Last updated: 14 October 2026
1. Who we are
This website is operated by:
Robert Anton Kolenbrander, trading as Mariposa-Feiertage
Loma de las Cuadrillas s/n
29780 Nerja, Málaga
Spanien
Tax or registration number: X5544608K
Email: katti@mariposaholidays.com
Telephone: +34 665 321 612 / +34 651 588 029
For the purposes of the General Data Protection Regulation (“GDPR”), we are the controller of the personal data described in this Privacy Policy.
2. Scope of this Privacy Policy
This Privacy Policy explains how we collect, use, store and share personal data when you:
- visit our website;
- contact us;
- submit a booking request;
- make or manage a reservation;
- stay at one of our accommodations;
- participate in a retreat;
- interact with our website statistics or advertising, where you have consented to this.
3. Personal data we collect
Booking information
When you submit a booking request, we may collect:
- your first and last name;
- email address and telephone number;
- country of residence;
- preferred accommodation;
- arrival and departure dates;
- number of adults and children;
- estimated arrival time;
- special requests;
- booking and payment information;
- acceptance of our terms and conditions;
- correspondence relating to your reservation.
Please do not include sensitive personal information in the “Special requests” field unless it is genuinely necessary for us to assist you.
Contact information
When you contact us through our contact form, email, telephone or WhatsApp, we may collect your name, contact details, the contents of your message and any other information you voluntarily provide.
Guest registration information
Spanish accommodation providers may be legally required to register their guests with the competent authorities. Depending on the applicable requirements, we may request:
- full name;
- date of birth;
- nationality and address;
- identity document type and number;
- document issue details;
- contact details;
- signature;
- information relating to the stay.
We only collect this information when required and use it to comply with our legal obligations.
Technical and usage information
When you visit our website, we may receive technical information such as your IP address, browser, device, operating system, language, approximate location, access time, pages visited, referring website, website interactions, cookie identifiers and security information.
Non-essential analytics, behavioural and advertising information is only collected after you provide the relevant cookie consent.
4. Why we process your data
| Purpose | Legal basis |
|---|---|
| Responding to questions and enquiries | Steps taken at your request before entering into a contract and our legitimate interest in responding to guests |
| Processing and managing booking requests | Performance of a contract or steps taken before entering into a contract |
| Managing payments, deposits, cancellations and refunds | Performance of a contract and compliance with legal obligations |
| Providing accommodation or a retreat | Performance of a contract |
| Guest registration, accounting and tax obligations | Compliance with a legal obligation |
| Website security and spam prevention | Our legitimate interest in maintaining a safe and reliable website |
| Remembering language and website preferences | Your consent, unless the preference is strictly necessary for a service you requested |
| Website analytics and improvement | Your consent |
| Heatmaps, session analysis and behavioural insights | Your consent |
| Advertising measurement and remarketing | Your consent |
Where processing is based on consent, you may withdraw that consent at any time. This does not affect processing carried out before consent was withdrawn.
5. Booking management and Smoobu
We use WP Booking System to display availability and collect booking information.
Booking and availability information may be exchanged with Smoobu, our property and reservation management platform. This allows us to:
- synchronise availability;
- avoid double bookings;
- manage reservations;
- communicate with guests;
- administer accommodation and payment information;
- coordinate reservations received through different channels.
More information is available in the Smoobu Privacy Policy.
6. Payments
When an online payment method is offered, payment information may be processed by Stripe.
We receive the information necessary to administer the payment, such as its status, amount and reference. Where payment details are entered directly into the payment provider’s secure environment, we do not store your complete payment-card details.
7. Contact and booking forms
Information submitted through our forms is used to respond to your enquiry, process your booking request or provide the requested service.
Acknowledging our privacy notice does not constitute consent to receive marketing. We only send promotional messages where we have a separate lawful basis, such as your optional consent.
8. Website software
Our WordPress website may use:
- Elementor for website layouts and functionality;
- JetEngine for dynamic website content;
- WP Booking System for availability and booking forms;
- TranslatePress for translated content and language selection.
Information submitted through the website may be stored within our secured WordPress environment and accessed only by authorised persons and service providers.
TranslatePress or a connected language-detection service may use your chosen language, browser language, IP address or approximate location to present an appropriate language version.
