Privacy policy

1. Data controller

• Controller: Beach Valencia Luxury S.L.
• Tax ID (CIF): B56843402
• Email: info@beachvalencia.com

2. Purposes of processing

We process your data for the following purposes:

• Managing enquiries: handling the information requests and contact you send us.
• Service improvement: we analyse queries submitted through our chat on an anonymised basis in order to improve our service and the information offered on the website. Any personal data they may contain (name, email address, phone number and similar) is removed before storage, and the queries are not linked to you or to your session.
• Chat assistant: answering the questions you ask through the website’s virtual assistant. To do so we keep the conversation (the messages you write and the assistant’s replies) and an encrypted, irreversible version of your IP address (a “hash”), used solely to limit the number of conversations and prevent abuse of the service. We do not keep your IP address in clear text.
• Managing accommodation bookings: processing, confirming and managing apartment bookings, and complying with associated legal obligations (among others, the registration and reporting of traveller data to the competent authorities, mandatory for tourist accommodation).
• Payment management: processing payment for the booking. Payment is made through Stripe Payments Europe, Ltd. as data processor: card details are entered directly in Stripe’s secure environment and the company does NOT store full card data.

3. Legal basis

• Consent of the data subject (Art. 6.1.a GDPR): to handle enquiries you voluntarily send us.
• Performance of a contract (Art. 6.1.b GDPR): to manage the booking and, where applicable, payment for the stay.
• Compliance with a legal obligation (Art. 6.1.c GDPR): for tax, accounting and traveller-registration obligations.
• Legitimate interest (Art. 6.1.f GDPR): to ensure the security of the site and prevent fraud.

4. Retention period

We keep your data for as long as necessary for the purpose for which it was collected and, thereafter, for the legally required periods (for example, tax and commercial periods). Enquiry data that does not result in a booking will be kept only for the time needed to handle it.

5. Recipients and disclosures

We do not disclose your data to third parties, except where legally required (for example, to the competent authorities for traveller registration, or to the tax authorities).

Data may be accessed by the processors that provide us with services (for example, the website hosting provider and Stripe Payments Europe, Ltd. for payments), with whom the data-processing agreements required by the GDPR are signed.

International transfers: the chat assistant runs on technology provided by Anthropic PBC (United States). The messages you write in the chat are transmitted to that provider, acting as data processor, for the sole purpose of generating the reply. This entails an international transfer of data outside the European Economic Area. If you would rather your data were not processed in this way, please do not use the chat assistant: you can contact us by email instead.

6. Your rights

You may exercise the following rights: access, rectification, erasure, objection, portability and restriction of processing, as well as withdrawing any consent given.

• How to exercise them: by writing to info@beachvalencia.com, stating the right you wish to exercise and enclosing a document proving your identity.
• We will respond to your request within the legally established time limits.

7. Complaint to the supervisory authority

If you believe that the processing of your data does not comply with the regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan, 6, 28001 Madrid — www.aepd.es.

8. Security and changes

We apply appropriate technical and organisational measures to protect your data. This policy may be updated; the version in force is the one published on this page.

9. MCP server for AI assistants

This site publishes a Model Context Protocol (MCP) server at /api/mcp, read-only, so that AI assistants and agents (for example Claude, ChatGPT and any other MCP-compatible client) can query availability, prices, features and policies of our apartments and hand the traveller off to this website to complete the booking.

The server does not expose personal guest data: the information returned is the same that any anonymous visitor would obtain by browsing the site. When you send an AI assistant a query related to Beach Valencia, that assistant may forward to our server your search parameters (dates, party size and category). We do not receive the messages you sent to the assistant nor your identity; we only receive those parameters and an anonymous session identifier.

For operational purposes, capacity planning and abuse prevention, each call is logged with timestamp, tool invoked, query parameters, latency, result and, if the MCP client sends it, an identifier of the client itself (for example, "claude.ai" or "chatgpt.com"). The IP address is turned into an irreversible hash (SHA-256 of the IP, the user-agent and an internal secret) that is only used to rate-limit sessions.

Legal basis: legitimate interest (Art. 6.1.f GDPR) in operating the site and preventing abuse. Booking and payment, if any, are governed by the legal basis in section 3 (performance of a contract).

Technical documentation of this service is at /mcp. Booking and payment are not performed through the MCP server: they are always completed by the guest on this website with the same conditions as any other direct booking.