Privacy policy

1. Scope of this Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored and shared in connection with the website mbzrentals.com, the MBZ Rentals brand, reservations, guest communications, check-in procedures and accommodation-related services.

Personal data is processed in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – “GDPR”), Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (“LOPDGDD”) and other applicable Spanish and European data protection legislation.



2. Data Controller

The website mbzrentals.com and the MBZ Rentals brand are operated by:

MBZ Inmo, S.L.

NIF: B22574735

Carrer del Bisbe Roig, 75, Ground floor

07620 Llucmajor

Mallorca, Spain

Email: info@mbzrentals.com

MBZ Inmo, S.L. is registered in Mallorca as a Central de Reservas under number CR/366.

For the purposes of applicable data protection legislation, MBZ Inmo, S.L. is the Data Controller in relation to the personal data processed within the scope described in this Privacy Policy.

3. Personal data we may collect

Depending on how you interact with MBZ Rentals and the services you use, we may collect and process the following categories of personal data:

Identification data

This may include:

• name and surname;

• date of birth;

• nationality;

• sex, where required by applicable guest registration regulations;

• identity document or passport details;

• usual place of residence, including address, locality and country;

• signature and other information required for statutory guest registration.

Contact data

This may include:

• email address;

• telephone number;

• postal address.

Reservation and accommodation data

This may include:

• selected property;

• booking and reservation number;

• arrival and departure dates;

• number and details of guests;

• accommodation preferences;

• information relating to changes, cancellations or requests;

• communications concerning the reservation or stay;

• information required to provide guest support.

Payment and billing data

This may include:

• amount paid;

• payment status;

• payment method;

• transaction reference;

• billing information;

• information required for invoices and accounting.

Where payment is processed by an external payment service provider, payment card or banking information may be collected directly by that provider. MBZ Inmo will process only the information necessary to manage the reservation, payment status, accounting and related obligations.

Check-in and statutory guest registration data

Information required under Spanish law may be collected as part of the check-in and guest registration process.

Depending on the applicable legal requirements and the check-in method used, this may include identification, contact, accommodation and other information required for the statutory registration of travellers.

Where an identity verification functionality is used, additional information may be processed for the sole purpose of confirming the guest's identity.

Website and technical data

When you use mbzrentals.com, certain technical information may be collected automatically, such as:

• IP address;

• browser and device information;

• date and time of access;

• pages or functions used;

• technical logs;

• cookie identifiers and similar technologies, where applicable.

The use of non-essential cookies and similar technologies is subject to the applicable consent requirements and is described in our Cookie Policy.

Communications

If you contact us by email, telephone, contact form or another communication channel, we may process the content of your communication and the information necessary to respond to your request.



4. How we obtain your personal data

We may obtain personal data:

• directly from you when you make a reservation, contact us or complete the check-in process;

• from the person making a reservation on your behalf;

• from booking platforms, travel portals or other intermediaries through which a reservation was made;

• through Smoobu, which we use to manage reservations and related accommodation services;

• through Chekin, which we use for digital check-in and statutory guest registration;

• automatically when you use our website;

• from property owners or accommodation providers where this is necessary to manage your reservation or stay.

If you provide personal data relating to another guest, you should ensure that you are authorised to provide that information and that the guest is informed about the processing of their personal data.



5. Purposes and legal bases for processing

We process personal data only where there is an appropriate legal basis.

Managing enquiries and reservations

We process personal data to:

• respond to accommodation enquiries;

• process and confirm reservations;

• manage changes and booking-related requests;

• communicate with guests before, during and after their stay;

• provide information necessary for arrival and departure;

• provide guest support.

Legal basis: Article 6(1)(b) GDPR – processing necessary to take steps prior to entering into a contract or for the performance of a contract.

Managing accommodation and the guest's stay

Personal data may be processed where necessary to organise and provide services relating to the booked accommodation, communicate operational information and resolve issues arising during the stay.

Legal basis: Article 6(1)(b) GDPR.

Where processing is necessary for operational management, security or protection of legitimate business interests that are not overridden by the guest's rights and freedoms, the legal basis may also be Article 6(1)(f) GDPR – legitimate interests.

Compliance with legal obligations

We process personal data where required to comply with Spanish or European legislation, including obligations relating to:

• registration of guests;

• communication of legally required information to public authorities;

• taxation;

• accounting;

• invoicing;

• responding to lawful requests from public authorities or courts.