9. Analytics and website improvement
Google Analytics and Google Tag Manager
Subject to your consent, Google Analytics helps us understand how visitors use our website. It may process information about visited pages, approximate location, devices, interactions and cookie identifiers.
Google Tag Manager is used to manage website tags. The information processed depends on the services loaded through the tag manager. Non-essential Google tags remain disabled until the required consent is provided.
Lies den Google Privacy Policy.
Hotjar or Microsoft Clarity
If enabled and accepted through the cookie banner, Hotjar or Microsoft Clarity may help us understand how visitors interact with the website using aggregated behavioural information, heatmaps and session recordings.
We aim to exclude sensitive form fields from recordings. These services remain disabled until the appropriate consent is provided.
Google Search Console
Google Search Console provides aggregated information about how our website performs in Google Search. It does not ordinarily place analytics cookies on your device through our website merely because we use Search Console.
10. Advertising services
The following services only apply when they are active and you have accepted marketing cookies.
Google Ads
Google Ads may be used to measure conversions, understand advertising effectiveness and display more relevant advertisements. Google may associate website information with other information held by Google, subject to your settings and Google’s policies.
Meta Ads
The Meta Pixel or similar Meta technologies may be used to measure advertising results, create audiences and display relevant advertisements on services such as Facebook and Instagram.
Lies den Meta Privacy Policy.
11. CAPTCHA and spam prevention
Our forms may use a CAPTCHA or similar security service to prevent spam and automated submissions.
Depending on the provider, technical information such as your IP address, browser, interaction data and submission time may be processed.
Active CAPTCHA provider: [insert provider and privacy-policy link]
12. Who receives your information?
Where necessary, personal data may be shared with:
- our hosting and technical service providers;
- authorised website administrators and support providers;
- WP Booking System and Smoobu;
- payment providers and financial institutions;
- email and communication providers;
- analytics providers, after consent;
- advertising platforms, after consent;
- accountants, insurers and legal advisers;
- police, guest-registration authorities, tax authorities or other public bodies where required by law.
We do not sell your personal data.
13. International data transfers
Some technology providers may process data outside the European Economic Area. Where required, these transfers are based on an adequacy decision, Standard Contractual Clauses or another legally recognised safeguard.
14. How long we retain information
- Contact enquiries are normally retained until the enquiry is resolved and for no longer than 12 months afterwards.
- Unsuccessful booking enquiries are normally retained for no longer than 12 months, unless further retention is justified.
- Booking, payment, invoice and contract records are retained for the applicable Spanish accounting, tax and legal limitation periods.
- Guest registration information is retained for the period required by Spanish law.
- Security logs are retained for a limited period unless needed to investigate misuse.
- Cookie and analytics information is retained according to our Cookie Policy and the settings of the relevant service.
- Consent records may be retained as evidence of the choices you made.
Information may be retained for longer where necessary to establish, exercise or defend a legal claim.
15. Children’s data
Bookings must be made by an adult. Our booking form may request the number of children in a group.
Please do not provide additional personal information about a child unless it is necessary for the stay or legally required. Where guest registration information is legally required for a child, it must be provided by a parent, guardian or authorised adult.
16. Security
We take reasonable technical and organisational measures to protect personal data, including encrypted website connections, access controls, software updates, monitoring and restricted administrative access.
No internet-based system can be guaranteed to be completely secure. Please do not send unnecessary identity documents or payment information through ordinary email.
17. Your rights
Subject to the applicable conditions, you may request:
- access to your personal data;
- correction of inaccurate or incomplete data;
- deletion of your data;
- restriction of processing;
- data portability;
- objection to processing based on legitimate interests;
- withdrawal of consent at any time.
To exercise your rights, email katti@mariposaholidays.com. We may request reasonable information to verify your identity.
You also have the right to lodge a complaint with the Spanish Data Protection Agency:
Agencia Española de Protección de Datos (AEPD)
www.aepd.es
18. Automated decision-making
We do not make solely automated decisions that produce legal or similarly significant effects for you.
Where advertising tools are enabled, providers may use profiling to select or measure advertisements. This only occurs after the required consent and does not determine whether we accept your booking.
19. Changes to this Privacy Policy
We may update this Privacy Policy when our services, website, legal obligations or service providers change. The current version and its last-updated date will always be published on this page.