Privacy and cookies

AGROTURISMO ACTUAL COOP VALENCIANA DE TURISMO RURAL, tax ID F12832143, with registered address at Calle Barranco, 4, 12225 Fuentes de Ayódar, (Castellón), España, represented by Nuria Pérez Ves.

Data protection contact address: casarurallacalma@gmail.com.

Browsing this website involves no processing of personal data. There are no analytics tools, no advertising pixels and no third-party scripts collecting information.

Personal data is processed in two situations. First, if you send the date request form: we store your name, your email address, your phone number if you choose to give it, the arrival and departure dates, the number of guests, whether you are bringing a dog, whether you are asking for the romantic pack, and any message you write.

Second, if you get in touch on your own initiative on WhatsApp or by email. In that case the data processed is what you provide, together with the content of your message.

The availability calendar processes no personal data: the browser only receives which dates are taken, with no information about who is staying or why.

The server hosting the site may record technical connection data, such as the IP address, for the sole purpose of providing the service and keeping it secure.

To deal with your request, check availability, tell you the conditions and the amount, and, if you decide to stay, manage the booking and the stay.

To email you a record of your request and let the host know it has arrived.

Your data is not used to send you marketing, no profiles are built and no automated decisions are taken. In particular, no request is accepted or rejected automatically: a person always reviews it.

Pre-contractual steps taken at your request and, where applicable, performance of the accommodation contract, under article 6.1.b GDPR.

The box you tick before sending the form is not consent to process your data —the processing relies on article 6.1.b— but a record that this information was put in front of you before you sent it. Sending you marketing would require a separate box of its own, because those are two different legal bases and they cannot be merged into one.

Where a legal obligation applies —for example the traveller register required of accommodation providers— the basis is compliance with that obligation, under article 6.1.c GDPR.

The language cookie relies on the legitimate interest of providing the service you asked for.

Requests and enquiries that do not lead to a stay are kept for as long as needed to deal with them and, at most, one year from the last contact.

Data linked to a stay is kept for the periods required by tax, accounting and traveller-register law. Once those periods have passed, it is deleted.

These periods are not merely declared: the system deletes requests that did not lead to a stay once the year has passed, along with contact details no longer linked to any request.

Three providers are used to deliver the service, each acting as a processor under its own processing agreement in accordance with article 28 GDPR:

Supabase, which hosts the database holding requests and contact details.

Resend, which sends the request, confirmation and host notice emails.

Vercel, which hosts the web application.

The property also answers WhatsApp enquiries with the help of an automated assistant. That assistant only reads which calendar dates are taken and has no access to any personal data.

If you write to us on WhatsApp, your message travels through the servers of WhatsApp Ireland Limited (Meta group), whose privacy policy applies to that channel. If you write by email, the message is received in a mailbox held with Google Ireland Limited. You can avoid both by writing by post to the registered address.

No international transfers take place other than those inherent to the providers named above. Data may be disclosed to public authorities where the law requires it.

The database is configured so that the public key used by the website can only read rates and which nights are taken. It cannot read a single request, name, email address or phone number. Reaching personal data requires signing in as the host.

Your browser never connects to the database directly: availability is worked out on the server, and only dates reach the browser.

The form is submitted over an encrypted connection, and personal data is not shared with any analytics, advertising or tracking service, because this website uses none.

You may exercise the rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent where the processing is based on it.

To exercise them, write to casarurallacalma@gmail.com or to the registered address above, stating the right you wish to exercise and attaching a copy of a document proving your identity. You will receive a reply within a maximum of one month.

Exercising these rights is free of charge.

If you believe the processing of your data does not comply with the law, you may lodge a complaint with the Agencia Española de Protección de Datos (Spanish Data Protection Agency), the competent supervisory authority in Spain: https://www.aepd.es.

Before doing so, you may contact the controller at casarurallacalma@gmail.com to try to resolve the matter directly.

This website uses no analytics, advertising or tracking cookies, and loads no third-party scripts. The only cookie stored in your browser remembers the language you chose. It is a technical cookie required to provide the service you requested and is therefore exempt from the prior consent requirement. You can delete it at any time from your browser settings.