Privacy Policy

1. Who we are

This privacy policy explains how Costadels AS collects and uses your personal data when you use our website or make a booking with us.

Costadels AS
Bernt Knudsens vei 8 B
1176 Oslo, Norway
Org. 933 017 583
[email protected]

Costadels is a holiday rental company that manages and lets properties in Spain, including at Mar Menor Golf Resort and Serena Golf Resort in Murcia. When you book with us, you are entering into a rental agreement directly with Costadels.

2. Data we collect

When you make an enquiry or booking through our website, we collect the following personal data:

• Contact details: First and last name, email address, phone number
• Booking details: Property, check-in and check-out dates, number of guests, special requests
• Payment data: Payment is processed by Stripe via a secure payment gateway. Costadels does not store your card details.
• Identity documents: Under Spanish law, we are required to collect and register a copy of the passport or national identity card of all guests aged 16 and over. See Section 5 below.

3. How we use your data

We use your personal data for the following purposes:

• Processing and confirming your booking
• Communicating with you before, during and after your stay (booking confirmation, check-in instructions, key handover arrangements)
• Processing payment and issuing receipts
• Complying with our legal obligations under Spanish law, including guest registration
• Resolving any complaints or disputes relating to your stay
• Sending marketing communications about our properties and offers, where you have given consent or where we have a legitimate interest based on a prior booking. You may unsubscribe at any time.

4. Legal basis for processing

We process your personal data on the following legal bases:

• Contract performance: Processing your name, contact details and booking data is necessary to fulfil your rental agreement with us.
• Legal obligation: Collection and registration of identity documents is required under Spanish law (Real Decreto 933/2021).
• Legitimate interest: For fraud prevention, security and improving our service.
• Consent: For marketing communications where separately obtained.

5. Spanish guest registration

Spanish regulations require all accommodation providers to register the identity documents of guests aged 16 and over with the Spanish authorities within 24 hours of check-in. We fulfil this obligation via the SES.hospedajes system operated by the Spanish Ministry of the Interior.

You are required to provide a valid passport or national identity card at check-in. This data is submitted to the Spanish authorities and retained for the period required by law. Failure to provide valid identity documents may result in your booking being cancelled without refund.

6. Payment processing — Stripe

All payments are processed securely by Stripe via an encrypted payment gateway. Costadels does not receive or store your card number, CVV or bank details. Stripe processes your payment data under its own privacy policy. By making a payment on our website, you agree to Stripe's data processing terms.

7. Data sharing

We do not sell your personal data to third parties. We may share your data with:

• Stripe: For payment processing
• Spanish authorities: As required by law for guest registration via SES.hospedajes
• Our local management partners (e.g. housekeeping, key handover staff) where necessary to fulfil your booking

8. Data retention

We retain your personal data for as long as necessary to fulfil the purposes described in this policy:

• Booking and payment records are retained for a minimum of five years for accounting and legal purposes
• Identity document data is retained for the period required under Spanish law
• Marketing consent records are retained until you unsubscribe

You may request deletion of your data at any time. We will comply unless retention is required by law.

9. Your rights

Under GDPR and Norwegian data protection law, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your data where legally permissible
• Restrict or object to processing in certain circumstances
• Receive your data in a portable format
• Withdraw consent for marketing at any time

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

10. Cookies

Our website uses cookies. Please see our Cookie Policy for full details.

11. Changes to this policy

We may update this Privacy Policy from time to time. The current version is always available on this page. Material changes will be communicated by email to guests with active or recent bookings.