Privacy policy

Privacy Policy

Last updated: 15 October 2026

1. Data controller

The controller of your personal data is Vesta Ikario S.L., CIF/NIF: B88821756, C/ Córdoba 37, 1B, 29640 Fuengirola (Málaga), Spain, email: vesta@ikario.es, phone: +48 664 588 464.

2. What data we process and why

• Bookings and stays – name, contact details, dates of stay, number of guests and payment details – to enter into and perform the contract (Art. 6(1)(b) GDPR).
• Guest registration – identity document details, date of birth, nationality, address and other data required by Spanish law (Real Decreto 933/2021) – submitted to the Ministry of the Interior’s SES.Hospedajes system to comply with a legal obligation (Art. 6(1)(c) GDPR).
• Invoices and accounting – to comply with tax and accounting obligations (Art. 6(1)(c) GDPR).
• Contact and enquiries (email, phone, WhatsApp, forms), including enquiries from owners and agencies about working with us – to reply and prepare an offer (Art. 6(1)(b) and (f) GDPR).
• Newsletter – your email address, based on your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
• Website analytics and cookies – data on how you use the website, based on your consent (Art. 6(1)(a) GDPR).

3. Recipients

Data is shared only to the extent necessary with: our booking system and website provider (Hotres), booking platforms if you book through them (e.g. Booking.com, Airbnb), banks and payment providers, analytics and communication tool providers (Google, WhatsApp/Meta), our accounting and legal advisers, and competent public authorities, including the Spanish Ministry of the Interior (SES.Hospedajes) and tax authorities.

4. Transfers outside the EEA

Some providers (e.g. Google, Meta) may process data outside the European Economic Area. Such transfers are based on a European Commission adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses.

5. How long we keep data

• Guest registration data – 3 years after the end of the stay, as required by RD 933/2021.
• Booking data, invoices and statements – for the period required by tax and commercial law.
• Enquiries and correspondence – until the matter is closed and then for the limitation period of any claims.
• Newsletter and analytics cookies – until you withdraw your consent.

6. Your rights

You have the right to access, rectify and erase your data, to restrict processing, to data portability and to object, as well as to withdraw your consent at any time (without affecting the lawfulness of earlier processing). To exercise these rights, write to vesta@ikario.es. You may also lodge a complaint with the Spanish Data Protection Agency – Agencia Española de Protección de Datos (www.aepd.es) – or with the supervisory authority in your country of residence.

7. Cookies

The website uses strictly necessary cookies required for it to work and to process bookings and – with your consent – analytics cookies set via Google Tag Manager. You can change your cookie settings in your browser.

8. Providing data

Providing your data is voluntary but necessary to make a booking. Providing data for guest registration is a legal obligation under Spanish law.

9. Changes

We may update this policy. The current version is always available on this page.