Privacy Policy

Effective Date: 1 October 2025
Last Updated: 1 October 2025

1. About This Privacy Policy

This privacy policy explains how Ebro Holidays handles any personal information you provide when booking our Riverside Finca accommodation in Benifallet, Spain, or when contacting us through our website.

Ebro Holidays is operated by Chad and Mandy. We are committed to protecting your privacy and being transparent about our data practices.

In summary: We collect minimal personal information, use it only for booking and correspondence purposes, and do not share it with third parties for marketing.

2. Information We Collect

2.1 Booking Information

When you make a booking, we collect only the information necessary to provide our accommodation services:

  • Your name and contact details (email, phone number)
  • Booking dates and number of guests
  • Payment information (for deposit processing)
  • Any specific requirements you mention (pets, dietary needs, accessibility)

2.2 Contact Form and Email Enquiries

When you contact us through our website contact form or email, we collect:

  • Your name and email address
  • The content of your message or enquiry
  • Any information you choose to provide about your holiday plans

2.3 Information We Do NOT Collect

We do not collect:

  • Marketing preferences or personal profiles
  • Browsing behaviour or tracking data
  • Social media information
  • Financial information beyond what’s necessary for deposits
  • Location data from your devices

3. How We Use Your Information

3.1 Legitimate Business Purposes Only

We use your personal information solely for:

  • Booking Management: Confirming reservations, sending booking confirmations, and managing your stay
  • Communication: Responding to enquiries, providing pre-arrival information, and addressing any issues during your stay
  • Payment Processing: Managing deposits and final payments
  • Property Management: Coordinating arrival times, providing directions, and arranging access

3.2 We Do NOT Use Your Information For:

  • Marketing campaigns or newsletters
  • Creating customer profiles
  • Sharing with marketing companies
  • Advertising purposes
  • Analytics beyond basic website visitor counts

4. Legal Basis for Processing (GDPR)

Under GDPR, our legal basis for processing your personal information is:

  • Contract Performance: Information necessary to provide our accommodation services
  • Legitimate Interests: Communication related to your booking and reasonable business record-keeping
  • Consent: Where you’ve specifically agreed to something (such as receiving follow-up emails)

5. Data Sharing and Third Parties

5.1 We Do NOT Share Your Data

We do not sell, rent, or share your personal information with third parties for marketing purposes. Your booking and contact details remain private to Ebro Holidays.

5.2 Limited Third-Party Processing

Your information may be processed by:

  • PayPal: When you choose to pay deposits via PayPal (subject to PayPal’s privacy policy)
  • Email Providers: Your messages are handled through standard email systems
  • Spanish Authorities: If required by Spanish law for tourist accommodation registration

6. Website Analytics and Cookies

6.1 Google Analytics

Our website uses Google Analytics to understand general website usage (such as how many people visit our site). This is managed entirely by Google and operates independently of our booking system.

  • Google Analytics may place cookies on your device
  • This tracking is not controlled by Ebro Holidays
  • For information about Google Analytics privacy practices, see Google’s Privacy Policy
  • You can opt out of Google Analytics tracking using Google’s opt-out tools

6.2 Essential Website Functions Only

Our website itself uses only essential functions necessary for:

  • Displaying web pages correctly
  • Ensuring the contact form works properly
  • Basic security features

We do not use tracking cookies, marketing pixels, or advertising technologies.

7. Data Retention

7.1 How Long We Keep Your Information

  • Active Bookings: Information retained until after your stay is complete
  • Past Guest Records: Contact details kept for up to 2 years for customer service purposes
  • Email Correspondence: Retained while relevant for business purposes, typically 1-2 years
  • Cancelled Bookings: Basic records kept for financial and booking management purposes

7.2 Automatic Deletion

We regularly review and delete information that is no longer needed for legitimate business purposes.

8. Your Rights Under GDPR

As a data subject, you have the following rights:

8.1 Access and Portability

  • Right of Access: Request a copy of personal information we hold about you
  • Data Portability: Receive your data in a structured, commonly used format

8.2 Correction and Deletion

  • Right to Rectification: Correct any inaccurate personal information
  • Right to Erasure: Request deletion of your personal information (subject to legitimate business needs)

8.3 Processing Rights

  • Right to Restrict Processing: Limit how we use your information
  • Right to Object: Object to processing based on legitimate interests
  • Right to Withdraw Consent: Where processing is based on consent

8.4 Making a Request

To exercise any of these rights, contact us using the details below. We will respond within one month and verify your identity before processing requests.

9. Data Security

9.1 How We Protect Your Information

  • Email communications use standard security protocols
  • Payment processing through established providers (PayPal, bank transfers)
  • Physical records (if any) stored securely
  • Access limited to Chad and Mandy only

9.2 Limitations

As a small accommodation provider, we do not have enterprise-level security systems. We take reasonable precautions appropriate to our business size and the limited data we collect.

10. International Data Transfers

Your personal information is processed in Spain and may be transferred to:

  • PayPal (if you choose this payment method)
  • Email service providers (for correspondence)

Any transfers comply with GDPR requirements for international data protection.

11. Children’s Privacy

Our services are not directed at children under 16. We do not knowingly collect personal information from children, except as part of family bookings where parents/guardians provide the information.

12. Changes to This Privacy Policy

We may update this privacy policy from time to time. Any changes will be posted on our website with a new “last updated” date. Continued use of our services after changes indicates acceptance of the updated policy.

13. Complaints and Supervisory Authority

13.1 Contact Us First

If you have concerns about how we handle your personal information, please contact us directly using the details below.

13.2 Regulatory Complaints

You also have the right to lodge a complaint with:

  • Spain: Agencia Española de Protección de Datos (AEPD)
  • Your EU Country: Your national data protection authority
  • UK: Information Commissioner’s Office (ICO) if you’re a UK resident

14. Contact Information

Data Controller: Chad and Mandy, Ebro Holidays
Address: Riverside Finca, Benifallet, Tarragona, Spain
Email: info@ebroholidays.com
Website: ebroholidays.com

For any privacy-related questions or to exercise your data rights, please contact us using the above details.

15. Effective Date

This privacy policy is effective from [Date] and applies to all information collected from that date onwards.

This privacy policy was last updated on 1 October 2025.
For the most current version, please visit: ebroholidays.com/privacy-policy