1. Controller
Controller: Oliver Strunk
NIF/NIE: X0224970F
Address: Barri de Sobrestany 6
17141 Torroella de Montgrí, Girona
E-mail: info@sobrestany.cat
Telephone: +34 646 068 450
No Data Protection Officer has been appointed, as none of the circumstances set out in Article 37 GDPR applies.
2. Purposes, legal bases and retention periods
a) Answering enquiries and booking requests (name, e-mail address, travel dates, message). Legal basis: Article 6(1)(b) GDPR, pre-contractual steps taken at your request. Retention: 12 months from the last contact; where a booking is concluded, tax and commercial retention periods of up to 6 years apply.
b) Preventing spam and abuse of the forms (IP address, browser identifier, timestamp). Legal basis: Article 6(1)(f) GDPR, legitimate interest in the security of the site. Retention: 15 minutes in the rate-limit record; the entry in the notification e-mail for as long as the enquiry itself.
c) Anonymous measurement of how the price calculator is used (travel dates, nights, unit, result, price shown, language, country, referring page, browser identifier, truncated IP address and a random session identifier). Legal basis: your consent, Article 6(1)(a) GDPR together with Article 22 LSSI-CE for the cookie. Retention: 12 months.
d) Provision and security of the website (host server logs). Legal basis: Article 6(1)(f) GDPR. Retention: according to the host's periods, generally a few weeks.
3. Handling of the IP address
For usage measurement your IP address is truncated before storage: with IPv4 the last field is removed (for example 93.184.216.34 becomes 93.184.216.0), with IPv6 the second half. It can no longer be traced back to your connection. Invalid values are not stored at all. The full IP address is processed solely for spam prevention on the enquiry form.
4. Whether providing data is required
Providing the data marked as required in the form is necessary for us to answer your enquiry; without it we cannot process it. All other entries are optional. Consent to usage measurement is entirely voluntary and has no effect whatsoever on the usability of the site or on your enquiry.
5. Recipients and processors
Your data is not sold and is not disclosed to third parties for advertising. The only party with access, as a processor under Article 28 GDPR, is the hosting provider ALL-INKL.COM — Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany (web server, database and e-mail). Data is disclosed to authorities only where we are legally obliged to do so.
6. International transfers
No personal data is transferred to countries outside the European Economic Area. The server and database are located in Germany. If you follow a link from this site to an external booking platform you leave our area of responsibility; its operator is responsible for any transfers occurring there.
7. Automated decision-making and profiling
No automated decision-making, including profiling, within the meaning of Article 22 GDPR takes place. Usage measurement serves solely to produce aggregate statistics and makes no decisions about individuals.
8. Your rights
You have the right of access to your data, to rectification of inaccurate data, to erasure, to restriction of processing, to data portability and to object to processing based on legitimate interest. You may withdraw consent at any time with future effect, without affecting the lawfulness of processing carried out beforehand.
An informal message to info@sobrestany.cat stating your request is sufficient; for verification we may ask for a copy of an official identity document. We will respond within one month.
9. Right to lodge a complaint
If you consider that the processing of your data infringes data protection law, you may lodge a complaint with the competent supervisory authority:
Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan 6, 28001 Madrid, Spain
Telephone: +34 901 100 099 / +34 912 663 517
www.aepd.es
10. Minors
The services on this site are directed at adults. Under Article 7 LOPDGDD, minors aged 14 and over may validly consent to the processing of their data; below that age the consent of a parent or guardian is required. Only adults may make a booking.
11. Security measures
The site is served exclusively over encrypted HTTPS. Forms are protected by a session token against abusive submission from other sites. Access to the internal analytics is password-protected and not publicly reachable.
12. Changes to this policy
This privacy policy may be amended if the processing or the legal framework changes. The version published on this page at any given time applies. Last updated: July 2026.