Privacy Policy

Privacy Policy

Kalma Boutique | Last updated:30-9-2026.

At Kalma Boutique, we take the privacy of people who visit our website, book a stay or stay at our hotels very seriously. This policy clearly explains what personal data we process, for what purposes, for how long, and what rights you can exercise, in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), Organic Law 3/2018 on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD), and Law 34/2002 on Information Society Services and Electronic Commerce (LSSI).

1. Data controller

  •      Data controller: PREMIUM DREAMS MALAGA S.L.

  •      Trading name: Kalma Boutique (Dulces Dreams and Picnic Dreams hotels)

  •      Tax ID: B88958999

  •      Registered office: Calle Bodegueros Nº5 29006, Málaga, Spain

  •      Privacy email: clientes@kalmaboutique.com

  •      Company registration details: registered with the Málaga Commercial Registry.

    • If the company has appointed a Data Protection Officer, you can contact them at clientes@kalmaboutique.com . Otherwise, all enquiries will be handled via the privacy email address provided.

    2. Personal data we process

    We only process the data needed for each purpose. Depending on your relationship with us, this may include:

  •      Identification and contact details: first name, last name, email address, telephone number and postal address.

  •      Identity document details: type and number of identity document or passport, nationality, date of birth, sex, and other information required by guest registration regulations.

  •      Booking and stay data: dates, room, number of guests, preferences, special requests, stay history and communications with the hotel.

  •      Financial and payment data: card details (processed by the payment gateway, without the hotel storing the full card number), amounts, invoices and tax details.

  •      Access data: entry codes or temporary credentials for contactless access to the accommodation.

  •      Browsing data: IP address, device and browser type, and website usage data, collected through cookies in accordance with our Cookie Policy.

  •      Professional data: CV, education and work experience, if you submit a job application.

    • We do not request special categories of data (health, political beliefs, religion, etc.). If you voluntarily provide us with this type of information when making a special request (for example, an accessibility requirement or food allergy), we will process it only to address your request and with your explicit consent.

    3. Purposes and legal basis for processing

    3.1 Booking and stay management

    Process your booking, manage payment, prepare for your arrival, complete check-in (in person or online), provide access to your accommodation, deliver the services you have booked and respond to your requests during your stay.

    Legal basis: performance of the accommodation contract or taking pre-contractual steps at your request (Article 6(1)(b) GDPR).

    3.2 Guest registration

    Comply with the legal obligation to register guests and report their data to the Ministry of the Interior and the law enforcement authorities, under Organic Law 4/2015 on the protection of public security and Royal Decree 933/2021.

    Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR). Providing this information is required in order for us to accommodate you.

    3.3 Invoicing and accounting obligations

    Issue invoices and meet tax and commercial obligations.

    Legal basis: compliance with legal obligations (Article 6(1)(c) GDPR).

    3.4 Handling enquiries

    Respond to enquiries you send us through the contact form, email, telephone, WhatsApp or social media.

    Legal basis: consent (Article 6(1)(a) GDPR) or, if your enquiry relates to a booking, performance of a contract (Article 6(1)(b) GDPR).

    3.5 Satisfaction surveys and reviews

    After your stay, send you a survey or invitation to review your experience so that we can improve our services.

    Legal basis: legitimate interest in assessing the quality of the service provided (Art. 6(1)(f) GDPR). You may object at any time.

    3.6 Marketing communications

    Send you information about offers, news and promotions from Kalma Boutique by email or other electronic means.

    Legal basis: consent (Article 6(1)(a) GDPR), or legitimate interest where you have previously been a customer and the communications relate to services similar to those you booked (Article 21(2) LSSI). You can unsubscribe at any time using the link included in each communication or by emailing our privacy address.

    3.7 Recruitment

    Assess your application for current or future vacancies.

    Legal basis: consent (Art. 6(1)(a) GDPR), which you give by sending us your CV.

    3.8 Website security and operation

    To ensure website security, prevent fraud and analyse website usage through cookies, as described in the Cookie Policy.

