Privacy policy

Espa Living | Epicasa Estates SL
Last updated: 19 July 2026

1. Who is responsible for your personal data?

The controller responsible for processing your personal data is:

Epicasa Estates SL
Trading as: Espa Living
CIF: B72911076
Los Lagos de Santa Maria Golf, Calle Lila 1
29604 Marbella, Málaga, Spain
Email: antti@espaliving.com

This policy applies when you book or stay in one of our holiday properties, contact us about our services, enquire about property or vacation-rental management, subscribe to our Guest Club or Property Updates, use our website or digital guidebooks, or communicate with us by email, telephone or WhatsApp.

2. Personal data we collect

Name, telephone number, email address and preferred language;
Booking details, dates of stay, property information and information about accompanying guests;
Identification and guest-registration information required by Spanish law;
Billing, invoicing and transaction information;
Messages sent through email, WhatsApp, booking platforms, guidebooks or contact forms;
Property preferences, budget, location preferences and enquiry history;
Newsletter choices, interests, tags, consent and unsubscribe records;
Technical information such as IP address, browser, device, website interactions and cookie identifiers, where applicable; and
Other information you voluntarily provide to us.

We do not store full payment-card details. Payments handled by booking platforms or payment providers are processed under those providers’ own privacy and security terms.

3. How we receive your information

Directly from you or from the person making a booking for a group;
Through Airbnb, Booking.com, Vrbo or another booking platform;
Through Hostfully Guidebooks, our website, Kit landing pages, email, telephone or WhatsApp;
From property portals, agents or professional partners when you make an enquiry; and
From public sources where this is necessary and legally permitted.

If you provide information about another person, please make sure they know that their information has been shared with us.

4. Why we process personal data

Managing enquiries, bookings, stays, check-in and customer service – Contract or steps requested before entering into a contract
Guest registration and compliance with tourism, security, tax and accounting requirements – Legal obligation
Property, investment and rental-management enquiries – Steps requested before entering into a contract
Service communication by email, telephone or WhatsApp – Contract and, where applicable, legitimate interests
Guest Club emails, Property Updates and WhatsApp marketing – Consent
Complaints, legal claims, security and fraud prevention – Legal obligation or legitimate interests
Google Analytics and other non-essential website technologies

Where processing is based on consent, providing consent is voluntary. You may withdraw it at any time without affecting processing that took place before withdrawal.

5. Guest Club and Property Updates

Espa Living Guest Club
Guest Club emails may include future-stay offers, news about holiday properties, Costa del Sol tips and
relevant guest benefits.

Costa del Sol Property Updates
Property Updates may include selected properties for sale, new developments, investment and renovation
opportunities, market information and vacation-rental investment content.

These are separate subscriptions. Subscribing to one does not automatically subscribe you to the other.
Each marketing email includes an unsubscribe link, and you can also withdraw consent by emailing
antti@espaliving.com. Necessary messages concerning an existing booking are service communications
and may still be sent.

6. WhatsApp communications

We may use WhatsApp to respond to enquiries, provide booking and check-in information and support guests during their stay. We use WhatsApp for promotional marketing only where we have the necessary consent. WhatsApp is provided by companies within the Meta group, which process data under their applicable privacy terms.

7. Who may receive your information?

Hostfully and Hostfully Guidebooks;
Kit, for subscription management and email marketing;
WhatsApp and Meta, when you communicate with us through WhatsApp;
Airbnb, Booking.com, Vrbo and other booking platforms;
Website, hosting, email, cloud-storage, analytics and IT providers;
Banks, invoicing providers and payment-service providers;
Accountants, legal advisers and other professional advisers;
Property owners, agents and operational service providers where necessary to deliver a requested
service; and
Police, tax, tourism and other public authorities where disclosure is legally required

Service providers acting for us may use personal data only for the services they provide and under applicable data-protection requirements. We do not sell personal data.

8. International data transfers

Some providers may process personal data outside the European Economic Area, including in the United States. Where this happens, we rely on a legally recognised mechanism, such as an adequacy decision, the EU-US Data Privacy Framework where applicable, European Commission Standard Contractual Clauses, or another permitted safeguard. Contact us if you would like more information about the safeguard used for a particular transfer.

9. How long we retain personal data

Booking and guest information: for the booking relationship and afterwards for applicable legal, tax and claim periods;
Accounting and invoicing records: for the period required by Spanish law;
Mandatory guest-registration information: for the period required by applicable Spanish law;
General, property and investment enquiries: normally for up to two years after the last meaningful contact, unless a longer period is necessary;
Marketing subscriptions: until consent is withdrawn or the subscription is considered inactive;
Consent and unsubscribe records: as long as needed to demonstrate compliance and respect your preferences; and
Complaints and legal matters: until the matter and applicable limitation periods have ended.

When information is no longer required, it will be deleted, anonymised or securely restricted.

10. Your rights

Access the personal data we hold about you;
Correct inaccurate or incomplete information;
Request erasure or restriction of processing;
Object to processing based on legitimate interests and to direct marketing at any time;
Receive eligible information in a portable format;
Withdraw consent at any time; and
Lodge a complaint with a supervisory authority.
To exercise your rights, contact antti@espaliving.com. We may request reasonable proof of identity. You may also complain to the Spanish Data Protection Agency (AEPD) at www.aepd.es.

11. Cookies and Google Analytics

Our website uses necessary cookies to function. With your consent, we also use Google Analytics, a website analytics service provided by Google. Google Analytics may collect information such as your IP address, device and browser information, cookie identifiers, pages viewed and interactions with the website. We use this information to understand how visitors use the website and to improve our content and services.

Google Analytics must not be activated until you have accepted analytics cookies through our cookie banner. You can refuse or withdraw consent at any time through the website’s cookie settings. Refusing analytics cookies does not prevent you from using the essential parts of the website.

Google may process information outside the European Economic Area. Where applicable, transfers are protected through recognised safeguards. Further information is available in Google’s privacy information at policies.google.com/privacy. More detailed information about cookies, their duration and how to manage them should be provided in our Cookie Policy.

12. Security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, loss or destruction. No internet-based service or transmission method can be guaranteed to be completely secure.

13. Children’s information

We may process information about children included in a holiday booking when necessary to manage the stay or meet legal guest-registration requirements. This information is used only for those purposes and guest safety. Marketing subscriptions are intended for adults.

14. Automated decisions

We do not make decisions that produce legal or similarly significant effects based solely on automated processing.

15. Changes to this Privacy Policy

We may update this policy when our services, systems or legal obligations change. The current version will be published on our website with its effective date. If a change materially affects how we use personal data, we will provide additional notice where appropriate.

EPICASA ESTATES SL • CIF B72911076 • stay@espaliving.com