1. Controller
The controller is HET KRUIDENNIERTJE, S.A., tax identifier A29757945, Avda. Carlota Alessandri 43, 29620 Torremolinos, Málaga, España. Costa Guest is the service/trade name. Privacy contact: privacy@costaguest.com.
2. Data we may process
Depending on how you use Costa Guest, we may process the following categories:
- Account and authentication data, such as name, email address, account identifiers and security/session information.
- Business or host account data, claim/verification information, listing edits, media and support communications submitted by authorised users.
- Guest/stay context supplied through an authorised stay flow, and Concierge messages needed to provide the requested assistance.
- Saved places, trip-planning inputs and explicit preferences you choose to provide. We do not require precise location unless a specific feature asks for it and you choose to allow it.
- Billing and subscription references when paid services are enabled. Payment-card data is handled by the payment provider and is not intended to be stored by Costa Guest.
- Technical, security and abuse-prevention information such as IP-derived security events, timestamps, request metadata and audit records where necessary to operate and protect the service.
- Affiliate/click attribution data designed to avoid unnecessary personal data, for example pseudonymous campaign/click identifiers.
- Business information obtained from the business itself or legitimate public/business sources when needed to maintain the local directory or contact a business in a lawful B2B context.
3. Purposes and legal bases
We process data only for defined purposes and with an applicable legal basis.
- Provide accounts, Concierge, trip tools, business/host services and requested features: performance of a contract or steps requested before entering one.
- Operate security, prevent abuse, protect users and maintain auditability: our legitimate interests in running a secure and reliable service, balanced against user rights.
- Billing, accounting, tax and legal compliance: compliance with legal obligations and performance of the relevant contract.
- Optional marketing/newsletters, if introduced: consent or another lawful basis expressly permitted by law; an easy opt-out will be provided.
- Non-essential analytics/advertising storage, if introduced: prior consent where required. It is not part of the current V1 code inventory.
4. Recipients and service providers
We use specialised providers to host and operate the service. The current architecture includes Supabase for backend/database/authentication, Vercel for web hosting/deployment, OpenAI for bounded AI-assisted features, and Stripe for payment processing when the relevant billing feature is enabled. Additional email, affiliate or operational providers may be added only after the production privacy/vendor inventory is updated.
Third-party booking/activity/transport providers reached through an outbound link generally process the data you provide to them under their own privacy terms. Costa Guest does not need to send them more personal data than is necessary for the relevant integration or attribution flow.
5. International transfers
Some service providers may process data outside the European Economic Area. Where this occurs, Costa Guest will rely on an applicable lawful transfer mechanism, such as an adequacy decision or appropriate safeguards, and will keep the production vendor/transfer register under review.
6. Retention
We keep personal data only for as long as necessary for the purpose for which it was collected, while the account or service relationship is active, and afterwards only for the periods required to meet legal obligations, resolve disputes, prevent abuse or establish/defend legal claims. Security logs and temporary technical data are kept for proportionate periods. Data no longer needed is deleted or irreversibly anonymised where appropriate.
7. Your rights
You may request access, rectification, erasure, restriction, portability where applicable, or object to processing. Where processing is based on consent, you may withdraw it at any time without affecting earlier lawful processing. Contact privacy@costaguest.com. We may need to verify your identity before acting on a request.
You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at aepd.es.
8. Automated recommendations
Costa Guest may use automated ranking or recommendation logic to organise travel information and suggestions. It is not intended to make decisions that produce legal effects or similarly significant effects about individuals. Commercial relationships must not override safety rules or automatically buy organic relevance.
9. Children
The public destination information can be viewed by families, but Costa Guest is not designed to collect account data directly from young children. We do not intentionally request special-category or medical data from children. Where parental/guardian authorisation is legally required, the relevant service must not be used without it.
10. Changes
We may update this policy when the service, providers or legal requirements change. Material changes will be reflected by a new update date and, where required, an appropriate notice or renewed consent.
Newsletter and marketing communications
If the Costa Guest newsletter is enabled in V1, subscription will be optional and separate from creating an account or buying Costa Guest+. We will not pre-tick a marketing box or make newsletter consent a condition of an unrelated service.
For a consent-based newsletter we will record the email address, consent status, timestamp, source/form and the version of the consent wording so that consent can be demonstrated. Consent can be withdrawn at any time through the unsubscribe mechanism in each marketing email or by contacting privacy@costaguest.com. Withdrawal does not affect processing already carried out lawfully.
Newsletter sending will not be activated until the selected email provider's processor terms, data location/transfers, retention, consent and unsubscribe handling have been incorporated into the production vendor/privacy controls and the newsletter launch gate has passed.
Email provider and international transfers
Costa Guest uses Resend as an email infrastructure provider for approved transactional/inbound email functions and, only if the separate newsletter gate is later activated, for newsletter transport. Newsletter marketing consent remains separate, optional and unchecked by default.
Resend's current provider documentation states that customer data is stored in the United States. For transfers of personal data from the EEA, Resend states that its Data Processing Addendum uses the European Commission Standard Contractual Clauses and that it participates in the EU-U.S. Data Privacy Framework. Costa Guest will keep the applicable processor/transfer evidence under review and will not treat the selected eu-west-1 sending region as EU data residency.
Resend currently states a 30-day retention period for email/log data on the relevant standard plans, with separate backup and account-termination periods. Marketing Contact records have their own lifecycle, so Costa Guest must apply its separate consent, unsubscribe and retention/deletion controls rather than assuming that Contact records automatically follow the email/log period.
First-party traffic measurement
Costa Guest measures aggregate use of public pages to understand visitor volumes, popular pages, external referrer domains, language/device mix and approximate country/city signals supplied by the hosting platform. Internal Control Tower, dashboard, Business Portal, API and redirect routes are excluded.
The traffic layer does not store raw IP addresses, raw user-agent strings, query strings or full referrer URLs. It stores server-side HMAC pseudonyms for visitor/session counting plus bounded page, locale, device class and approximate geography. Browser Do Not Track (DNT=1) is respected and known bots are excluded.
IP-derived country/city signals are approximate and are used only for aggregate product analytics, not for precise location, advertising or safety decisions.
Costa Guest may also record bounded first-party conversion events such as opening a business-claim page, reaching authenticated claim access, attempting submission and completing a server-verified claim. These analytics events do not store the claim form's email, phone, claimant name, typed business name, free-text message, authentication user ID or verification evidence.
Costa Guest may additionally measure bounded public-product actions such as opening a Place from Discover, adding a Place to a day plan, successfully saving a Place, or clicking a call, website, WhatsApp, booking or concierge action. Raw search text and free-form filter text are not stored in this analytics dataset, and these signals are not used to change public ranking without a separate governance decision.
For itinerary and affiliate continuity, Costa Guest may record a save attempt, a server-verified saved-trip reference and a server-side affiliate redirect reference. These events do not store trip names or notes, provider destination URLs, account user IDs or raw request identifiers. An affiliate redirect click is not treated as a booking, sale, commission or revenue.