Privacy Notice

1. Who is responsible

Marta Aragón, trading as Kaluma Stays, NIF 44138671S, of Av. Calderón de la Barca, Magna Marbella 48, 29660 Marbella, Málaga, Spain, privacy contact privacy@kalumaliving.com, is the controller of the personal data obtained through the website and Kaluma's own channels, enquiries and bookings, managing the stay, and meeting the obligations that apply to the tourism operation.

AT Newman Property Limited, company number 08824534, registered office 495 Green Lanes, London N13 4BS, United Kingdom, owns the property and acts as an independent controller only in respect of the data it receives for settlements, tax, insurance, damage, claims and compliance with its own obligations. It is not a general joint controller of Kaluma Stays' processing.

2. What data is processed

Kaluma may process:

• identification details, signature and contact details;
• enquiry, proposal, booking, accompanying guests, dates, occupancy and stay;
• the data required by the traveller-registration rules;
• communications, requests, incidents and operational preferences;
• billing, payments, refunds and deposit data, without storing full card details;
• inventories, photographs or video limited to the condition of the property and to incidents;
• technical and security data from the website and, where consent exists, analytics or marketing.

Copies, scans or photographs of identity documents are not ordinarily requested or retained. The original document is shown so the details can be verified where that is compulsory.

3. Purposes and legal bases

• Answering enquiries and preparing a proposal — pre-contractual steps requested by the individual.
• Making and managing the booking and the stay — performance of the contract.
• Payments, refunds, the deposit, inventory, damage and claims — performance of the contract, and legitimate interests in security, fraud prevention and legal defence.
• Traveller registration and communication, and tourism, tax and accounting obligations — compliance with legal obligations, including Royal Decree 933/2021.
• Systems security, abuse prevention and continuity — legitimate interest and security obligations.
• Marketing not necessary for the booking — consent, where required; it can be withdrawn at any time.

Where a piece of data is required in order to contract or to meet a legal obligation, refusing to provide it may prevent the accommodation being confirmed or provided.

4. Who receives it

Data may be shared, to the extent necessary, with:

• the Ministry of the Interior, law-enforcement bodies and other competent authorities;
• AT Newman Property Limited, for financial reconciliation, tax, insurance, damage and claims;
• financial institutions, the payment gateway and card issuers, for payments, pre-authorisations, refunds and fraud;
• cleaning, maintenance, concierge and other requested service providers, limited to what they need;
• advisers, insurers, courts and authorities where necessary for obligations or claims.

Technology providers processing data on Kaluma's behalf are subject to Article 28 GDPR contracts. Where a provider involves a transfer outside the European Economic Area, an adequacy decision, standard contractual clauses or another valid safeguard is used.

5. How long it is kept

• Enquiries that do not become bookings: up to 12 months from the last interaction, unless you object or a claim requires otherwise.
• Booking, contract, payments, invoicing and essential communications: for the relationship and the legal tax, accounting and liability periods.
• The documentary traveller register: three years from the end of the service, under Royal Decree 933/2021.
• Deposit, inventories and incidents: until closed, and for the applicable claim period.
• Marketing: until consent is withdrawn or you object.

When the period ends, data is deleted or blocked as appropriate.

6. Your rights

You can request access, rectification, erasure, objection, restriction and portability, and withdraw a consent, by writing to privacy@kalumaliving.com and identifying your request. Where there is reasonable doubt about identity, proportionate additional information will be requested; a full copy of your document will not routinely be asked for.

You can also complain to the Spanish Data Protection Agency: https://www.aepd.es.

7. Automated decisions

Kaluma does not take decisions with legal effects based solely on automated processing. Fraud or payment checks may lead to a human review or to a request for a different payment method.

8. Changes

The version that applies to a booking is the one given to the guest when they accepted it, without prejudice to changes required by law. Material changes will be communicated by an appropriate means.