Privacy Policy

Last updated: 28/01/2026

This policy explains how personal information of all individuals interacting with HELENA AGUILAR BALEA through this website www.casaminima.com, corresponding to the Casa Mínima tourist accommodation, will be processed and protected.

Please read all sections of the Legal Notice, the Cookie Policy (if applicable), and this Privacy Policy before using this website.

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), and Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights, HELENA AGUILAR BALEA informs you that, by accepting this Privacy Policy, you give your express, informed, free, and unequivocal consent for the data you provide to be processed in accordance with the technical and organizational security measures established by current regulations.

The booking and payment process for stays is carried out through an external booking engine accessible via redirection from this website. This process takes place on secure platforms managed by specialized providers, independent from the Casa Mínima website.

Personal data collected through this website will be treated confidentially and incorporated into the corresponding processing activities owned by HELENA AGUILAR BALEA, in her capacity as data controller.

WHO IS RESPONSIBLE FOR THIS WEBSITE?

  • Data Controller: HELENA AGUILAR BALEA

  • Tax ID (NIF): 05278789J

  • Address: 28200 San Lorenzo de El Escorial, Madrid, Spain

  • Email: info@casaminima.com

  • Telephone: +34 918 324 432

WHAT PERSONAL DATA IS COLLECTED ON THIS WEBSITE?

For the purposes established in this Privacy Policy, HELENA AGUILAR BALEA may collect and process the following personal data, depending on the user’s use of the website and the services contracted:

  • Identification data: first and last name.

  • Contact data: postal address, email address, and phone number.

  • Booking and stay data: check-in and check-out dates, number of guests, total amount of the stay, special requests voluntarily provided by the guest.

  • Financial and payment data: information necessary to manage the collection of the booking. Full credit/debit card details are entered directly by the user in the secure environment of the booking engine and payment platform; Casa Mínima does not have access to or store these data.

  • Browsing data: IP address, device type and identification, browser type, domain from which the website is accessed, navigation data, and activity on the website.

  • Data necessary for legal obligations: when applicable, particularly in relation to tourist, tax, accounting, or public security regulations.

The data required to manage bookings and stays are mandatory, as they are necessary for the proper provision of the service. Failure to provide such data will prevent the booking from being formalized. Any other data requested will be optional.

LEGAL BASIS FOR PROCESSING YOUR DATA

Personal data is processed based on the following legal grounds:

  • Execution of a contract, for the management of bookings, stays, payments, invoicing, and other services associated with the accommodation.

  • Compliance with legal obligations applicable to the tourist accommodation activity, including tax, accounting, administrative, and public security obligations.

  • User consent, in relation to contact forms, content subscriptions, or the sending of commercial communications.

  • Legitimate interest of the data controller, to ensure website security, prevent fraud, and misuse of services.

PURPOSES OF DATA PROCESSING

This website may include different forms and data collection systems. The information provided will be used for the following purposes:

  • Booking management: processing, confirmation, and management of bookings, payments, invoicing, communications related to the stay, and compliance with legal obligations arising from the activity. Data may also be processed for communication to competent authorities when legally required.

  • Contact forms: responding to inquiries, requests for information, or professional communications made by the user.

  • Content subscription forms: managing newsletter subscriptions and sending informational or commercial communications related to Casa Mínima, always with prior consent from the user.

  • Browsing data: analyzing website usage and improving the user experience through analytical and technical tools.

RETENTION PERIOD OF PERSONAL DATA

Personal data will be retained for the minimum time necessary to fulfil the purpose for which they were collected and to comply with applicable legal obligations.

Thereafter, the data will be blocked in accordance with applicable regulations and will remain available exclusively to Courts and Tribunals, the Public Prosecutor’s Office or competent Public Authorities during the legally established limitation periods, after which they will be permanently deleted.

Accommodation customer data:

  • 4 years: Articles 66 et seq. of the Spanish General Tax Law.

  • 5 years: Article 1964 of the Spanish Civil Code.

  • 6 years: Article 30 of the Spanish Commercial Code.

  • 10 years: Article 25 of the Law on the Prevention of Money Laundering and Terrorist Financing, where applicable.

Subscriber data:
From the moment the user gives consent until such consent is withdrawn.

YOUR RIGHTS REGARDING YOUR DATA

Any person has the right to obtain confirmation as to whether HELENA AGUILAR BALEA / CASA MÍNIMA is processing personal data concerning them.

Data subjects have the right to:

  • Request access to their personal data.

  • Request rectification or erasure of their data.

  • Request restriction of processing.

  • Object to processing.

  • Request data portability.

  • Withdraw consent at any time.

To exercise these rights, you may write to info@casaminima.com.

If you consider that your rights have been infringed, you may lodge a complaint with the Spanish Data Protection Agency (AEPD), the competent supervisory authority, via its website www.aepd.es.

BREACH NOTIFICATION AND DECLARATION

HELENA AGUILAR BALEA / CASA MÍNIMA applies appropriate technical and organisational security measures to protect personal data against unauthorised access, loss, alteration or unlawful disclosure.

In the event of a personal data breach, action will be taken in accordance with the GDPR and, where applicable, the breach will be notified to the competent supervisory authority and to the affected data subjects.

DATA RECIPIENTS

For the proper development of its activity, HELENA AGUILAR BALEA / CASA MÍNIMA may communicate personal data to external providers acting as data processors when strictly necessary for the provision of services.

Competent public authorities:
Guest data may be communicated to competent public authorities when legally required, particularly to comply with regulations on traveler registration and public security. This communication is carried out through official systems enabled by the corresponding public administration and may be technically managed via booking management platforms used by the accommodation, without implying any additional purpose or different processing.

Specifically, data may be communicated to the following providers:

  • KrossBooking, as the online booking engine provider.

  • Redsys, as a secure payment platform, which directly processes users’ banking data.

  • Web hosting providers, technical maintenance, web analytics, and email service providers.

In all cases, these providers have signed the corresponding data processing agreements and apply appropriate security measures in accordance with current regulations.

DATA PROCESSORS

  • Google LLC, for web analytics services.

  • Squarespace, Inc., as the website hosting platform.

If certain providers involve international data transfers outside the European Economic Area, these are carried out with adequate safeguards, using standard contractual clauses or other mechanisms legally provided and approved by the European Commission.

DATA CONFIDENTIALITY AND SECURITY

HELENA AGUILAR BALEA is committed to respecting the confidentiality of personal data and adopting the necessary measures to prevent its alteration, loss, processing, or unauthorized access, in accordance with current regulations.

However, the absolute security of Internet access against fraudulent third-party access cannot be guaranteed.

ACCURACY OF DATA

Users are responsible for the accuracy, correctness, and updating of the data provided, releasing HELENA AGUILAR BALEA from any liability in this regard.

THIRD-PARTY PERSONAL DATA

If personal data provided belongs to a third party, the user guarantees that they have previously informed the third party of this Privacy Policy and obtained their consent to communicate their data.

CHANGES TO THE PRIVACY POLICY

HELENA AGUILAR BALEA reserves the right to modify this policy to adapt it to legislative or jurisprudential changes. Modifications will be published on this page with reasonable notice before implementation.

ADDITIONAL INFORMATION ON DATA PROTECTION

If you need additional information on data protection, you can write to info@casaminima.com.