1. Data controller
The data controller for personal data collected through this website is:
- Business name: Malaga Hostel Lemon Tree S.L.
- NIF/CIF: B-16448573
- Address: Calle González Anaya nº 16, 29009 Málaga, Spain
- Email: info@lemontreehostel.com
We have not appointed a Data Protection Officer, as it is not required for a business of our size and nature. For any data protection matter, contact us at the email address above.
2. What data we collect
We may collect the following personal data:
- Name, email address and telephone number (when contacting us or making a reservation)
- ID document details, required by Spanish law for guest registration when you check in
- Payment information (processed securely through our booking management platform)
- Browsing data (collected anonymously via analytics tools — see Cookies Policy)
Providing your name and email address is necessary to process a booking or respond to an enquiry — without it we won't be able to do so. Any other data we ask for is optional.
3. Why we process your data, and on what legal basis
- Reservations — to manage your booking and communicate about your stay. Legal basis: performance of a contract.
- Customer service — to respond to enquiries and requests sent through this website. Legal basis: performance of a contract / legitimate interest in answering enquiries.
- Guest registration — reporting required identification data to the Policía Nacional. Legal basis: compliance with a legal obligation.
- Fraud and abuse prevention — for example, verifying that contact-form submissions are not automated. Legal basis: legitimate interest in keeping our services secure.
- Marketing — only by email and only if you opt in. Legal basis: your consent, which you can withdraw at any time.
4. Automated decision-making
We do not carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.
5. How long we keep your data
We retain personal data for no longer than necessary for the purpose for which it was collected, and in any case for the period required by applicable law. Booking data is kept for a minimum of 5 years in line with tax and accounting obligations. Guest registration data reported to the Policía Nacional is kept for the period required by Spanish security legislation.
6. Who we share your data with
We do not sell or rent your personal data to third parties. We may share data with:
- Booking management platform — used to process and manage your reservation
- Policía Nacional / Guardia Civil — as required by Spanish law for accommodation providers
- Service providers acting as data processors (e.g. email delivery, anti-spam verification, hosting), bound by confidentiality and data processing agreements
7. International transfers
Some of our service providers may process data outside the European Economic Area. In such cases, appropriate safeguards are in place in accordance with GDPR Chapter V (such as Standard Contractual Clauses or an adequacy decision).
8. Your rights
Under the GDPR and Spanish data protection law (LOPDGDD), you have the right to:
- Access your personal data
- Request rectification of inaccurate data
- Request erasure ("right to be forgotten")
- Object to or restrict processing
- Data portability
- Withdraw consent at any time (where processing is based on consent), without affecting the lawfulness of processing before withdrawal
- Lodge a complaint with the Agencia Española de Protección de Datos (aepd.es)
To exercise your rights, contact us at info@lemontreehostel.com with a copy of your ID document.
9. Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction or alteration.
10. Changes to this policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by posting a notice on our website or by email where appropriate.