1. Controller

The data controller responsible for your personal information is:
‍
‍Molino de Tresgrandas S.L.
Lugar Tresgrandas 14, 33590 Llanes, Asturias, Spain
Email: info@santuariokunturi.com
Telephone: +34 627 407 073

2. Scope of this Policy

This Privacy Policy applies to personal data we collect about you when you:

It does not apply to personal data processed by third parties (including third-party booking platforms) except as described in section Disclosure of your information below.

• visit or use our website and digital services;
• make enquiries, requests or bookings via the Site or third-party booking platforms;
• use our accommodation, retreats or related services;
• subscribe to our marketing communications;
• or otherwise provide personal data to us in connection with our business.

3. How we collect information about you

We collect personal data:

• directly from you when you make a booking, send an enquiry, register for newsletters, fill in forms, use online chat, call or email us;
• when you use our Site (via cookies and similar technologies) — see our Cookies Policy;
• from third parties such as booking platforms (e.g., Booking.com, Airbnb, Littlehotelier, Mews), payment processors and service providers acting on our behalf; and
• from publicly available sources where permitted by law.

4. Information we collect

The categories of personal data we may collect and process include:

‍Identity & contact details: name, title, postal address, email address, telephone number, date of birth (if provided).
Booking & stay details: reservation details, arrival and departure dates, room preferences, number of guests, special requests, billing information and payment transaction data (payment card details are processed by our payment provider and stored only as permitted).
Communications: correspondence and communications with us, including feedback and customer service interactions.
Transactional data: details of services purchased, booking history, invoices and financial records.
Technical and usage data: IP address, browser type and version, device identifiers, operating system, referral source, pages visited on our Site, search terms, analytics data and other tracking data collected through cookies and similar technologies.
Special categories: information about health or dietary requirements may be collected where necessary to provide services (for example, medical conditions relevant to a retreat). Such data will only be processed with explicit consent or when strictly necessary for providing the requested service and in accordance with applicable law.

5. Purposes and legal bases for processing

We process your personal data for the following purposes and legal bases:

• To manage enquiries and reservations (performance of a contract / pre-contractual measures).
• To provide accommodation, services and on-site facilities during your stay (performance of a contract).
• To process payments, refunds and invoices (performance of a contract / legal obligation).
• To comply with legal and regulatory obligations, including accounting, tax, immigration and public health reporting (legal obligation).
• To communicate with you about your booking, stay, or enquiries, including sending transactional emails and customer service messages (necessary for contract performance).
• To send marketing communications (where you have given consent) about our services, offers and events (consent). You may opt out at any time.
• To improve and personalise our Site, services and offerings and to perform analytics (our legitimate interests in improving our services, provided that such interests do not override your data-protection rights).
• To protect our business, guests and others (fraud prevention, safety and security) (our legitimate interests and/or legal obligation).
• To comply with any other purpose for which you provided the data and which we notify you of at the time of collection.

Where processing is based on our legitimate interests, we will ensure your rights and interests are respected and will not process in ways that unjustifiably infringe your privacy.

6. Marketing communications

If you have consented, we will send you information about offers, events and services. You may opt out of marketing at any time by:

• following the “unsubscribe” link in any marketing email we send; or
• emailing info@santuariokunturi.com and requesting to be unsubscribed.

We may also send you operational messages about your booking or mandatory service-related notices which are not marketing and which you cannot opt out of.

7. Disclosure of your information

We may disclose your personal data to:

• Group companies and affiliates where necessary for the provision of services;
• Booking platforms and travel agents (e.g., Booking.com, Airbnb, Littlehotelier, Mews) in order to manage reservations;
• Service providers who perform services for us such as payment processors, IT and hosting providers, email and messaging providers, analytics providers, marketing platforms, legal, tax and accounting advisors, laundry and transport partners;
• Public authorities and law enforcement, where required by law (for example, immigration, tax or public health reporting); and
• Any other third party where you have provided consent to the disclosure.

All third-party processors are bound by contractual obligations to protect personal data and may only process it as instructed by us and in compliance with applicable laws.

8. International transfers

Your personal data may be transferred to, stored or processed in countries outside the European Economic Area (EEA). Where we transfer personal data outside the EEA, we will ensure appropriate safeguards are in place (for example, the European Commission’s Standard Contractual Clauses, Binding Corporate Rules where applicable, or other lawful transfer mechanisms) to ensure your data remains protected in accordance with applicable law.

If you would like more details about the transfer mechanisms we use, please contact info@santuariokunturi.com.

9. Retention of personal data

We retain personal data only for as long as necessary for the purposes set out in this Privacy Policy and to comply with legal, regulatory, tax and accounting obligations.

Typical retention periods include:

• reservation and transactional data: for the period required by tax and accounting law (generally up to 6 years in Spain), and while any dispute or claim is possible;
• marketing preferences: until you withdraw consent;
• analytics and technical logs: for a period necessary to improve services and as permitted by law.

If you would like further detail on specific retention periods for particular categories of personal data, please contact us at info@santuariokunturi.com.

10. Your legal rights

Under the GDPR you have certain rights in relation to your personal data. Subject to applicable law, you may have the right to:

• request access to the personal data we hold about you;
• request rectification of inaccurate or incomplete data;
• request erasure of your personal data (in certain circumstances);
• request restriction of processing in certain circumstances;
• object to processing based on our legitimate interests or for direct marketing purposes;
• request portability of your personal data to another controller, where applicable; and
• withdraw consent at any time where processing is based on consent (this will not affect the lawfulness of processing prior to withdrawal).

To exercise any of these rights, please write to: info@santuariokunturi.com or send a signed request by post to our registered address (a copy of an identity document should be provided for security reasons). We will respond within the timescales required by law.If you consider that we have not complied with your rights, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD): https://www.aepd.es/

11. Automated decision making and profiling

We do not carry out automated decision-making which produces legal effects or similarly significantly affects you. Where we carry out any profiling or automated processing that has a significant effect on you, we will notify you, explain the logic involved and implement suitable measures to safeguard your rights.

12. Security

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, and any other unlawful form of processing. Measures include encryption of online transactions, secure servers, access controls, regular backups and staff training.

While we strive to protect your personal data, the transmission of information via the internet is not completely secure and we cannot guarantee the security of data transmitted to our Site. Any transmission is at your own risk.

13. Children

Our Site and services are not intended for children under sixteen years old. We do not knowingly collect personal data from children under sixteen years old without parental consent. If you believe we have collected such data, please contact us at info@santuariokunturi.com and we will take steps to delete the information.

14. Links to other websites

Our Site may contain links to third-party websites. This Privacy Policy does not apply to those websites and we are not responsible for the privacy practices of third parties. Please read the privacy notices of other websites before providing personal data.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal or regulatory requirements, or to improve clarity. Any changes will be published on this Site with an updated effective date. We recommend you check this page periodically.

16. Contact us

For questions, requests, complaints or to exercise your rights, contact our Data Controller at:

‍Molino de Tresgrandas S.L. (Santuario Kunturi)
Lugar Tresgrandas 14, 33590 Llanes, Asturias, Spain
Email: info@santuariokunturi.com
Telephone: +34 627 407 073

17. Complaints

If you are not satisfied with how we handle your personal data, please contact us using the details above and we will try to resolve your complaint. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD): https://www.aepd.es/