1. Legal Notice
1.1 Identifying Information
In compliance with article 10 of Spanish Law 34/2002 on Information Society Services and
Electronic Commerce (LSSI-CE), the following identifying data is provided:
| Name / Business name |
Vicent Tur Verdera - Habitatges turístics Can Xumeu Carlos |
| Tax ID (NIF) |
78290979Z |
| Address |
Venda des Pi des Català nº2501, 07860 Sant Francesc de Formentera - Illes Balears |
| Email |
canxumeucarlos@gmail.com |
| Activity |
Tourist accommodation |
1.2 Purpose and Scope
This Legal Notice governs access, browsing and use of the Can Xumeu Carlos website
(hereinafter, «the Website»). Access to and use of the Website implies full and unconditional
acceptance of these terms.
1.3 Intellectual and Industrial Property
All content on the Website — including, without limitation, texts, photographs, logos, graphics and
source code — is the property of Can Xumeu Carlos or its legitimate licensors, and is protected by
Spanish and international intellectual and industrial property law. Reproduction,
distribution, public communication or transformation without the prior written authorisation of the
owner is strictly prohibited.
1.4 Technology Infrastructure and Providers
The Website is hosted on servers of Hostinger International Ltd., a provider based
in the European Union. The Website may incorporate forms managed via Google Forms
and audience analytics tools via Google Analytics, both services of Google LLC
(USA). International data transfers arising from the use of these services are governed in the
Privacy Policy and Cookie Policy below.
1.5 Disclaimer of Warranties and Liability
Can Xumeu Carlos does not guarantee the continuous availability of the Website or the absence of
errors in its contents. The owner is exempt from liability for damages arising from access to or use
of the Website, computer viruses or technical failures beyond its control.
1.6 Hyperlinks
The Website may contain links to third-party sites. Can Xumeu Carlos accepts no responsibility for
the content, policies or privacy practices of those sites.
1.7 Applicable Law and Jurisdiction
This Legal Notice is governed by Spanish law. For the resolution of any dispute, the parties submit
to the jurisdiction of the Courts of Ibiza (Illes Balears), expressly waiving
any other forum.
2. Privacy Policy
Drafted in accordance with GDPR (EU) 2016/679, LOPDGDD 3/2018 and LSSI-CE 34/2002
2.1 Data Controller
| Controller |
Vicent Tur Verdera - Habitatges turístics Can Xumeu Carlos |
| Tax ID (NIF) |
78290979Z |
| Address |
Venda des Pi des Català nº2501, 07860 Sant Francesc de Formentera - Illes Balears |
| Email |
canxumeucarlos@gmail.com |
2.2 Applicable Legal Framework
Personal data processing is carried out in accordance with:
- Regulation (EU) 2016/679 (GDPR) of the European Parliament and of the Council
of 27 April 2016.
- Spanish Organic Law 3/2018 on Personal Data Protection and guarantee of digital
rights (LOPDGDD).
- Spanish Organic Law 4/2015 on the Protection of Citizens' Security.
- Royal Decree 933/2021 establishing documentary registration and reporting
obligations for accommodation operators.
2.3 Purposes and Legal Bases for Processing
A) Booking management and communications
Data processed: name, surname, email, phone and booking details.
Purpose: processing booking requests, managing pre-contractual and contractual
relationships with guests, and attending to enquiries.
Legal basis: Article 6(1)(b) GDPR — performance of a contract or
pre-contractual measures at the request of the data subject.
B) Mandatory traveller registration
Data processed: name, surname, identity document type and number or passport, date
of birth, sex, nationality, date of entry and, where applicable, vehicle data.
Purpose: compliance with legal obligations for documentary registration and
reporting to the Spanish Ministry of the Interior, pursuant to Organic Law
4/2015 and Royal Decree 933/2021.
Legal basis: Article 6(1)(c) GDPR — compliance with a legal obligation.
Recipients: Spanish law enforcement bodies (Guardia Civil or Policía Nacional,
depending on area) and the Ministry of the Interior.
Retention period: three (3) years from the date of service.
C) Statistical analysis and Website improvement
Data processed: anonymised or pseudonymised browsing data collected via
Google Analytics (truncated IP, pages visited, session duration, device).
Purpose: obtaining audience metrics to improve Website content and usability.
Legal basis: Article 6(1)(a) GDPR — consent, given by accepting the Cookie
Policy.
D) Commercial communications (where applicable)
Data processed: email address and guest preferences.
Purpose: sending offers, promotions and information about Can Xumeu Carlos services.
Legal basis: Article 6(1)(a) GDPR — express consent. You may withdraw
consent at any time by writing to canxumeucarlos@gmail.com.
2.4 User Area — Account management, bookings and discounts (Future feature)
Can Xumeu Carlos plans to soon enable a private user area on the Website, allowing
guests to:
- Create and manage a personal account.
- View their booking history.
- Access personalised rates and discounts linked to their loyalty profile.
- Update their accommodation preferences and contact details.
Data to be processed: name, surname, email, encrypted password, booking history and
user preferences.
Legal bases: Article 6(1)(b) GDPR (performance of contract) and Article 6(1)(a) GDPR
(consent for personalisation). Passwords will be stored encrypted using robust algorithms (bcrypt or
equivalent).
This section will be updated with full technical and legal details when the feature is
activated.
