Privacy Policy

Last updated: October 2026

Burgin Management S.L. (CIF: B29593423), trading as Palm Beach Club Apartamentos, is committed to protecting your personal data. This policy explains how we collect, use and protect your information in accordance with EU Regulation 2016/679 (GDPR) and Spain's Organic Law 3/2018 (LOPDGDD).

1. Data Controller

Burgin Management Sociedad Limitada. CIF: B29593423. Address: C/ Ciudad de Porcuna, 14, 29620 Torremolinos, Málaga, Spain. Email: reservas@palmbeachclub.com. Phone: +34 952 37 03 39. Andalusian Tourism Registry: A/MA/00958.

2. Data We Collect

We collect personal data only when you provide it to us. This includes: (a) Contact enquiries — name, email, phone number and message content when you use our contact form or contact us directly; (b) Reservations — name, contact details and payment information when you make a booking. Payment is processed securely by Redsys; we do not store your full card details; (c) Online check-in and guest registration — full name, ID document type and number, date of birth, nationality, home address and contact details of all guests on the reservation and, for minors, their relationship to the accompanying adult.

3. Purpose & Legal Basis

Contact enquiries: to respond to your message — legal basis: legitimate interest. Reservations: to manage your booking and provide the contracted service — legal basis: performance of a contract. Online check-in and guest registration: to comply with the legal obligation to register guest documentation and report it to the Spanish Ministry of the Interior — legal basis: compliance with a legal obligation (Royal Decree 933/2021). Marketing communications: only sent with your explicit consent, which you may withdraw at any time.

4. Data Retention

Contact enquiries: 12 months from the date of your enquiry. Reservation data: 5 years, to comply with Spanish tax and commercial law obligations. Guest registration data: 3 years, as set out in Royal Decree 933/2021. Consent records: for the duration required by applicable law.

5. Recipients and Data Processors

We share data only where necessary: Kross (PMS) and Paraty (booking engine) process reservation and check-in data on our behalf, under data processing agreements. Enquiries submitted via our website are stored by Supabase (database infrastructure) and delivered via Resend (email delivery); both act as data processors under data processing agreements. Guest registration data is reported to the Spanish Ministry of the Interior (the SES.Hospedajes platform) and, where required by law, to State security forces. TripAdvisor and Google Maps operate their own independent services on this site; please refer to their respective privacy policies. We do not sell personal data to any third party.

6. International Transfers

Your data is processed within the European Economic Area. Where any provider operates outside the EEA, appropriate safeguards are in place, such as the Standard Contractual Clauses approved by the European Commission.

7. Your Rights

Under GDPR you have the right to: access your personal data; rectify inaccurate data; request erasure ('right to be forgotten'); restrict or object to processing; request data portability; withdraw your consent at any time, where processing is based on it. To exercise any of these rights, write to us at reservas@palmbeachclub.com. We will respond within one month. You also have the right to lodge a complaint with the Spanish Data Protection Authority (AEPD) at www.aepd.es.

8. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or disclosure.

9. Changes to This Policy

We may update this policy from time to time. The date at the top of this page indicates when it was last revised. If changes are significant, we will notify you through our usual communication channels.

10. Contact

For any questions or requests relating to your personal data, please write to us at reservas@palmbeachclub.com