Privacy Policy

Last updated: October 1, 2026

1. Data controller

In compliance with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD), we inform you that the controller of your personal data is:

  • Name: Esencia Sevilla
  • Address: Imaginero Luis Álvarez Duarte 7, 41008 Sevilla, España
  • Email: [email protected]
  • Tourist Registry No.: AT/SE/03584

2. Data we collect

We collect the following personal data:

  • Booking data: name, email, phone, stay dates, number of guests
  • Payment data: processed exclusively by Stripe (we do not store card details)
  • Pre-check-in: ID document details, date of birth, nationality (required by law)
  • Communications: chat or email messages sent through the site
  • Technical data: IP address, browser type, pages visited (via Google Analytics)

3. Purpose and legal basis

We process your data for:

  • Booking management: performance of the contract (Art. 6.1.b GDPR)
  • Traveller registry: legal obligation, Organic Law 4/2015 on Public Safety (Art. 6.1.c GDPR)
  • Booking-related communications: performance of the contract
  • Marketing/newsletter: consent of the data subject (Art. 6.1.a GDPR)
  • Analytics: legitimate interest in improving the service

4. Disclosure to third parties

Your data may be disclosed to:

  • Security Forces (SES.HOSPEDERÍA): legal obligation
  • Stripe Inc.: payment processing (PCI-DSS certified)
  • Resend/SendGrid: transactional email delivery
  • Supabase: data storage (servers in the EU)
  • Google Analytics: anonymised data for traffic analysis

5. Data retention

  • Booking data: 5 years (tax obligation)
  • Traveller registry data: 3 years (police regulations)
  • Communications data: up to 2 years after the last contact

6. Your rights

You may exercise the following rights by emailing [email protected]:

  • Access: know what data we hold about you
  • Rectification: correct inaccurate data
  • Erasure: request deletion (where there is no legal obligation)
  • Portability: receive your data in electronic format
  • Objection: object to processing for marketing
  • Restriction: restrict processing in certain circumstances

You may also lodge a complaint with the Spanish Data Protection Agency (AEPD).

7. Cookies

We use our own cookies (session) and third-party cookies (Google Analytics, Meta Pixel). You can manage your preferences in the cookie banner or in your browser settings.