Privacy Policy

Last updated: 5 July 2026 · GDPR / LOPDGDD compliant

This Privacy Policy explains how Loft Siam ("we", "us") collects and uses personal data when you visit loftsiam.com, submit a booking request, contact us, or pay for a direct booking.

1. Data controller

Loft Siam
Calle Francia, 38660 Adeje, Santa Cruz de Tenerife, Spain
Email: booking@loftsiam.com
Phone: +34 650 512 721

2. Personal data we collect

Data	Source
Name, email, phone	Booking & contact forms
Check-in/out dates, guest count	Booking form
Message content	Contact form
Payment status, transaction IDs	Stripe (we do not receive full card numbers)
IP address	Server logs (rate limiting & security)
Language preference	Browser local storage

3. Purposes and legal bases

Processing booking requests — performance of pre-contractual steps / contract (Art. 6(1)(b) GDPR)
Contact enquiries — consent (Art. 6(1)(a)) and/or legitimate interest in responding (Art. 6(1)(f))
Payment processing — contract performance (Art. 6(1)(b))
Security & fraud prevention — legitimate interest (Art. 6(1)(f))
Legal obligations — e.g. tax and tourism records (Art. 6(1)(c))

4. Recipients and processors

We share data only when necessary:

Stripe Payments Europe Ltd. — payment processing (Stripe Privacy Policy)
Email provider (e.g. Brevo/Gmail SMTP) — transactional emails
Hosting provider — website and API server (VPS in EU)

We do not sell your personal data.

5. International transfers

Some processors (e.g. Stripe) may process data outside the EEA. Where this occurs, appropriate safeguards such as Standard Contractual Clauses apply.

6. Retention

Booking records: up to 2 years after stay (or longer if required by law)
Contact messages: up to 1 year
Server/rate-limit logs: up to 90 days
Payment records: as required by tax/accounting law (typically 6 years in Spain)

7. Your rights

Under GDPR you have the right to:

Access your personal data
Rectify inaccurate data
Erasure ("right to be forgotten") where applicable
Restrict or object to processing
Data portability
Withdraw consent at any time (without affecting prior lawful processing)
Lodge a complaint with a supervisory authority

To exercise your rights, email booking@loftsiam.com. We respond within one month.

Supervisory authority: Agencia Española de Protección de Datos (AEPD).

8. Children

Our services are not directed at children under 16. We do not knowingly collect data from children.

9. Security

We use HTTPS, access controls, and reputable payment/email providers. No method of transmission over the internet is 100% secure.

10. Changes

We may update this policy. Material changes will be reflected on this page with an updated date.