Privacy Policy

Draft for review. This page is a working draft prepared for professional legal review. It is not yet legal advice and should not be relied on until it has been checked and finalised.

At Casa Agara we ask for very little, we use it plainly, and we never sell it. This policy explains what we collect through agara.es, why, and the choices you have.

Who we are

Casa Agara is an 18th-century hosted, catered casona in Fresneda de Cabuérniga, Cantabria, Spain. For the purposes of data protection law, the operator of this website is the data controller for the information described here.

• Legal entity, registered address and tax number (NIF/CIF): [to be confirmed for legal review]
• Contact for anything to do with your data: hello@agara.es

We are based in Spain and the European Union, so this policy is written to meet the EU General Data Protection Regulation (GDPR) and Spain's Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD).

Our role, so it's clear

Casa Agara is the house and the host — the accommodation and venue where hosted weeks take place. We are not the tour operator and we do not sell holiday packages or flights.

The holidays themselves are sold by independent operators (currently Spice Escapes, with New You Escapes for yoga weeks coming soon). Where a trip includes flights, the operator holds the relevant financial protection, including ATOL where it applies. When you book a holiday, your booking contract — and its own privacy terms — is with that operator, not with Casa Agara.

What we collect

We only collect what you give us through the site:

• Enquiries: first and last name, email, phone number, the dates or week you're interested in, group size, and your message.
• Week waitlists: name, email and phone number, when you ask to be told about availability for a particular week.
• Reviews: the name and comments you choose to submit if you leave a review.
• Contact records: we keep a simple record built from the above so we can pick up the conversation where it left off.
• Basic site analytics: privacy-respecting, aggregated usage data (see our Cookie Notice). This does not identify you personally.

We do not ask for special-category data (health, beliefs, and so on). Please don't send it to us through the forms.

Why we use it, and our lawful basis

• Reply to your enquiry and help you find the right week — to answer you and, if you ask, connect you with the operator who can book it. Basis: steps taken at your request before any contract, and our legitimate interest in responding to you.
• Add you to a week's waitlist and let you know about availability — because you asked us to. Basis: your consent.
• Publish and hold reviews — to share genuine guest feedback. Basis: your consent to publish; legitimate interest in keeping a record.
• Understand how the site is used — to keep the site useful and working. Basis: our legitimate interest in a well-run site, using privacy-respecting analytics.

Where we rely on consent, you can withdraw it at any time — just reply to any message or email hello@agara.es.

Who we share it with

We share your information only with the suppliers who help us run the site and reply to you, and — only when you ask us to help with a booking — with the relevant operator.

• The operator (e.g. Spice Escapes, New You Escapes): we pass on your enquiry details only to fulfil a booking or answer a question you've asked about, and only to the operator relevant to that trip.
• Resend — sends our transactional emails (for example, your enquiry confirmation).
• Cloudflare — hosts the website and our database and serves it securely at the edge.
• Cloudinary — stores and delivers the images on the site.

These suppliers act as our processors: they handle data on our instructions and are not allowed to use it for their own purposes. Our website analytics are privacy-respecting and self-hosted, so no analytics provider receives your data. We never sell your data, and we never share it for third-party marketing.

Where your data is held

Our database and content are hosted within the EU/EEA wherever possible. Some suppliers may process data outside the EEA; where that happens, the transfer is covered by an approved safeguard — typically the European Commission's Standard Contractual Clauses or an adequacy decision — so your data keeps essentially the same protection it has in the EU.

How long we keep it

• Enquiries and contact records: for as long as we're in conversation, and normally up to 24 months afterwards, unless you ask us to erase them sooner.
• Waitlists: until the week has passed or you unsubscribe.
• Reviews: for as long as they remain published, unless you ask us to remove yours.
• Records tied to an actual stay: as long as any accounting or legal obligation requires.

When a retention period ends, we delete or anonymise the information.

Your rights

Under GDPR and the LOPDGDD you can, at any time: access your data, correct it, erase it, object to or restrict its use, withdraw consent, and ask for a portable copy. To use any of these, email hello@agara.es. We'll respond within one month, free of charge, and may need to confirm your identity first.

How to complain

If you're unhappy with how we've handled your data, please tell us first so we can put it right. You also have the right to complain to the Spanish supervisory authority, the Agencia Española de Protección de Datos (AEPD) — www.aepd.es, C/ Jorge Juan 6, 28001 Madrid.

Last updated: draft pending review.