notification.

Definitions of terms

In this section you will find an overview of the terms used in this privacy policy. Where the terms are defined by law, their legal definitions apply. The following explanations, on the other hand, are primarily intended to aid understanding.

• Identity document and registration data: Information required to comply with the registration obligation for accommodation providers, e.g. type and number of the identity document, date of birth and nationality
• Inventory data: Essential information necessary for the identification and administration of contractual partners, user accounts and similar assignments, such as names, addresses and specific identifiers (user IDs)
• Content data: Information generated in the course of creating and transmitting content, such as the texts of messages and e-mails
• Contact data: Information that enables communication with persons or organisations, such as telephone numbers, postal addresses and e-mail addresses
• Meta, communication and procedural data: Data containing information about how data is processed, transmitted and managed, e.g. communication data (IP addresses, timestamps, transmission paths) and procedural data on processes
• Usage data: Information that records how users interact with digital products, services or platforms, e.g. pages visited, device information and IP addresses
• Personal data: Any information relating to an identified or identifiable natural person; an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more specific factors
• Log data: Information about events or activities that have been logged in a system or network, typically including timestamps, IP addresses, user actions and error messages
• Reach measurement: The evaluation of the visitor flows of an online offer, which may include the behaviour or interests of visitors in certain information
• Contract data: Information about a contractual relationship, e.g. travel dates, number of guests, prices, booking reference and contract terms
• Payment data: Information on the processing of payments, e.g. payment status, payment deadlines, receipts of payment and invoice data
• Controller: The natural or legal person, authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data
• Processing: Any operation or set of operations performed on personal data, whether or not by automated means, such as collection, evaluation, storage, transmission or erasure