Privacy policy

Sunrise Valencia is one apartment, let directly by the people who own it. This site does not live off advertising and sells nothing on: the only data we handle is what we need to answer a booking request, to meet a Spanish legal obligation, and to know which pages of the site are any use.

1. Who is responsible for this data

PinyaLabs — Ivan Izquierdo, SIRET 89388375100016, publisher of sun.pinyalabs.com and the data controller.

For any question, or to exercise your rights: sun@pinyalabs.com. We answer within a month.

2. The booking request

When you send a request through the form, we record: your name, email address, phone number if you give one, your message, the dates and number of guests, your preferred payment method, and the language of the site.

The legal basis is taking steps at your request prior to a contract (GDPR article 6(1)(b)): without that information there is no request to answer. The data is stored on our server, and we are notified of your request by email.

We keep it while the request is being handled and then, if a stay took place, for as long as accounting obligations require. A request that goes nowhere is deleted at most three years after the last exchange. You can ask us to delete it sooner.

3. Traveler registration (Spanish law)

Spanish law (Royal Decree 933/2021) requires every accommodation provider to report the identity of each traveler to the Ministry of the Interior. That is what the registration form is for, and it is a legal obligation we cannot opt out of (GDPR article 6(1)(c)).

The form asks for identity data: name and surnames, identity document type and number, date of birth, nationality, address, contact details, and the family relationship in the case of a minor.

We keep none of it. The filing is built, transmitted to the authorities, and then dropped: not one of those fields is written to our database. A passport number we do not store is a passport number nobody can steal from us. How long the authorities keep it is set by Spanish regulation, not by us.

4. Audience measurement, and only if you accept it

We would like to know which pages get read and which buttons get used, so we can improve the site. That runs through Google Tag Manager and Google Analytics, on the basis of your consent (GDPR article 6(1)(a)).

Until you accept in the banner, nothing loads: no Google script is requested, no request is sent, no cookie is set. This is not measurement switched off, it is measurement absent. If you decline, it stays that way.

Advertising consent signals stay denied in every case: we do not advertise and we do not build a profile of you.

You can change your mind at any time, free of charge, through the "Manage cookies" link in the footer.

5. Cookies and local storage

• Before you consent, and if you decline: nothing, with one exception. Your choice itself (accepted or declined) is remembered in your browser’s local storage so you are not asked again on every page. It never leaves your device.
• After you consent: Google Analytics audience-measurement cookies, whose lifetime is capped at 13 months.
• The booking form keeps what you are typing in your browser so you do not lose it. It is cleared as soon as the request is sent, and reaches us no other way than by sending the form.

6. Who else sees this data

Nobody buys it and nobody receives it for commercial purposes. Only the following are involved, each for a single task:

• Brevo (Sendinblue, France): delivering the booking-request emails.
• Google Ireland Limited: audience measurement, and only after you have consented.
• The Spanish Ministry of the Interior: the traveler registration filing, under the legal obligation above.
• Our hosting provider, to run the server, located in the European Union.

The booking platforms (Airbnb, Booking.com) receive nothing from us but unavailable dates, with no personal data attached: no name, no email, no amount.

7. Server logs

Like any web server, ours logs the requests it receives, including the IP address. Those logs are for security and for diagnosing faults, on the basis of our legitimate interest in keeping the site running (article 6(1)(f)), and are not used to track you.

8. Your rights

You have the right of access, rectification, erasure, restriction, objection and portability, and the right to withdraw consent at any time. Write to us at sun@pinyalabs.com: we do not demand a copy of your ID for a request we can match to a booking.

Some requests run into a legal obligation: we cannot erase a filing already transmitted to the Spanish authorities, nor an accounting record before its retention period expires.

If our answer does not satisfy you, you can complain to the Spanish data protection authority (aepd.es) or to the French CNIL (cnil.fr).

9. Changes

Any change to this document will be published on this page, with its update date. A change that widened how your data is used would be put to you again rather than announced here.