1. Who controls your data
The controller is PROSPERA ASSETS SL, trading as PDG15, NIF/CIF B-26625939, with registered office at C/. Sant Francesc 18, 08202 Sabadell, Barcelona. Privacy enquiries and rights requests may be sent to marcel@pdg15.com.
2. What we use information for
Information is collected directly from visitors and guests and may also be received through Lodgify or a booking channel connected by PDG15.
| Activity | Information | Legal basis | Retention |
|---|---|---|---|
| Enquiries and pre-booking requests | Name, contact details, dates, guest requirements and message | Steps requested before a contract; legitimate interests in responding | Proposed: 12 months after the last contact if no booking follows. Marcel must confirm that this period is implemented. |
| Reservations, payments and guest service | Identity, contact and booking details, payment status, correspondence and stay preferences | Performance of the accommodation contract; legal obligations | During the booking and stay. Invoices, accounting records and required transaction documents are retained for six years from the last relevant accounting entry. Other data is deleted or restricted when no longer needed, subject to legal claims. |
| Statutory traveller registration | Guest identity and information required by Spanish authorities | Legal obligation | Three years from the end of the contracted accommodation service, as required by Royal Decree 933/2021. |
| Security, damage and claims | Booking records, communications, incident evidence and transaction details | Contract; legitimate interests; establishment, exercise or defence of legal claims | Until the matter is resolved, then restricted for up to five years where needed for contractual claims; longer while proceedings or a legal hold remain active. |
| Marketing, if offered | Email address and consent, withdrawal or objection record | Consent | Until consent is withdrawn or the person objects. A minimum suppression record may then be retained in restricted form to ensure marketing is not restarted and to demonstrate compliance. |
| Website preferences and measurement | Device, browser, IP and interaction data | Consent for non-essential technologies; legitimate interests for necessary security | See the Cookie Policy |
Lodgify processes reservation data for the period instructed by PDG15. When the PDG15 customer account ends, Lodgify’s Data Processing Addendum provides for return or destruction on request, except where retention is required by law.
3. Who receives information
PDG15 uses Lodgify, operated by Codebay Solutions Limited (company number 5903966), for booking, reservation-management and guest-communication services. For guest information processed through those services on PDG15’s behalf, PROSPERA ASSETS SL is the controller and Codebay Solutions Limited acts as processor. Lodgify acts as a separate controller for information associated with the PDG15 Lodgify customer account. See the Lodgify Terms, Data Processing Addendum and Privacy Policy.
Payment-card information submitted through the booking flow is processed by the payment provider enabled for that booking. Lodgify states that it does not directly collect or store payment-card details. Marcel must confirm the enabled payment provider and whether PDG15 personnel can access any payment-card information.
Information may also be handled by Cloudflare for website security, hosting and delivery; the OpenStreetMap Foundation when interactive map tiles are requested; connected booking channels and integrations; professional advisers; cleaning or guest-service providers where necessary; and competent public authorities. Marcel must confirm every connected channel, integration and operational recipient that can access guest information.
PDG15 does not sell personal information.
4. International transfers
Lodgify and some of its subprocessors may process or store personal information outside the European Economic Area. Lodgify states that it uses safeguards appropriate to the transfer, which may include an adequacy decision, the European Commission’s Standard Contractual Clauses or, where relevant, the UK International Data Transfer Agreement or Addendum. Lodgify’s Data Processing Addendum allows PDG15 to request its current subprocessor list.
Cloudflare may process website request and security data internationally under its Data Processing Addendum, which incorporates Standard Contractual Clauses for relevant transfers and maintains a public subprocessor list. OpenStreetMap states that map-tile requests are served through a global cache network under its Privacy Policy.
Before publication, Marcel must request and retain Lodgify’s current subprocessor list and confirm the transfers associated with the enabled payment provider, booking channels and integrations.
5. Your rights
You may request access, correction, deletion, restriction, portability or objection, and may withdraw consent at any time without affecting earlier lawful processing. Send a request to marcel@pdg15.com. PDG15 may request reasonable identity verification.
You may also complain to the Spanish Data Protection Agency (AEPD).
6. Required information
Fields identified as required are needed to respond, make a reservation or meet legal obligations. A booking or stay may not be possible if required information is not supplied.
7. Children and updates
The website is not directed at children booking accommodation independently. Information about minors may be processed as part of a family booking where necessary. This policy may be updated when services or legal requirements change; the date above identifies the current version.
8. Marcel’s confirmation checklist
Before this policy is published, Marcel must confirm:
- that the Lodgify customer account identifies PROSPERA ASSETS SL as the legal customer and Marcel only as its authorised user or contact;
- that the proposed 12-month enquiry period and the deletion, restriction and suppression procedures above are implemented in practice;
- the enabled payment provider and whether PDG15 personnel can access any payment-card information;
- all connected booking channels, integrations and external operational recipients with access to guest information;
- whether PDG15 sends marketing messages and, if so, how consent, withdrawal, objections and suppression are recorded; and
- that Lodgify’s current subprocessor list and the relevant provider safeguards have been requested and retained with PDG15’s compliance records.