Privacy policy

1.Data controller

Controller: Lilian Elizabeth Gros Riveros, host of El Refugio del Casar.

Spanish tax number (NIF): 03959269-A. Address for notices: Avenida de Carabanchel Alto 3, Madrid.

Contact email: refugiodelcasar@gmail.com. Phone: +34 699 411 829.

Activity: holiday rental of a privately owned house in El Casar de Escalona (Toledo), Spain.

2.What data is processed — and what is not

Browsing this website does not require you to provide any personal data. There is no contact form, no newsletter sign-up, no private area, no comments, no shopping cart and no social media profiles.

That does not mean nothing is recorded. Like any web server, the one serving this page automatically writes every request it receives to its technical log: your IP address, the date and time, the address requested, the response code, the page you arrived from, and the identification of your browser and operating system. This happens always, whether or not you accept cookies, and that log is not combined with any other information nor used to recognise you from one visit to the next.

If you accept analytics cookies, Google Analytics 4 collects aggregated statistical information about the visit: pages viewed, time on page, device and browser type, approximate country or region, and traffic source. That information cannot identify you personally and is not combined with any other database.

If you reject them, Google still receives an anonymous, cookieless measurement of the visit — the page viewed, where you came from, the device type and the approximate country inferred from your IP address — plus a signal when the WhatsApp or call button is pressed. None of that is stored on your device and none of it can recognise you from one visit to the next: they are isolated data points Google uses to estimate overall trends.

If you message me on WhatsApp, email me or call me, I will only process the data you choose to share in that conversation (your name, your number and the content of the message) in order to reply to you.

3.Purpose and legal basis

• Analytics with cookies: understanding which content is useful and improving the site, being able to tell the same visitor apart across visits. Legal basis: your consent (art. 6.1.a GDPR), given through the cookie banner and withdrawable at any time.
• Cookieless measurement, while you have not yet decided in the banner and also if you reject: Google’s script loads from the outset with consent denied and still sends Google an isolated measurement of the visit — the page viewed, where you came from, device and browser type, and the approximate country inferred from your IP address — plus a signal when the WhatsApp or call button is pressed. Nothing is written to or read from your device and no identifier is generated that could recognise you from one visit to the next. Legal basis: my legitimate interest in knowing the volume and the origin of the site’s traffic (art. 6.1.f GDPR). You may object to this processing (art. 21 GDPR) by writing to the contact address, and you can also block it yourself from your browser or with a blocking extension.
• Web server logs: keeping the site available, detecting and stopping attacks or automated abuse, and diagnosing errors. Legal basis: my legitimate interest in protecting the site and keeping it running (art. 6.1.f GDPR). Without those logs there is no way to tell whether the site is being attacked.
• Answering your enquiries: replying to you and giving you details about availability and the conditions of the stay. Legal basis: pre-contractual steps taken at your request (art. 6.1.b GDPR).
• No commercial profiling and no automated decision-making are carried out about you.

4.Cookies and browser storage

No cookie is installed until you make a choice in the banner. Google’s measurement script loads from the outset, but until you accept it runs with consent denied (Google Consent Mode v2): no cookie or identifier is stored on your device, only the anonymous measurements described above are sent.

Your choice is saved in your own browser’s local storage. It is a plain interface preference — "accepted" or "rejected" — and it never leaves your device.

If you accept, Google Analytics 4 installs its measurement cookies (_ga and _ga_<property identifier>), with a maximum lifetime of two years.

This website uses no advertising, remarketing or social media cookies: advertising storage stays denied at all times.

You can change your mind whenever you like: the “Cookie preferences” link in the footer clears your choice, sets consent back to denied and brings the banner up again so you can choose afresh.

5.Google Maps

The "Location" section can display an interactive Google Maps map. That map loads inside a frame served by Google, which means Google receives your IP address and may set its own cookies in your browser.

For that reason the map is NOT loaded automatically unless you have consented to it. If you accept in the banner, the map appears directly when you reach that section. If you reject, or have not decided yet, you will instead see an illustrated map drawn by us — which makes no third-party requests — alongside a "Load the interactive map" button.

Pressing that button loads the Google map for that visit only and does not change your cookie decision: next time you visit you will see the illustrated map again.

There is also a "View on Google Maps" link that opens the map in a new tab; in that case the relationship is directly between you and Google, outside this website.

6.Recipients and international transfers

Statistical browsing data is shared with Google Ireland Limited as the provider of Google Analytics 4. If you accept, that measurement includes the cookies and identifier that let your browser be recognised across visits. While you have not decided, and also if you reject, no cookie or identifier is stored on your device, but Google still receives the anonymous, cookieless measurements described above.

If the interactive map is loaded — because you consented or because you pressed the button — Google additionally receives your IP address and the technical data inherent to that request, as the provider of Google Maps.

In both cases Google may process that information on servers outside the European Economic Area, relying on the safeguards set out in the GDPR (standard contractual clauses and the EU–US Data Privacy Framework).

All traffic to this website also passes through the network of Cloudflare, Inc., which acts as a content delivery network and a firewall: it filters attacks, contains automated abuse and speeds up loading. To do so, the encrypted connection terminates at the Cloudflare node closest to you, which means Cloudflare receives your IP address and the content of every request and every response before passing them on to the origin server. It processes that data as a processor, following my instructions and without using it for its own purposes.

Cloudflare is a US company with nodes all over the world, so that connection data may be processed outside the European Economic Area. The transfer relies on the European Commission’s standard contractual clauses incorporated into its data processing agreement and on its certification under the EU–US Data Privacy Framework.

The origin server — the one that generates the pages and holds the technical logs — is located in France, within the European Union. Your connection, however, does not reach it directly: it first enters through the Cloudflare network node nearest to you, which may be outside the European Union.

If you message me on WhatsApp, that conversation happens inside a third-party platform and is also governed by the privacy policy of WhatsApp Ireland Limited, over which I have no control.

Beyond the above, no data is sold, shared or disclosed to anyone, except where required by law.

7.Retention periods

• Analytics data: kept in Google Analytics 4 for a maximum of 14 months from the visit, then deleted automatically.
• Web server logs: kept only for the server’s automatic log rotation cycle — of the order of a couple of weeks — after which the oldest files are deleted without manual intervention. They are not archived nor copied to any other system.
• Your cookie preference: stays in your browser until you withdraw it from “Cookie preferences” or clear the site data.
• WhatsApp, email or phone conversations: for as long as we are in contact and afterwards for the periods required by applicable law.

8.Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time, and withdraw any consent you have given, without affecting the lawfulness of processing carried out beforehand.

To do so, write to refugiodelcasar@gmail.com stating which right you wish to exercise. Requests are answered within one month at the latest.

If you believe your data has not been handled properly, you may lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.

9.Information security

The website is always served encrypted over HTTPS and applies a content security policy that blocks the execution of unauthorised third-party scripts.

There is no visitor database on the server and no file holding your details: all that remains of your visit are the technical web server logs described above, which delete themselves as the logs rotate. Access to those logs is restricted to server administration.

10.Changes to this policy

This policy may be updated if the way data is handled changes or if the applicable legislation does. The date shown at the top always reflects the latest revision.