— Privacy

How we handle your data.

Short version: we collect only what you give us when you write to us. We use it to write back. We don't share it. You can ask us to delete it any time. Long version below.

— 01Who is responsible

Lukas Klingebiel, who runs the finca. Address and contact details on the imprint page. We are the data controller under Article 4(7) GDPR.

— 02What we collect

When you send an inquiry

  • Your name
  • Your email address
  • Your requested check-in and check-out dates
  • Anything you choose to write in the message field

When you visit this website

Our server logs the date and time of your visit, the page you requested, your browser type, and a truncated IP address for two weeks. We also use Google Analytics 4 (see section 06 below) to understand which pages are read and how guests find us — always with anonymised IPs and without advertising features.

— 02Why we collect it

To reply to your booking inquiry (legal basis: Art. 6(1)(b) GDPR — pre-contractual measures), and to keep the website running (Art. 6(1)(f) — legitimate interest in basic security and performance).

— 03How long we keep it

Email inquiries
6 months after the last message, then deleted. If you become a guest, we keep contract data for the legal retention period required by Spanish tax law (currently 6 years).
Server logs
14 days, then deleted.

— 04Who we share it with

No one. Your inquiry sits in a mailbox hosted by a German email provider (mailbox.org) bound by GDPR. We do not sell, rent, or hand over your data to anyone except where legally compelled.

— 05Your rights

  • You can ask us what data we hold on you (Art. 15)
  • You can ask us to correct it (Art. 16)
  • You can ask us to delete it (Art. 17)
  • You can ask us to stop processing it (Art. 18)
  • You can ask for a portable copy (Art. 20)
  • You can complain to a supervisory authority — in Spain, the AEPD (aepd.es)

Email hola@fincalavanda.es and we'll respond within a few days.

— 06Google Analytics

We use Google Analytics 4, a web-analytics service provided by Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland). It helps us understand which pages are read, on what device, and which country you come from — nothing more.

What we configure

  • IP anonymisation is enabled (your IP is truncated before it reaches Google’s servers).
  • Google Signals and ad personalisation are switched off.
  • No demographic / interest reports, no cross-device tracking, no remarketing.
  • Data retention is set to the shortest period Google allows: 2 months.

Legal basis & transfers

Processing is based on your consent (Art. 6(1)(a) GDPR), collected via the cookie banner on first visit. Until you accept, analytics cookies stay switched off via Google Consent Mode v2 — only an anonymous "ping" reaches Google, with no identifiers attached. Google may transfer aggregated data to the United States under the EU–US Data Privacy Framework. You can withdraw consent at any time — see below.

How to opt out

  • Withdraw your consent on this site at any time: .
  • Install the official Google opt-out browser add-on: tools.google.com/dlpage/gaoptout
  • Or set your browser to block third-party cookies / scripts.
  • Or use a privacy-respecting browser (Firefox, Brave, Safari with ITP).

Google’s own privacy notice: policies.google.com/privacy.

— 07Cookies

This site sets only the cookies Google Analytics requires to count visits (_ga, _ga_*). They expire after 13 months. We do not use marketing or social-media cookies. We embed Google Fonts directly; the request to fonts.googleapis.com may be logged by Google. If that concerns you, a strict privacy browser will block it and the site will simply use system fonts.

Last updated: May 2026.