Legal basis: Article 6(1)(c) GDPR – compliance with a legal obligation.

Prevention of fraud, protection of property and legal claims

Where necessary, personal data may be processed to prevent or investigate fraud or misuse, protect properties, establish or defend legal claims and manage disputes.

Legal basis: Article 6(1)(f) GDPR – legitimate interests, and where applicable Article 6(1)(c) GDPR.

Marketing communications

If you expressly subscribe to a newsletter or otherwise consent to receiving marketing communications, we may use your contact details to send information about MBZ Rentals, properties, offers or related services.

Legal basis: Article 6(1)(a) GDPR – consent, unless another legal basis expressly permitted by applicable legislation applies.

You may withdraw your consent or unsubscribe at any time.

Analytics and non-essential cookies

Where analytics, advertising or other non-essential website technologies requiring consent are used, personal data will be processed only after the required consent has been obtained.

Legal basis: Article 6(1)(a) GDPR – consent.

Further information is provided in the Cookie Policy.

6. Reservations and Smoobu

MBZ Inmo uses Smoobu GmbH, Pappelallee 78/79, 10437 Berlin, Germany, as a technology provider for the management of holiday rental reservations and related services.

Smoobu may process personal data on behalf of MBZ Inmo, including reservation details, contact details, communications, contractual information and billing-related data to the extent necessary to provide the services used by MBZ Inmo.

For such processing, MBZ Inmo acts as the Data Controller and Smoobu acts as a Data Processor in accordance with Article 28 GDPR.

Where a reservation originates from a third-party booking platform, that platform may process personal data separately under its own privacy policy and may provide the information necessary to MBZ Inmo and Smoobu for the management of the reservation.



7. Digital check-in, Chekin and guest registration

MBZ Inmo uses Chekin Soluciones Digitales, S.L., NIF B21579990, Avda. República Argentina, 24 – 7º, 41011 Sevilla, Spain, to facilitate digital check-in and compliance with statutory guest registration requirements.

For services performed on behalf of MBZ Inmo, Chekin acts as a Data Processor and processes guest information according to the instructions of MBZ Inmo and the applicable data processing arrangements.

Chekin may be used to:

• collect information required for guest registration;

• facilitate digital check-in;

• verify guest information and identity where applicable;

• generate legally required guest registration records;

• transmit information required by law to the competent Spanish authorities.

Certain guest identification and accommodation data are required under Spanish legislation and may be communicated to the competent authorities, including through the SES.HOSPEDAJES system.

This processing is necessary to comply with statutory obligations relating to the registration and reporting of persons using accommodation services.

Legal basis: Article 6(1)(c) GDPR and the applicable Spanish legislation governing guest registration, including Real Decreto 933/2021.

Guests are required to provide information that is legally necessary for check-in and statutory registration. Failure to provide required information may prevent or delay check-in where MBZ Inmo or the accommodation provider would otherwise be unable to comply with its legal obligations.

Depending on the Chekin functionality used for a particular property or reservation, an identity verification process may involve processing an image of an identity document and/or a photograph or selfie exclusively for verification purposes. The applicable information will be provided during the relevant check-in process.



8. Recipients and service providers

Personal data may be made available only where necessary and on an appropriate legal basis to the following categories of recipients:

Technology providers and Data Processors

These may include:

• Smoobu GmbH – reservation and accommodation management platform;

• Chekin Soluciones Digitales, S.L. – digital check-in and guest registration;

• hosting, website infrastructure and IT service providers;

• email and communication service providers;

• payment service providers;

• accounting and invoicing service providers;

• other technology providers necessary to operate the services.

Where such providers act as Data Processors, they are required to process personal data on the basis of appropriate contractual arrangements and only in accordance with documented instructions, subject to applicable law.

Public authorities

Personal data may be communicated to public authorities where required by law, including:

• competent Spanish security authorities;

• authorities receiving information through SES.HOSPEDAJES;

• tax authorities;

• courts and judicial authorities;

• other competent administrative authorities.

Property owners or accommodation providers

Where necessary for the management or provision of the booked accommodation, relevant personal data may be communicated to the owner or operator of the property.

Where a property owner or accommodation provider processes personal data for its own independent legal or operational purposes, it may act as a separate Data Controller in relation to that processing.

