Privacy policy

Last updated: April 2026

1. Data controller

In compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), we inform you that the controller of your personal data is:

Company name: Grupo Empresarial Alme S.L.
CIF (Tax ID): B93521813.
Trading name: Apartamentos Villa Torcal.
Registered address: Calle Lope de Rueda, 35, 29190, Málaga, Spain.
Email: apartamentos@torcal.es.
Telephone:+34 600 950 652.
Activity: Tourist accommodation.

2. Data we collect

For the purpose of managing bookings and providing our accommodation services, we may collect and process the following personal data:

  • Identification data: first name, surname(s), identity document or passport number, date of birth and nationality.
  • Contact data: postal address, email address and telephone number.
  • Booking data: arrival and departure dates, number of occupants, preferences and special requests.
  • Payment data: information needed to process payment for the booking, handled through secure payment platforms.
  • Browsing data: IP address, browser type and pages visited on our website, via technical cookies.

3. Purposes and legal basis for processing

Your data will be processed for the following purposes:

  • Managing the booking and providing the service: performance of a contract (Art. 6.1.b GDPR).
  • Compliance with legal obligations such as guest registration with the competent authorities and tax obligations: compliance with a legal obligation (Art. 6.1.c GDPR).
  • Marketing communications about our services, only with your prior consent: consent of the data subject (Art. 6.1.a GDPR).
  • Handling enquiries and complaints: legitimate interest of the controller (Art. 6.1.f GDPR).

4. Retention period

Your data will be kept for as long as necessary to fulfil the purpose for which it was collected and, in any case, for the periods established by law. Booking data will be kept for a minimum of 5 years for tax and accounting purposes. Guest registration data will be kept in accordance with the public security legislation in force.

5. Recipients of the data

Your personal data may be disclosed to the following recipients:

  • State Security Forces and Corps and competent authorities, in compliance with the regulations on accommodation and guest registration.
  • Tax Authorities, in compliance with tax obligations.
  • Booking platforms and distribution channels through which the booking was made.
  • Technology service providers(data processors) under a confidentiality agreement and in compliance with the GDPR.

No international transfers of data outside the European Economic Area will take place unless appropriate safeguards are guaranteed in accordance with the GDPR.

6. Rights of the data subject

You have the right to exercise the following rights over your personal data at any time:

  • Access: to know which of your personal data we process.
  • Rectification: to correct inaccurate or incomplete data.
  • Erasure: to request the deletion of your data when it is no longer necessary for the purpose for which it was collected.
  • Objection: to object to the processing of your data in certain circumstances.
  • Restriction of processing: to request that the processing of your data be restricted.
  • Portability: to receive your data in a structured, commonly used and machine-readable format.
  • Withdrawal of consent: at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise these rights, please write to the postal address given in section 1 or to apartamentos@torcal.es, stating the right you wish to exercise. You have the right to lodge a complaint with the Agencia Española de Protección de Datos (AEPD, Spanish Data Protection Agency) at www.aepd.es if you consider that the processing of your data does not comply with the legislation in force.

7. Cookies

Our website may use technical cookies that are necessary for it to function properly. No tracking, analytics or advertising cookies are used without the user's prior consent. By continuing to browse our website, you accept the use of strictly necessary technical cookies.

8. Data security

We have adopted appropriate technical and organisational security measures to protect your personal data against loss, misuse, unauthorised access, disclosure, alteration or destruction, in accordance with the GDPR and applicable Spanish legislation.

9. Changes to this statement

We reserve the right to update this Privacy Statement at any time to adapt it to legislative or case-law changes or to changes in our services. The current version will always be available on our website. We will inform you of any substantial changes through our usual communication channels.