1. Who controls your data
The controller is PROSPERA ASSETS SL, trading as PDG15, NIF/CIF B-26625939, with registered office at C/. Sant Francesc 18, 08202 Sabadell, Barcelona. Privacy enquiries and rights requests may be sent to marcel@pdg15.com.
2. What we use information for
Information is collected directly from visitors and guests and may also be received through Lodgify or a booking channel connected by PDG15.
| Activity | Information | Legal basis | Retention |
|---|---|---|---|
| Enquiries and pre-booking requests | Name, contact details, dates, guest requirements and message | Steps requested before a contract; legitimate interests in responding | Proposed: 12 months after the last contact if no booking follows. Marcel must confirm that this period is implemented. |
| Reservations, payments and guest service | Identity, contact and booking details, payment status, correspondence and stay preferences | Performance of the accommodation contract; legal obligations | During the booking and stay. Invoices, accounting records and required transaction documents are retained for six years from the last relevant accounting entry. Other data is deleted or restricted when no longer needed, subject to legal claims. |
| Statutory traveller registration | Guest identity and information required by Spanish authorities | Legal obligation | Three years from the end of the contracted accommodation service, as required by Royal Decree 933/2021. |
| Security, damage and claims | Booking records, communications, incident evidence and transaction details | Contract; legitimate interests; establishment, exercise or defence of legal claims | Until the matter is resolved, then restricted for up to five years where needed for contractual claims; longer while proceedings or a legal hold remain active. |
| Marketing, if offered | Email address and consent, withdrawal or objection record | Consent | Until consent is withdrawn or the person objects. A minimum suppression record may then be retained in restricted form to ensure marketing is not restarted and to demonstrate compliance. |
| Website preferences and measurement | Device, browser, IP and interaction data | Consent for non-essential technologies; legitimate interests for necessary security | See the Cookie Policy |
Lodgify processes reservation data for the period instructed by PDG15. When the PDG15 customer account ends, Lodgify’s Data Processing Addendum provides for return or destruction on request, except where retention is required by law.
How the booking journey uses information
For availability searches, your browser sends your selected dates and adult and child counts to the PDG15 service hosted on Cloudflare. That service sends the dates and total guest count to Lodgify to obtain availability and prices. This search does not ask for your name, email address or payment-card details. Technical request information is also involved in delivering the service.
Where enabled, the apartment booking box loads software directly from Lodgify into your browser. This connects your browser to Lodgify and involves technical information such as your IP address. Continuing to book opens the separate checkout on checkout.lodgify.com, where booking and payment information is handled through Lodgify and the payment provider enabled for that booking.
Lodgify’s own account privacy policy does not replace this policy for PDG15 guests. Confirm the actual checkout fields, payment provider and its privacy terms, connected integrations and staff or service-provider access before publication. This explanation is based on the current implementation; a complete browser audit and account-configuration review are still pending.
3. Who receives information
PDG15 uses Lodgify, operated by Codebay Solutions Limited (company number 5903966), for booking, reservation-management and guest-communication services. For guest information processed through those services on PDG15’s behalf, PROSPERA ASSETS SL is the controller and Codebay Solutions Limited acts as processor. Lodgify acts as a separate controller for information associated with the PDG15 Lodgify customer account. See the Lodgify Terms, Data Processing Addendum and Privacy Policy.
Payment-card information submitted through the booking flow is processed by the payment provider enabled for that booking. Lodgify states that it does not directly collect or store payment-card details. Marcel must confirm the enabled payment provider and whether PDG15 personnel can access any payment-card information.
Information may also be handled by Cloudflare for website security, hosting and delivery; the OpenStreetMap Foundation when interactive map tiles are requested; connected booking channels and integrations; professional advisers; cleaning or guest-service providers where necessary; and competent public authorities. Marcel must confirm every connected channel, integration and operational recipient that can access guest information.
PDG15 does not sell personal information.
4. International transfers
Lodgify and some of its subprocessors may process or store personal information outside the European Economic Area. Lodgify states that it uses safeguards appropriate to the transfer, which may include an adequacy decision, the European Commission’s Standard Contractual Clauses or, where relevant, the UK International Data Transfer Agreement or Addendum. Lodgify’s Data Processing Addendum allows PDG15 to request its current subprocessor list.
Cloudflare may process website request and security data internationally under its Data Processing Addendum, which incorporates Standard Contractual Clauses for relevant transfers and maintains a public subprocessor list. OpenStreetMap states that map-tile requests are served through a global cache network under its Privacy Policy.
Before publication, Marcel must request and retain Lodgify’s current subprocessor list and confirm the transfers associated with the enabled payment provider, booking channels and integrations.
5. Your rights
You may request access, correction, deletion, restriction, portability or objection, and may withdraw consent at any time without affecting earlier lawful processing. Send a request to marcel@pdg15.com. PDG15 may request reasonable identity verification.
You may also complain to the Spanish Data Protection Agency (AEPD).
6. Required information
Fields identified as required are needed to respond, make a reservation or meet legal obligations. A booking or stay may not be possible if required information is not supplied.
7. Children and updates
The website is not directed at children booking accommodation independently. Information about minors may be processed as part of a family booking where necessary. This policy may be updated when services or legal requirements change; the date above identifies the current version.
8. Marcel’s confirmation checklist
The review must cover the actual PDG15 availability search, embedded Lodgify booking widgets and checkout on checkout.lodgify.com, together with the enabled payment provider. Confirm that the data uses and recipients described here match that complete booking journey before legal review and publication.
Before this policy is published, Marcel must confirm:
- that the Lodgify customer account identifies PROSPERA ASSETS SL as the legal customer and Marcel only as its authorised user or contact;
- that the proposed 12-month enquiry period and the deletion, restriction and suppression procedures above are implemented in practice;
- the enabled payment provider and whether PDG15 personnel can access any payment-card information;
- all connected booking channels, integrations and external operational recipients with access to guest information;
- whether PDG15 sends marketing messages and, if so, how consent, withdrawal, objections and suppression are recorded; and
- that Lodgify’s current subprocessor list and the relevant provider safeguards have been requested and retained with PDG15’s compliance records.