Last updated: August 2026
1. Controller
The controller for data processing on this website is:
Markus Pauly, Kalbacher Hauptstraße 42a, 60437 Frankfurt am Main, Germany.
Contact details are given in the legal notice.
2. Overview
This is the private letting website for a single holiday house. We process personal data only where it is needed to run the site and handle booking enquiries. There is no sharing of data for advertising, no tracking profiles and no social media plugins.
3. Server log files
Our hosting provider automatically collects and stores information in server log files that your browser transmits: browser type and version, operating system, referring URL, host name of the accessing device, time of the request and IP address. This data is not combined with other sources. The legal basis is Art. 6(1)(f) GDPR – our legitimate interest in the technically sound and secure operation of the site.
4. Analytics with Koko Analytics
We use Koko Analytics to understand how the site is used. All processing happens on our own server. No data is transferred to third parties and no personal profiles are created. Koko Analytics sets a single technically necessary cookie that distinguishes new from returning visits and does not allow identification. IP addresses are not stored. The legal basis is Art. 6(1)(f) GDPR.
5. Security: NinjaFirewall
We run a web application firewall to protect against attacks. IP addresses and request data are evaluated briefly and logged where access looks suspicious. The legal basis is Art. 6(1)(f) GDPR – our legitimate interest in defending against attacks.
6. Cookie consent
We use a consent tool to manage your choices. It stores your selection locally in your browser so that the prompt is not repeated on your next visit. You can withdraw your consent at any time via the cookie notice.
7. Enquiries
When you contact us through the enquiry form or by e-mail, we process the details you provide – name, e-mail address, preferred dates, number of guests and your message – in order to deal with your enquiry. The legal basis is Art. 6(1)(b) GDPR, as the processing is necessary for pre-contractual steps. We delete this data once the matter is closed and no statutory retention periods apply.
8. Reporting to the Spanish authorities
Once a booking is made, Spanish law requires us as the host to transmit the details of all arriving guests to the registration system operated by the Spanish Ministry of the Interior (SES.HOSPEDAJES). This covers name, identity document details, date of birth, nationality and the dates of arrival and departure. The legal basis is Art. 6(1)(c) GDPR – compliance with a legal obligation. Accommodation cannot lawfully be provided without this transmission.
9. YouTube video
A video hosted on YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) is embedded on the home page. We use a two-click solution: when the page loads, only a preview image served from our own server is displayed. No connection to Google is made unless you start the video. Only when you click the preview is the video loaded via youtube-nocookie.com, at which point Google receives your IP address and other browser data. The legal basis is the consent you give by clicking, under Art. 6(1)(a) GDPR.
10. Affiliate advertising (Awin)
An advertising banner from the affiliate network Awin (AWIN AG, Eichhornstraße 3, 10785 Berlin, Germany) is embedded on the “Getting Here” page. When the page loads, the banner is retrieved from Awin’s servers; your IP address and browser data are transmitted to Awin and cookies may be set that attribute a later booking to our referral. If you book through the banner we receive a commission; there is no extra cost to you. The legal basis is Art. 6(1)(f) GDPR – our legitimate interest in helping fund the site. You can object via the cookie settings.
11. Flight arrivals (Avionio)
An arrivals board for Seville airport, provided by Avionio, is embedded on the “Getting Here” page. The board is loaded in an embedded frame from the provider’s servers as soon as you scroll to it. Your IP address and browser data are transmitted to Avionio in the process. The legal basis is Art. 6(1)(f) GDPR – our legitimate interest in giving guests current flight information for their journey.
12. TLS encryption
This site uses TLS encryption for security. You can recognise an encrypted connection by the padlock symbol in your browser bar. While encryption is active, the data you send us cannot be read by third parties.
13. Your rights
You have the right at any time to obtain free information about your stored personal data, its origin and recipients and the purpose of processing (Art. 15 GDPR), and rights to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You may withdraw any consent given at any time with effect for the future. An informal message to the contact details in the legal notice is sufficient.
14. Right to complain
You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the Hessian Commissioner for Data Protection and Freedom of Information, Postfach 3163, 65021 Wiesbaden, Germany.
15. Objection to marketing e-mails
We hereby object to the use of contact data published under our legal notice obligations for sending unsolicited advertising. We reserve the right to take legal action in the event of unsolicited advertising being sent.