Privacy policy

This policy describes how we process the personal data you provide through the application form on this website, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

1. Data controller

• Controller: [Full name or company name]
• Tax ID (NIF/CIF): [NIF or CIF]
• Address: [Full address], León, Spain
• Email: hola@habitacionesleon.com

2. What data we process and why

We process the data you provide in the application form (identification and contact details, the reason for and conditions of your stay, and any information you add in the free-text field) for the sole purpose of managing your room rental application: assessing it, contacting you and, where appropriate, arranging a visit.

3. Legal basis

The legal basis for the processing is your consent, given by ticking the acceptance box before sending the form (art. 6.1.a GDPR), and the application of pre-contractual measures at your request (art. 6.1.b GDPR).

4. Recipients and data processors

Your data is not shared with third parties for commercial purposes. The following data processors are involved in providing the service:

• Property management company: [Name of the management company, tax ID and address], acting as data processor, which accesses application data exclusively to manage it on behalf of the controller, under the processing agreement in place (art. 28 GDPR).
• Supabase (database hosting) and Vercel (web hosting), technology providers that may involve international transfers covered by standard contractual clauses.
• Transactional email provider ([Resend or other]) for internal notification of new applications.

5. Retention

We keep your application data while it is being processed and, at most, [period, e.g. 12 months] from receipt if no contract is signed. If a contract is signed, the data will be processed within the contractual relationship.

6. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to hola@habitacionesleon.com, attaching a copy of your ID document. You can also withdraw your consent at any time and lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

7. Security

We apply appropriate technical and organisational measures to protect your data: restricted access through authentication, encryption in transit (HTTPS) and database-level access control.