2.5 Data Retention Periods
| Type of data |
Retention period |
| Bookings and contracts |
5 years (civil and tax obligations) |
| Traveller registration |
3 years (RD 933/2021) |
| Commercial communications |
Until consent is withdrawn |
| Browsing data (Analytics) |
14 months (GA4 default) |
| User accounts (future) |
While account is active + 2 years after closure |
2.6 Recipients and Processors
Personal data will not be shared with third parties, except in the following cases:
- Legal obligation: disclosure to Spanish law enforcement bodies (traveller
registration).
- Data processors: Hostinger International Ltd. (web hosting, EU
servers) and Google LLC (Google Analytics and Google Forms).
2.7 International Data Transfers — Google LLC (USA)
The use of Google Analytics and Google Forms involves the transfer
of personal data to Google LLC (USA). Such transfers are made under the following
appropriate safeguards pursuant to Article 46 GDPR:
- Standard Contractual Clauses (SCCs) adopted by the European Commission.
- EU–US Data Privacy Framework, European Commission Adequacy Decision of 10 July
2023.
Google's privacy policy: policies.google.com/privacy
2.8 Your Rights — How to Exercise Them
Under Articles 15 to 22 GDPR, you have the following rights:
| Right |
Description |
| Access |
Find out what personal data of yours is being processed. |
| Rectification |
Correct inaccurate or incomplete data. |
| Erasure («right to be forgotten») |
Request deletion of your data when no longer necessary. |
| Objection |
Object to processing based on legitimate interest or to receiving commercial
communications. |
| Portability |
Receive your data in a structured, commonly used format. |
| Restriction |
Request suspension of processing in the cases provided for in Article 18 GDPR. |
Send an email to canxumeucarlos@gmail.com with the subject «GDPR Rights
Request», attaching a copy of your ID/passport and a clear description of the right you
wish to exercise. Can Xumeu Carlos will respond within a maximum of one (1) month.
If you believe your data is not being processed in compliance with applicable law, you may lodge a
complaint with the Spanish Data Protection Authority (AEPD): www.aepd.es
2.9 Data Security
Can Xumeu Carlos applies appropriate technical and organisational measures to ensure an adequate
level of security pursuant to Article 32 GDPR, including data-in-transit encryption via
HTTPS (TLS) and restricted access controls on personal information.
2.10 Changes to this Privacy Policy
Can Xumeu Carlos reserves the right to modify this Privacy Policy to adapt to regulatory or
technological changes. We recommend reviewing it periodically. Significant changes will be
communicated via a prominent notice on the Website.
3. Cookie Policy
Drafted in accordance with GDPR (EU) 2016/679, LOPDGDD 3/2018 and LSSI-CE 34/2002
3.1 What are cookies?
Cookies are small text files that are downloaded and stored on the user's device
when they access a website. They allow the website to remember user preferences, analyse behaviour
and improve the browsing experience.
3.2 Legal Framework
The use of cookies on the Website is governed by:
- Article 22.2 of LSSI-CE, as amended by Royal Decree-Law 13/2012.
- GDPR (EU) 2016/679 and LOPDGDD 3/2018, regarding consent.
- AEPD Guidelines on the use of cookies (current version).
3.3 Classification of Cookies Used
A) Technical or strictly necessary cookies
Essential for the correct operation of the Website. No user consent is required.
| Cookie |
Provider |
Purpose |
Duration |
| User session |
Can Xumeu Carlos / Hostinger |
Maintaining the active session during browsing |
Session |
| Cookie preferences |
Can Xumeu Carlos |
Remembering the user's cookie choice |
12 months |
B) Analytics cookies — Google Analytics
Allow measurement and analysis of Website usage for statistical purposes. Require prior user
consent.
| Cookie |
Provider |
Purpose |
Duration |
_ga |
Google LLC |
Unique user identifier to distinguish visitors |
2 years |
_ga_[ID] |
Google LLC |
Stores session state in Google Analytics 4 |
2 years |
_gid |
Google LLC |
Identifies the user for 24 hours |
24 hours |
_gat |
Google LLC |
Throttles request rate |
1 minute |
Note: Google Analytics transfers data to Google LLC servers in the USA (see section 2.7 of the
Privacy Policy). Can Xumeu Carlos has configured Google Analytics with IP
anonymisation enabled and a data retention period of 14
months.
C) Form cookies — Google Forms
When the user uses forms based on Google Forms, Google may set its own cookies
necessary for the form to function.
| Cookie |
Provider |
Purpose |
Duration |
| Forms functional cookies |
Google LLC |
Ensuring correct form submission and validation |
Session |
3.4 How to Manage or Reject Cookies
When you first access the Website, a cookie banner will allow you to accept or
reject non-essential cookies. You can change your choice at any time via the «Cookie settings» link
in the Website footer.
You can also manage cookies directly from your browser:
| Browser |
Instructions |
| Google Chrome |
Settings › Privacy and security › Cookies |
| Mozilla Firefox |
Options › Privacy & Security › Cookies |
| Safari |
Preferences › Privacy › Manage Website Data |
| Microsoft Edge |
Settings › Privacy, search and services › Cookies |
Disabling technical cookies may affect the correct functioning of the Website.
To prevent Google Analytics from collecting information about your visit, you can install the
official opt-out add-on: tools.google.com/dlpage/gaoptout
3.5 Changes to this Cookie Policy
Can Xumeu Carlos reserves the right to update this Cookie Policy in response to regulatory or
technological changes. We recommend reviewing it periodically.
