Privacy & Cookie Policy
Last updated: 20 May 2026
1. Who is the data controller?
The data controller for personal data processed through costastay.homes is Richard Lagrand (sole trader, autónomo), trading as Costa Stay. NIE: X2057755Z. Registered address: Calle Peña del Aguila 6, 11520 Rota, Cádiz, Spain. Contact: hello@costastay.homes.
2. What data we collect
We process the personal data you provide to us when you contact us through this site — typically your name, email address, phone number (often a WhatsApp number), preferred travel dates, number of guests and the property you are interested in, plus any message you choose to send us. We also process technical data automatically when you visit the site (IP address, browser type, pages visited) for security and analytics.
3. Why we use it (purposes and legal bases)
We use your data to (a) respond to your enquiry, draft a rental proposal, and where relevant prepare a rental contract — legal basis: pre-contractual measures and, once a contract is signed, contract performance; (b) send you the occasional newsletter or seasonal guide if you explicitly subscribed — legal basis: your consent, which you can withdraw at any time; (c) measure how visitors use the site and improve it — legal basis: your consent via the cookie banner; (d) comply with our legal, tax and accounting obligations — legal basis: legal obligation.
4. Who we share data with
We do not sell your data. We share it only with service providers that help us run the site and respond to you. These are our current processors:
- Sanity (Sanity.io, USA/EU) — content management for property listings.
- Resend (USA) — sending enquiry confirmation and team notification emails.
- Brevo (France/EU) — newsletter list and bilingual seasonal guides.
- Umami (EU) — privacy-friendly analytics, no cross-site tracking.
- Meta / Facebook Pixel (USA, Ireland) — measuring ad campaign effectiveness, loaded only after you accept cookies.
- Netlify (USA) — hosting and content delivery.
Where data is transferred outside the European Economic Area, we rely on the European Commission's Standard Contractual Clauses or an adequacy decision.
5. How long we keep it
Enquiry messages are kept for up to 24 months after our last contact, so we can follow up on returning interest. If you become a guest, your contract and invoicing data are kept for the period required by Spanish tax law (currently 4 years for tax records, up to 6 years under the Spanish Commercial Code). Newsletter subscribers stay on our list until they unsubscribe.
6. Your rights
Under the GDPR you have the right to access, correct or delete your personal data, to restrict or object to its processing, to data portability, and to withdraw any consent you previously gave. To exercise any of these rights, email hello@costastay.homes. You can also lodge a complaint with the Spanish data protection authority (Agencia Española de Protección de Datos, www.aepd.es).
8. Changes to this policy
We may update this policy from time to time. The date at the top reflects the most recent change.