Privacy Policy – CostaCabana
This privacy policy explains how we handle personal data when you visit our websites (costacabana.com, .nl, .de, .fr, .be, .ch and .eu), contact us, or book and stay in one of our holiday homes on the Costa Brava. The English version is the master text; translations are provided for convenience.
1. Who we are
The controller responsible for your personal data is:
Swiss Quality Homes SA, trading as CostaCabana ("we", "us")
Avenue de Grandson 48
CH-1400 Yverdon-les-Bains
Switzerland
Company number (UID/IDE): CHE-388.201.763
Privacy contact: [email protected]
We are a Swiss company and process your data under the Swiss Federal Act on Data Protection (FADP/nDSG). Because we offer holiday rentals to guests in the European Union and the homes are located in Spain, the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) also applies to our processing (Article 3(2) GDPR), together with the relevant Spanish rules, in particular on guest registration.
We have not appointed a data protection officer. You can contact us with any privacy question at the address above.
2. What data we process and where it comes from
Depending on how you deal with us, we process:
- Contact and booking data: name, address, email address, phone number, preferred language, the home and dates booked, number of guests, special requests and the booking history.
- Guest registration data: the identity details Spanish law requires for every guest, such as full name, ID or passport type and number, nationality, date of birth, sex, address and, for minors, their relationship to the accompanying adult (see section 4).
- Payment data: amounts, payment method, transaction references and payment status. Card and account details are handled by the payment provider. We do not store full card numbers ourselves.
- Communication data: the content of emails, WhatsApp messages, chat messages and phone calls with us or our local service team, including photos you send us.
- Stay data: check-in and check-out times, key-box and access arrangements, reports of damage or maintenance issues, deposit handling and any complaints.
- Account data: if you use "My Stays" on our website, your login details and the bookings linked to your account.
- Website and device data: IP address, browser and device type, pages visited and cookie identifiers (see section 7).
- Marketing data: your newsletter subscription and consent history.
Sources. We receive most data directly from you. If you booked through a platform such as Airbnb, we receive your booking and contact details from that platform. Your fellow travellers' details are provided by you or by them. Some data is generated by our website and tools when you use them.
If you are booking for others, please make sure they know about this policy.
3. Purposes, legal bases and retention
| Purpose | Data | Legal basis (GDPR) | How long we keep it |
|---|---|---|---|
| Handling your enquiry and booking, and running your stay (arrival information, access, cleaning, service, repairs) | Contact and booking data, stay data, communication data | Contract or steps before a contract (Art. 6(1)(b)) | Until the stay is completed and settled, then as part of the booking file: until the end of the limitation period |
| Guest registration with the police (section 4) | Guest registration data of every guest | Legal obligation (Art. 6(1)(c)) under Spanish Royal Decree 933/2021 and the Catalan rules | 3 years from the end of the stay, as required by that law |
| Payments, invoices and accounting | Booking data, payment data | Legal obligation (Art. 6(1)(c)) under Swiss accounting law | 10 years (Swiss Code of Obligations, art. 958f) |
| Tourist tax | Number of guests and nights, booking data | Legal obligation (Art. 6(1)(c)) | 3 years from the end of the stay, as required by that law |
| Customer service by email, phone, WhatsApp and website chat | Contact data, communication data | Contract (Art. 6(1)(b)) or our legitimate interest in answering questions (Art. 6(1)(f)) | As part of the booking file, or 12 months after the last contact if no booking follows |
| Disputes, complaints, damage claims, payment disputes and chargebacks | Booking, payment, stay and communication data | Our legitimate interest in establishing, exercising or defending legal claims (Art. 6(1)(f)) | As long as the claim is open, plus the applicable limitation period |
| Your "My Stays" account | Account data, booking data | Contract (Art. 6(1)(b)) | Until you close the account or inactive for 5 years |
| Newsletter and offers by email | Name, email address, language, consent history | Your consent (Art. 6(1)(a)) | Until you unsubscribe; proof of consent for as long as we need to demonstrate it |
| Website operation and security (strictly necessary cookies, server logs) | Website and device data | Our legitimate interest in a secure, working website (Art. 6(1)(f)) | Session end, max 1 year |
| Website statistics and advertising (analytics and marketing cookies) | Website and device data, cookie identifiers | Your consent (Art. 6(1)(a)) | Per the cookie settings (section 7) |
Where the law of Switzerland applies instead of the GDPR, we process data on the corresponding grounds under the FADP.
Do you have to give us your data? We need your contact and booking data to take a booking. Guest registration data is required by law: without it, we cannot let you check in. Newsletter and analytics/advertising cookies are always optional.
We do not make decisions about you based solely on automated processing.
4. Guest registration (Mossos d'Esquadra)
Spanish law (Royal Decree 933/2021) and the Catalan rules require every provider of tourist accommodation to register the identity of each guest and pass it to the police. In Catalonia this is the Mossos d'Esquadra.
