1. Data controller
The data controller for personal data collected through this website is:
- Business name: [Razón social — pending]
- NIF/CIF: [NIF — pending]
- Address: Calle González Anaya nº 16, 29009 Málaga, Spain
- Email: info@lemontreehostel.com
2. What data we collect
We may collect the following personal data:
- Name, email address and telephone number (when contacting us or making a reservation)
- Payment information (processed securely through our booking provider, Cloudbeds)
- Browsing data (collected anonymously via analytics tools — see Cookies Policy)
3. Why we process your data
We use your personal data for the following purposes:
- Reservations: To manage your booking and communicate any relevant information about your stay
- Customer service: To respond to enquiries and requests
- Legal obligations: To comply with applicable legislation (e.g. guest registration for the Policía Nacional)
- Marketing: Only with your explicit consent and only by email
4. Legal basis for processing
- Execution of a contract (your booking)
- Compliance with a legal obligation
- Legitimate interests of the controller
- Your consent, where required
5. How long we keep your data
We retain personal data for no longer than necessary for the purpose for which it was collected, and in any case for the period required by applicable law. Booking data is kept for a minimum of 5 years in line with tax and accounting obligations.
6. Who we share your data with
We do not sell or rent your personal data to third parties. We may share data with:
- Cloudbeds — our reservation management platform
- Policía Nacional / Guardia Civil — as required by Spanish law for accommodation providers
- Service providers acting as data processors, bound by confidentiality agreements
7. International transfers
Some of our service providers (such as Cloudbeds) may process data outside the European Economic Area. In such cases, appropriate safeguards are in place in accordance with GDPR Chapter V.
8. Your rights
Under the GDPR and Spanish data protection law (LOPDGDD), you have the right to:
- Access your personal data
- Request rectification of inaccurate data
- Request erasure ("right to be forgotten")
- Object to or restrict processing
- Data portability
- Withdraw consent at any time (where processing is based on consent)
- Lodge a complaint with the Agencia Española de Protección de Datos (aepd.es)
To exercise your rights, contact us at info@lemontreehostel.com with a copy of your ID document.
9. Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction or alteration.
10. Changes to this policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by posting a notice on our website or by email where appropriate.
Last updated: July 2026