    Legal basis: legitimate interest in security (Article 6(1)(f) GDPR) and consent for non-essential cookies (Article 22(2) LSSI).

    We do not make automated decisions or create profiles that produce legal effects concerning you.

    4. Data retention period

  •      Booking and stay data: for the duration of the contractual relationship and thereafter for the limitation periods applicable to any legal claims that may arise.

  •      Guest registration records: three years, as required by Royal Decree 933/2021.

  •      Invoicing data: four years for tax purposes and six years for commercial purposes.

  •      Enquiries: for as long as needed to address them and for a maximum of one year afterwards.

  •      Marketing communications: until you withdraw your consent or object.

  •      Job applications: one year from receipt, unless you ask us to delete them sooner.

  •      Cookies: the periods specified in the Cookie Policy.

    • After these periods, the data will be deleted or kept restricted solely for access by judges, courts and competent authorities, in accordance with Article 32 of the LOPDGDD.

    5. Data recipients

    We do not sell or disclose your data to third parties for their own purposes. We only disclose it in the following cases:

  •      Public authorities: the Ministry of the Interior and law enforcement agencies (guest registration), the Tax Agency and other public bodies where required by law.

  •      Financial institutions and payment gateways: to process payments, deposits and refunds.

  •      Booking platforms: if you book through an online travel agency (Booking.com, Expedia, Airbnb or others), that platform acts as an independent controller of the data it collects. We recommend that you consult its privacy policy.

    • Data is also accessed by service providers acting as data processors on our behalf; this does not constitute a transfer. We have signed the relevant agreement with them in accordance with Article 28 GDPR. These providers include our hotel management and booking system (Octorate), online check-in and contactless access provider, web hosting and technical support provider, email and communications tools, review management provider, accounting and tax advisers, and marketing and communications agency.

    6. International transfers

    Some of our technology providers may process data outside the European Economic Area. In such cases, we only work with providers located in countries covered by an European Commission adequacy decision (such as entities participating in the EU-U.S. Data Privacy Framework) or that provide appropriate safeguards, such as standard contractual clauses approved by the European Commission. You can request more information by emailing our privacy contact.

    7. Your rights

    You may exercise the following rights at any time:

  •      Access: find out whether we process your data and obtain a copy.

  •      Rectification: correct inaccurate or incomplete data.

  •      Erasure: request that we delete your data when it is no longer needed.

  •      Right to object: object to certain processing, such as marketing communications or surveys.

  •      Restriction: request that we suspend processing in certain circumstances.

  •      Data portability: receive your data in a structured, commonly used format, or have us transmit it to another controller.

  •      Withdrawal of consent: this does not affect the lawfulness of processing carried out before withdrawal.

    • To exercise your rights, email us at clientes@kalmaboutique.com or write to us at calle Bodegueros Nº43. Oficina 5. 29006 Málaga, specifying which right you wish to exercise. If we have reasonable doubts about your identity, we may ask you for additional information to verify it. We will respond within a maximum of one month.

    If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

    8. Data security

    We implement appropriate technical and organisational measures to protect your data against loss, misuse, unauthorised access, alteration or disclosure, taking into account the state of the art and the nature of the data processed. These measures include the use of an encrypted connection (HTTPS) on our website and restricting access to data to authorised personnel.

    9. Minors

    The website is not intended for children under 14. Bookings must be made by adults. Information about minors staying at the hotel must be provided by their parents or guardians and will only be processed to manage their stay and comply with guest registration regulations.

    10. Data accuracy

    You warrant that the data you provide is true, accurate and up to date, and agree to notify us of any changes. If you provide data about other people (for example, travel companions), you must inform them of the contents of this policy beforehand.

    11. Links to other websites and social media

    The website may contain links to third-party websites and to our social media profiles. We are not responsible for the privacy policies of those websites. When you interact with our social media profiles, we process your data in accordance with this policy and the terms of each social network.

    12. Changes to this policy

    We may update this policy to reflect changes in regulations or our services. We will always publish the current version on this page, along with its update date. We recommend reviewing it periodically.