How it works:
- Before arrival, you enter the registration details of each guest yourself, through the Traveller portal provided.
- On arrival, we check the details against the guests' ID documents.
- We then submit the details to the Mossos d'Esquadra, as the law requires.
The data covers the identity and document details listed in section 2, plus booking and payment details that the law requires.
Legal basis: legal obligation (Art. 6(1)(c) GDPR). Recipient: the Mossos d'Esquadra and, where the law requires, other competent Spanish authorities. Retention: 3 years, as the law requires, after which we delete it. If the details are not provided, we are legally unable to let you check in.
5. Who receives your data
We do not sell your data. We share it only where needed for the purposes above:
- Payment providers, such as PayPal, to process payments, refunds and payment disputes. Mollie, UBS and PayPal process data as an independent controller under its own privacy policy.
- Booking platforms, such as Airbnb, Booking.com etc., if you booked through them. They act as independent controllers under their own privacy policies.
- Home owners and local service partners (Holiday Service Costa Brava SL, for cleaning, maintenance and key handover) in the Lloret de Mar area. They receive only what they need for your stay, such as your name, arrival and departure dates and the number of guests.
- Communication and IT tools we use to work with your data, as our service providers: Missive (shared email inbox), WhatsApp (messaging, Meta), Google (Google Workspace / Drive for files and Google Tag Manager on our websites) and Cloudflare, Hetzner, Google for website delivery and security.
- Our accountant and advisers, lawyers and auditors, where needed, bound by professional secrecy or confidentiality.
- Authorities: the Mossos d'Esquadra (section 4), tax authorities (for example for the tourist tax), and courts or authorities where we are legally required to share data or need it to defend a claim.
6. International transfers
We are based in Switzerland and the homes are in Spain, so your data is processed in Switzerland and the EU/EEA (in particular Spain). The European Commission has recognised Switzerland as providing an adequate level of protection, and Switzerland recognises the EU/EEA likewise.
Some of our service providers (for example Google and Meta/WhatsApp) are based in, or may access data from, the United States, Canada or elsewhere. For these transfers we rely on the EU-US Data Privacy Framework and the Swiss-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's standard contractual clauses (recognised by Switzerland) or another lawful safeguard.
7. Cookies
Our websites use cookies and similar technologies. When you first visit, a cookie banner asks for your choice. Non-essential cookies are only used after you consent.
- Strictly necessary cookies keep the website working, for example to remember your language and your progress in a booking. These do not need consent.
- Analytics and advertising cookies (for example through Google Tag Manager (Google Analytics 4, Google Ads, Cloudflare beacon)) are only set after you give consent in our cookie banner. Until then, Google Consent Mode is set to "denied" by default, so these tags do not fire.
You can change or withdraw your consent at any time through the cookie settings. More details, including a list of cookies, are viewable in the Cookie settings tab.
8. Your rights
Under the GDPR and the FADP you have the right to:
- Access the personal data we hold about you and receive a copy.
- Rectification of inaccurate or incomplete data.
- Erasure of your data, for example when it is no longer needed or you withdraw consent, unless we must keep it by law (such as guest registration or accounting records).
- Restriction of processing, for example while we check whether your data is accurate or while an objection is assessed.
- Data portability: to receive the data you provided to us in a common, machine-readable format, or have it sent to another provider.
- Object to processing based on our legitimate interests. We will stop unless we have compelling legitimate grounds or need the data for legal claims. You can object to direct marketing at any time, and we will always stop.
- Withdraw your consent at any time, for example to the newsletter (via the unsubscribe link in every email) or to cookies (via the cookie settings). Withdrawal does not affect processing that took place before.
How to exercise your rights: simply send an email to [email protected]. No registered letter or particular form is needed. We will only ask for proof of identity if we have reasonable doubts about who you are. We answer within one month; for complex requests this may be extended by up to two further months, in which case we will tell you why.
Complaints: if you are not satisfied with how we handle your data, please contact us first. You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state where you live or work, or where the alleged infringement took place (for example the Autoriteit Persoonsgegevens in the Netherlands, the Gegevensbeschermingsautoriteit/Autorité de protection des données in Belgium, the CNIL in France, the competent German data protection authority, or the Agencia Española de Protección de Datos in Spain). In Switzerland, you can contact the Federal Data Protection and Information Commissioner (FDPIC/EDÖB/PFPDT).
9. Security
We protect your data with appropriate technical and organisational measures. Our websites use encrypted connections (HTTPS). Access to guest data is limited to staff and partners who need it for your booking or stay, and they are bound by confidentiality. ID data is used only for legal registration.
No system is completely secure. If a data breach is likely to put you at high risk, we will inform you as the law requires.
10. Changes to this policy
We may update this policy when our services or the law change. The current version is always on this page, with the date of the last update at the bottom. If we make important changes, we will inform you where appropriate, for example by email to guests with an upcoming booking.
Last updated: 30 October 2026