Privacy Policy

Controller: Tolosa Properties SL, NIF B22920839, Avda. de la Torre 63, Rincón de la Victoria, Málaga (España). Data protection contact email: info@holidaysmalaga.com.

We process the data you provide through the forms on this website:

• Contact form: name, email, phone and your message — to answer your enquiry.
• Owner income calculator: name, email, phone, how you heard about us and your property details — to send you the requested estimate and follow up on your interest in our management services.
• Newsletter: email — to send you recommendations and offers until you unsubscribe.
• Bookings: booking data is collected in the booking engine (reservations.holidaysmalaga.com), operated on the Hostaway platform, and processed to manage your stay, including the mandatory guest registration with the Spanish authorities (SES.Hospedajes).
• Browsing: with your consent, aggregated usage statistics via Google Analytics (see Cookies Policy).

Processing is based on your consent (when submitting each form or accepting cookies), the performance of a contract in the case of bookings, and compliance with legal obligations (guest registration, invoicing).

We do not sell your data. We use providers acting as data processors:

• EmailJS (delivery of form submissions to our inbox).
• Google (Google Analytics, only with your consent).
• Hostaway (booking management platform).
• Vercel (website hosting).
• Some of these providers are located in the United States; transfers are covered by the EU-US Data Privacy Framework or standard contractual clauses.

We keep enquiry and lead data for the duration of the relationship or until you request deletion; booking data for the legally required tax and guest-registration periods; and newsletter emails until you unsubscribe.

You may exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to info@holidaysmalaga.com. You may also lodge a complaint with the Spanish Data Protection Agency (aepd.es).

We apply appropriate technical and organisational measures: TLS encryption across the site, restricted mailbox access, and providers bound by contractual guarantees.