Privacy policy
This policy explains who is responsible for the personal data collected through benalbeach-apartments.com and in connection with stays in our apartments, what data we collect, why, how long we keep it and what rights you have under the EU General Data Protection Regulation (GDPR) and Spanish data protection law (LOPDGDD).
Last updated: 2026-09-28
Data controller
Ionuț Muscalu (private individual), NIE X7133661G.
Address: Avenida del Parque 3, Bloque 3, Edificio Benalbeach, 29630 Benalmádena (Málaga), Spain.
Email: vipmalaga@live.com · Phone / WhatsApp: +34 611 690 915.
Tourist licences: VUT/MA/39774 (Sea View Apartment) and VFT/MA/32191 (Beach Studio).
What data we collect
Contact form and messages: name, email address, phone number (optional), travel dates, number of guests and the text of your message.
Direct bookings: name, email, phone, country, dates, number of guests, price and payment status, managed in our booking system Smoobu (Smoobu GmbH, Germany). Card payments are processed by Stripe (Stripe Payments Europe, Ltd., Ireland); we never see or store your full card number.
Guest registration: the identity details that Spanish law requires for every guest (see below).
Technical data: IP address, browser type and pages requested, recorded automatically in the server logs of our web host for security.
Statistics: anonymous usage data from Google Analytics, only if you accept statistics cookies.
Why we use your data and on what legal basis
To answer your questions and send quotes — steps taken at your request before a contract (art. 6.1.b GDPR).
To manage your booking, stay, payments and invoices — performance of the contract (art. 6.1.b GDPR).
To register guests with the Spanish police authorities (Real Decreto 933/2021) and to meet tax and accounting obligations — legal obligation (art. 6.1.c GDPR).
To measure how the website is used with Google Analytics — your consent (art. 6.1.a GDPR), which you can withdraw at any time.
To keep the website secure and prevent abuse — our legitimate interest (art. 6.1.f GDPR).
We do not use your data for automated decision-making or profiling, and we do not send newsletters or advertising.
Guest registration (RD 933/2021)
Spanish law requires every tourist accommodation to record the details of all guests and send them to the Guardia Civil or Policía Nacional: full name, nationality, date of birth, identity document type and number (for guests aged 14 and over), address, contact details, dates of stay, and the relationship to the adult for guests under 14. This data is used only for this purpose and kept for 3 years, as the law requires.
How long we keep your data
Enquiries that do not lead to a booking: up to 24 months.
Booking, payment and invoice records: for the period required by Spanish tax and commercial law (generally 4 to 6 years).
Guest registration records: 3 years.
Google Analytics data: 14 months.
Server logs: according to our web host's retention settings, normally a few weeks.
After these periods the data is deleted or anonymised.
Who receives your data
Service providers that process data on our behalf: Smoobu GmbH (booking system, EU), Stripe Payments Europe, Ltd. (card payments, EU), Newfold Digital / Bluehost (website hosting) and, only with your consent, Google Ireland Ltd (Google Analytics).
If you book through Booking.com, Airbnb or another platform, that platform also processes your data under its own privacy policy.
Public authorities when required by law: Guardia Civil / Policía Nacional (guest registration) and the Spanish tax authorities.
We never sell, rent or give away your data for marketing purposes.
Transfers outside the EU
Some providers (for example Google or our web host) may process data in the United States. These transfers are covered by the EU–US Data Privacy Framework or by the European Commission's standard contractual clauses.
Cookies
Technical cookie: PHPSESSID, a session cookie set by the website itself so that forms work securely. It is deleted when you close the browser and does not require consent.
Statistics cookies (Google Analytics): _ga and _ga_*, which store an anonymous identifier for up to 2 years. They are set only after you click “Accept” in the cookie banner. If you click “Reject”, Google Analytics is not loaded at all.
We store your choice in your browser's local storage so that we don't ask again on every page. You can change your choice at any time with the “Cookie settings” link at the bottom of every page, or delete cookies in your browser settings.
The booking calendar on the booking page is provided by Smoobu and may set its own technical cookies needed for the booking process.
Your rights
You can ask for access to your data, rectification, erasure, restriction of processing, data portability and object to processing. Where processing is based on consent, you can withdraw it at any time without affecting processing carried out before.
To exercise your rights, write to vipmalaga@live.com. We may ask you to prove your identity. We will reply within one month.
If you believe your rights have not been respected, you can file a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).
Minors
This website is not directed at children. Bookings can only be made by adults. Data about guests under 14 is collected only from their parent or guardian and only for the legal guest registration.
Security
The website uses an encrypted HTTPS connection. We apply reasonable technical and organisational measures to protect your data against loss, misuse and unauthorised access, and we only keep the data we actually need.
Changes to this policy
We may update this policy when the law or our services change. The date of the latest version is shown at the top of this page.