CHECK AVAILABILITY

PRIVACY POLICY

1. Data controller

The controller responsible for processing personal data collected through this website is:

Controller: GREENLINE INVEST SWISS
NIF: N0259093C
Commercial name: Cortijo Al-Andalus
Business establishment: Paraje de Mateo, Cortijo El Rincón, s/n, Pago del Cortijo de la Adelfa y Carrizal, 18400 Las Barreras, Órgiva, Granada, Spain
Email: info@andalusretreat.com
Tourism registration: VTAR/GR/02935
Website: www.andalusretreat.com

2. Scope of this Privacy Policy

This Privacy Policy explains how personal data is processed when you:

  • visit this website;

  • contact us through the contact form or by email;

  • request information about accommodation or retreat services;

  • make or enquire about a reservation;

  • interact with third-party services linked or embedded on the website.

3. Personal data we may collect

Depending on how you interact with us, we may process:

  • identification and contact details, such as your name and email address;

  • information included in your enquiry, such as preferred dates, number of guests, accommodation requirements and the content of your message;

  • booking and stay information;

  • billing, payment and transaction information necessary to manage a reservation;

  • communications exchanged with us;

  • technical information, such as IP address, browser type, device information, access date and security logs;

  • cookie and browsing information, where applicable and subject to your consent when required.

Please do not include sensitive personal information in the contact form unless it is strictly necessary for your request.

4. Purposes and legal bases

Enquiries and retreat proposals

We process the information you provide to answer questions, check availability and prepare accommodation or retreat proposals.

The legal basis is taking steps at your request before entering into a contract.

Reservations and guest services

We process personal data to manage reservations, payments, cancellations, communications, check-in, accommodation services and related guest requests.

The legal basis is the performance of a contract or taking pre-contractual steps at your request.

Legal obligations

Certain information may be processed to comply with tax, accounting, tourism, security and guest-registration obligations applicable to accommodation providers.

The legal basis is compliance with applicable legal obligations.

Website security and legal claims

Technical data may be processed to maintain website security, prevent misuse or fraud, resolve technical incidents and establish, exercise or defend legal claims.

The legal basis is our legitimate interest in protecting the website, the business and its users.

Optional cookies and marketing

Non-essential cookies or similar technologies are used only where legally permitted and, when required, after obtaining your consent.

We will not use your contact details to send marketing communications unless you have specifically consented to receive them. You may withdraw your consent at any time.

5. Booking platform

The booking buttons on this website redirect users to an external booking service operated through AvaiBook.

When you access the AvaiBook booking platform, your personal data may also be processed according to the privacy information displayed on that platform. We may receive the information necessary to manage your reservation, payment and stay.

6. Recipients of personal data

Personal data may be accessed or received, only when necessary, by:

  • website hosting, email and technical service providers;

  • reservation and payment service providers, including AvaiBook;

  • accounting, legal or administrative service providers;

  • competent public authorities when disclosure is required by law;

  • other service providers necessary to manage a reservation or requested service.

We do not sell personal data.

Service providers are required to process personal data securely and only for the relevant purpose, subject to their legal role and contractual obligations.

7. International data transfers

Some external technology providers, including providers of map, hosting or online services, may process information outside the European Economic Area.

Where such transfers are subject to our control, appropriate safeguards required by data-protection law will be used, such as an adequacy decision, Standard Contractual Clauses or another legally recognised mechanism.

8. Data retention

Personal data is retained only for as long as necessary for the purpose for which it was collected.

In particular:

  • enquiries that do not lead to a reservation may normally be retained for up to 12 months after the last communication;

  • reservation, payment and accounting information may be retained for the periods required by applicable tax, accounting, tourism and claims legislation;

  • information required to manage a legal dispute may be retained until the relevant limitation period expires;

  • data processed on the basis of consent may be retained until consent is withdrawn, without affecting the lawfulness of previous processing;

  • technical and security logs are retained only for the period reasonably necessary for website administration and security.

9. Your data-protection rights

Subject to the conditions established by applicable law, you may request:

  • access to your personal data;

  • correction of inaccurate or incomplete data;

  • deletion of your data;

  • restriction of processing;

  • objection to processing based on legitimate interests;

  • portability of data where applicable;

  • withdrawal of consent at any time.

To exercise your rights, contact:

info@andalusretreat.com

Please identify your request clearly. We may request additional information only when reasonably necessary to verify your identity.

You also have the right to lodge a complaint with the Spanish Data Protection Agency — Agencia Española de Protección de Datos (AEPD) at www.aepd.es.

10. Children’s data

Reservations and contact requests should be submitted by adults.

Where information about minors is required to manage a family reservation, guest registration or accommodation service, it will be processed only for those purposes and in accordance with applicable law.

11. Security

Reasonable technical and organisational measures are used to protect personal data against accidental loss, unauthorised access, alteration, disclosure or destruction.

However, no internet-based service can guarantee absolute security.

12. Cookies and external services

This website may use cookies and external services, including Google Maps. These services may receive technical information such as your IP address and device or browser information.

Further details about the cookies and external services used on the website will be provided in the Cookie Policy.

13. Changes to this Privacy Policy

This Privacy Policy may be updated when the website, its services or applicable legal requirements change. The current version will always be published on this page.

Last updated: July 2026.