Privacy Policy

Confidentiality and security are core values at Olala!, and consequently, we are committed to ensuring the User’s privacy at all times and to not collecting unnecessary information. Below, we provide all the necessary information about our Privacy Policy regarding the personal data we collect, explaining:

• Who is responsible for processing your data.
• For what purposes we collect the data we request.
• What is the legal basis for its processing.
• How long we retain it.
• To which recipients your data is communicated.
• What your rights are.

1. Data Controller:

Olala!, formed by the companies listed in Annex I, which may act as controllers or processors of personal data, as applicable.

Passatge d’En Sagristà 11, Ground Floor

08029 Barcelona, Spain

legal@olalahomes.com

2. Purposes, Legal Basis, and Retention of Data Collected Through:

• EMAIL CORRESPONDENCE

Purpose: To respond to your requests for information, handle your inquiries, and answer your questions.

Legal Basis: User consent when requesting information via email.

Retention: Until your request is answered by email, unless it triggers a new processing activity.

• CONTACT FORM

Purpose: To provide a means to contact us and respond to your requests for information, as well as to send you communications about our products, services, and activities, including electronically, if you check the acceptance box.

Legal Basis: User consent when submitting information through our contact form and checking the acceptance box for receiving information.

Retention: Until your request is resolved via the form or answered by email, unless it triggers a new processing activity. If you agreed to receive commercial communications, data will be retained until you unsubscribe.

• NEWSLETTER SUBSCRIPTION

Purpose: Sending our commercial newsletter and informative/advertising communications about our products or services of interest, including electronically.

Legal Basis: User consent when subscribing to our commercial communications and/or newsletters.

Retention: Until the user revokes consent and unsubscribes.

• WHISTLEBLOWER CHANNEL

Purpose: To process and manage any complaints submitted through the available channels (form, email, postal mail, or in person).

Legal Basis: Compliance with a legal obligation.

Retention: During the processing of the complaint and, once completed, for the legally required period to address potential liabilities. Personal data of the informant will be deleted from the system after 3 months.

• RESERVATION FORM

Purpose: To process and manage your reservation, guarantee payment if applicable, and send commercial information, including electronically.

Legal Basis: Agreement of the reservation request and user consent when checking the acceptance box for receiving information.

Retention: While the reservation request is active; once finalized, for the legally required retention periods to address potential liabilities. If you agreed to receive commercial information, data will be retained until you unsubscribe.

*If you request a booking on behalf of a third party, you must provide the personal details of the guest. In this case, you guarantee that you have provided the guest with the necessary information regarding the processing of their personal data by any company within the Olala! group and how such data will be handled.

• CHECK-IN FORM

Purpose: To process and manage your stay and associated services.

Legal Basis: Service contract.

Retention: Data will be retained during your stay and, once completed, for the legally required retention periods to address potential liabilities.

• PROPERTY OWNER REGISTRATION FORM

Purpose: To process and manage your registration as a property owner, enabling you to rent your property easily and free of charge. Sending informative communications about our services, including electronically.

Legal Basis: User consent when requesting registration as a property owner.

Retention: While the relationship lasts and, if applicable, for the legally required retention periods to address potential liabilities. If you agreed to receive commercial communications, data will be retained until you unsubscribe.

Obligation to provide personal data and consequences of not doing so:

Providing personal data requires a minimum age of 14, or, where applicable, sufficient legal capacity to contract.

The personal data requested is necessary to manage your requests and/or provide the services you contract. If you do not provide it, we will not be able to process your request or provide the requested service.

3. Recipients of your data

Your data is confidential and will not be shared with third parties unless there is a legal obligation.

Some data from your identity document will be shared with authorities as legally required (Organic Law 4/2015 on the Protection of Citizen Security and related regulations): document number, type, issue date, first and second surname, gender, date of birth, nationality, entry date, and other legally required information.

Additionally, data may be shared with third parties necessary to provide contracted additional services.

4. Rights regarding your personal data

Anyone can withdraw consent at any time when it was given for processing personal data. Withdrawal does not affect the execution of subscription contracts or prior relationships.

You may also exercise the following rights:

• Request access to your personal data or rectification if inaccurate.
• Request deletion when the data is no longer necessary for the purposes collected.
• Request restriction of processing in certain circumstances.
• Object to processing based on your particular situation.
• Request data portability where applicable.
• Other rights recognized by applicable regulations.

How and where to request your rights:

Submit a written request to the data controller at the postal or email address indicated in Section 1, referencing “Personal Data,” specifying the right to exercise and the relevant data.

In case of disputes with the company regarding data processing, you may file a complaint with the Data Protection Authority (www.agpd.es).

5. Security of your personal data

To safeguard your personal data, we have implemented all necessary technical and organizational measures to prevent alteration, loss, or unauthorized processing or access.

6. Updating your data

To keep your data accurate, please inform us of any changes. Otherwise, we cannot guarantee the accuracy of your information.

We are not responsible for the privacy policies of personal data you may provide to third parties through links on our website.

This Privacy Policy may be modified to reflect changes on our website, as well as legislative or judicial updates regarding personal data. Therefore, we recommend reviewing it each time you provide your data via our website.