Privacy policy
Last updated: 29-08-2026
This is a translation for information only. In case of any discrepancy, the Spanish version prevails.
1. Data controller
- Identity
- Iván Pérez Gil
- Tax ID (NIF)
- 26262866V
- Address
- C. Periodista Juan Rejano 1, Bajo A, 29620 Torremolinos (Málaga), España
- info@costivia.com
2. What data we process and why
We process the data you give us and the data your visit generates, for these purposes:
- To answer your enquiries about availability and price, received by email, WhatsApp or phone.
- To manage the booking and the stay: guest identification, check-in, check-out and any incidents.
- To meet the legal obligations of record-keeping and reporting of traveller data that apply to accommodation businesses, under Spanish Royal Decree 933/2021.
- To meet the tax and accounting obligations arising from the relationship.
- To understand how the site is used so we can improve it, through analytics, if you accept the relevant cookies.
3. Legal basis
- Performance of a contract or pre-contractual steps, to answer your enquiry and manage the booking.
- Compliance with a legal obligation, for traveller registration and tax obligations.
- Your consent, for analytics cookies and for commercial communications, if you authorise them. You may withdraw it at any time.
4. Retention
We keep the data for as long as the relationship lasts and, afterwards, for the statutory limitation periods for tax, accounting and liability obligations. Traveller registration data is kept for the period required by the rules that mandate it. Once no longer needed, it is deleted.
5. Recipients and processors
We do not sell your data or transfer it to third parties for their own use. To provide the service we rely on these suppliers, acting as processors:
| Supplier | Purpose | Where |
|---|---|---|
| Vercel Inc. | Website hosting | United States, with EU infrastructure |
| Supabase Inc. | Apartment database | European Union |
| Microsoft (Clarity) | Website usage analytics | United States |
| Email and WhatsApp provider | Communicating with you | Depending on the provider |
6. International transfers
Some of the suppliers above are established in the United States. Those transfers rely on the EU–US Data Privacy Framework or on the standard contractual clauses approved by the European Commission, depending on the supplier.
Analytics involving a transfer is only activated if you accept the relevant cookies.
7. Your rights
You may exercise the following rights at any time:
- Access your personal data.
- Request rectification of inaccurate data.
- Request erasure when the data is no longer necessary for the purposes for which it was collected.
- Request restriction of processing.
- Object to processing.
- Request portability of your data.
- Withdraw consent, without affecting the lawfulness of processing carried out beforehand.
8. How to exercise them and where to complain
Write to info@costivia.com stating the right you wish to exercise and attaching a copy of your ID card, passport or equivalent document so that we can identify you.
If you believe we have not handled your request properly, you may complain to the Spanish Data Protection Agency (www.aepd.es).
9. Security and accuracy of the data
The owner undertakes to keep personal data confidential and to adopt the measures needed to prevent its alteration, loss, unauthorised processing or access, taking into account the state of the art.
The user warrants that the data provided is true, accurate, complete and up to date, and is liable for any damage caused by failing to meet this obligation.