Privacy Policy

1. Who is responsible for your data

The controller of your personal data is:

• Owner: Aurora Living S.L.
• Tax ID (NIF): B25942103
• Registered address: Calle Francisco de Coalla 4, 29170 Colmenar (Málaga), Spain
• Contact email: retreats@myauroraliving.com
• Website: retreats.myauroraliving.com

2. What data we collect

You can browse this website without providing any personal data. We only collect the personal data you choose to give us through our inquiry forms:

• Booking inquiry form: your first and last name, email address, your selected dates and number of guests, any retreat add-on you indicate, and any message you write.
• Retreat hosting inquiry form: your name, email address, and optionally your phone number, country, the type and size of retreat, preferred dates, overnight requirements, services of interest, budget and your message.
• Technical and usage data: a strictly necessary cookie that remembers your chosen language, plus anonymous, aggregated usage statistics collected by a privacy-friendly, cookieless analytics service (see sections 5 and 10). We do not use advertising or cross-site tracking cookies.

3. Why we use your data (purposes)

• To respond to your booking or retreat inquiry and answer your questions.
• To prepare an estimate and, if you decide to proceed, to organise your stay or retreat.
• To keep records required by applicable tax and commercial law where a booking goes ahead.
• To understand, in aggregate and without identifying you, how visitors use the website so we can improve it.
• We do not use your data for automated decision-making or profiling, and we do not sell it.

4. Legal basis for processing

• Your consent, given when you tick the consent box and submit a form (Art. 6(1)(a) GDPR). You may withdraw it at any time.
• Steps taken at your request prior to entering into a contract, for example responding to a booking inquiry (Art. 6(1)(b) GDPR).
• Compliance with our legal obligations, such as retaining accounting and tax records (Art. 6(1)(c) GDPR).
• Our legitimate interest in understanding and improving how the website is used, through privacy-friendly analytics that do not identify you (Art. 6(1)(f) GDPR).

5. Who we share your data with

We do not sell or rent your data, and we only share it where necessary to operate this website and respond to you:

• Resend (our email delivery provider), which transmits the contents of your inquiry to our inbox.
• Our cloud hosting provider, which hosts the website.
• Vercel (our web analytics provider), which collects anonymous, aggregated usage statistics without cookies or personal identification.
• Public authorities, only where we are legally required to disclose data.

6. International transfers

Some of our service providers may process data outside the European Economic Area. Where this happens, the transfer is protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision, so that your data continues to enjoy GDPR-level protection.

7. How long we keep your data

• Inquiries that do not lead to a booking: kept only as long as needed to deal with your request, and in any case deleted within 12 months.
• Inquiries that lead to a confirmed booking or retreat: kept for the duration of our relationship and afterwards only for the periods required by Spanish tax and commercial law (generally up to 6 years).
• When the retention period ends, your data is securely deleted or anonymised.

8. Your rights

You have the following rights over your personal data, free of charge:

• Access: obtain confirmation of whether we process your data and a copy of it.
• Rectification: correct inaccurate or incomplete data.
• Erasure ('right to be forgotten'): ask us to delete your data.
• Restriction: ask us to limit how we use your data.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on our legitimate interests.
• Withdraw consent: at any time, without affecting processing already carried out.

How to exercise your rights

To exercise any of these rights, email us at retreats@myauroraliving.com, including enough information for us to identify you. We may ask for proof of identity to protect your data.

If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), www.aepd.es.

9. Data security

We apply reasonable technical and organisational measures to protect your data against loss, misuse and unauthorised access. Inquiry data is transmitted over encrypted connections. No system can be guaranteed completely secure, but we take all reasonable steps to prevent incidents.

10. Cookies and analytics

This website uses a strictly necessary technical cookie to remember your language preference. It is essential for the site to work and does not require consent.

For usage statistics we rely on Vercel Web Analytics, a privacy-friendly service that does not set cookies, does not track you across websites, and does not collect personally identifiable information; the data it produces is aggregated and anonymous. We do not use advertising or third-party tracking cookies.

11. Children

This website and our services are directed at adults. We do not knowingly collect personal data from children under 16. If you believe a minor has provided us with data, please contact us so we can delete it.

12. Changes to this policy

We may update this Privacy Policy to reflect legal or operational changes. The version and effective date shown at the top of this page indicate the current version. Significant changes will be published on this page.

13. Contact

For any question about this Privacy Policy or how we handle your data, contact us at retreats@myauroraliving.com.