Professional advisers

Where necessary, information may be made available to accountants, lawyers, tax advisers, insurers or other professional advisers, for example for accounting, compliance, claims or legal proceedings.



9. International transfers of personal data

MBZ Inmo is established in Spain. Some technology providers used by MBZ Inmo or their subprocessors may process personal data outside the European Economic Area.

Where personal data is transferred to a country outside the European Economic Area, appropriate safeguards required by Chapter V of the GDPR will be used.

Depending on the recipient and destination country, these may include:

• an adequacy decision adopted by the European Commission;

• participation in the EU-U.S. Data Privacy Framework where applicable;

• Standard Contractual Clauses approved by the European Commission;

• another legally recognised transfer mechanism.

MBZ Inmo requires its service providers to implement appropriate data protection safeguards in accordance with applicable law.



10. How long we keep personal data

Personal data will not be kept longer than necessary for the purposes for which it was collected, taking into account applicable statutory retention obligations and limitation periods.

In particular:

• personal data relating to reservations and contracts will be retained for the period necessary to manage the reservation and subsequently for the periods required for accounting, taxation, legal compliance and the establishment or defence of claims;

• guest registration information subject to the statutory register under Real Decreto 933/2021 will be retained for the legally required period, currently three years from the end of the contracted service;

• information relating to enquiries may be retained until the enquiry has been resolved and, where necessary, for a reasonable period thereafter;

• personal data processed on the basis of consent for marketing purposes will be processed until consent is withdrawn or the person unsubscribes, unless retention is otherwise legally required;

• information relating to cookies and similar technologies will be retained for the periods described in the Cookie Policy.

Once personal data is no longer required, it will be deleted, anonymised or securely restricted where retention remains necessary for legal purposes.



10. How long we keep personal data

Subject to the conditions provided by applicable law, you have the right to:

• Access your personal data and obtain information about how it is processed.

• Rectify inaccurate or incomplete personal data.

• Request deletion of your personal data where there is no longer a lawful reason to retain it.

• Request restriction of processing in circumstances provided by law.

• Object to processing based on legitimate interests, including direct marketing.

• Request data portability where the applicable legal conditions are met.

• Withdraw consent at any time where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

• Not be subject to certain decisions based solely on automated processing, including profiling, where the conditions of Article 22 GDPR apply.

These rights are not absolute. For example, MBZ Inmo may be required to retain certain personal data despite a request for deletion where retention is necessary to comply with a legal obligation.

To exercise your rights, please contact:

MBZ Inmo, S.L.

Carrer del Bisbe Roig, 75, Ground floor

07620 Llucmajor

Mallorca, Spain

Email: info@mbzrentals.com

We may request information necessary to verify your identity before acting on a request.

You also have the right to lodge a complaint with the Agencia Española de Protección de Datos (AEPD) if you believe that your personal data has been processed in breach of applicable data protection legislation.

12. Cookies and similar technologies

mbzrentals.com may use cookies and similar technologies necessary for the operation and security of the website and booking functions.

Other cookies, including analytics or marketing cookies, will be used only where permitted by applicable law and, where required, after obtaining the user's consent.

Users can accept, reject or manage non-essential cookies through the consent management mechanism available on the website.

Detailed information about the cookies actually used, their providers, purposes and duration is provided in the Cookie Policy.



13. Security

MBZ Inmo implements appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Access to personal data is limited to persons and service providers who require it for legitimate operational, contractual or legal purposes.

No information system can guarantee absolute security. MBZ Inmo therefore reviews its security measures taking into account the nature of the processing, available technology and the risks associated with the personal data processed.



14. Third-party websites and booking platforms

mbzrentals.com may contain links to third-party websites or services.

Where you use a third-party website, booking platform, payment provider or other independent service, that provider may process personal data under its own privacy policy and terms.

MBZ Inmo is not responsible for the independent processing practices of third-party services over which it has no control.

We recommend reviewing the applicable privacy information before providing personal data directly to a third party.



15. Changes to this Privacy Policy

MBZ Inmo may update this Privacy Policy where necessary to reflect:

• changes in applicable legislation or regulatory guidance;

• changes to the services offered by MBZ Rentals;

• changes to technology providers or data processing activities;

• changes intended to improve transparency or data protection practices.

The current version will be published on mbzrentals.com together with the date of the latest update.

For questions concerning this Privacy Policy or the processing of personal data, please contact info@mbzrentals.com.