Legal
The controller of the personal data collected through the website maikhomes.com and through the associated booking and support channels is:
Maik Homes is not required to appoint a Data Protection Officer under Article 37 GDPR. Any privacy-related matter may be addressed to reservas@maikhomes.com.
This Policy has been drawn up in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation ("GDPR"), and with Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (Ley Orgánica 3/2018, de Protección de Datos Personales y garantía de los derechos digitales, "LOPDGDD").
We process personal data for the following purposes, each with its legal basis under Article 6 GDPR:
| Purpose | Legal basis |
|---|---|
| Management of apartment bookings, collection of payment (including the transitional phase in which a booking is recorded and payment confirmed by WhatsApp or email), handling of cancellations and operational communications about the stay | Performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR) |
| Creation and management of the user account, application of the member discount (15%) and access to the booking history | Performance of a contract (Art. 6(1)(b) GDPR) |
| Mandatory online check-in: collection of the details of all guests and digital signature, and delivery of the digital access codes to the apartment | Performance of a contract (Art. 6(1)(b) GDPR) and, as regards the data required under traveller registration rules, legal obligation (Art. 6(1)(c) GDPR) |
| Reporting of traveller and transaction data to the Spanish Ministry of the Interior's SES Hospedajes platform, for stays in tourist accommodation only | Compliance with a legal obligation: Royal Decree 933/2021 of 26 October (Art. 6(1)(c) GDPR) |
| Execution and management of seasonal lease agreements with professionals (Art. 3.2 of the Spanish Urban Leases Act, LAU), including their digital signature | Performance of a contract (Art. 6(1)(b) GDPR) |
| Issuing of invoices and compliance with accounting, tax and commercial obligations | Compliance with legal obligations (Art. 6(1)(c) GDPR) |
| Management of the affiliate programme: registration, attribution of bookings, settlement of commissions, affiliate invoices and payments | Performance of the commercial affiliate agreement (Art. 6(1)(b) GDPR) and legal invoicing obligations (Art. 6(1)(c) GDPR) |
| Fraud prevention, systems security, control of access to the apartments, handling of incidents and damage, and defence against claims | Legitimate interest of the controller (Art. 6(1)(f) GDPR): protecting its assets, its systems and its rights |
| Service improvement and internal analysis of website activity using our own resources | Legitimate interest of the controller (Art. 6(1)(f) GDPR) |
| Sending the newsletter and commercial communications | Consent of the data subject (Art. 6(1)(a) GDPR), revocable at any time |
| Placing of cookies that are not strictly necessary (affiliate attribution cookie mh_ref) | Consent of the data subject (Art. 6(1)(a) GDPR and Art. 22.2 of the Spanish LSSI-CE) |
| Handling of enquiries and support by email or WhatsApp | Pre-contractual measures or performance of the contract (Art. 6(1)(b) GDPR); failing that, legitimate interest in responding to those who contact us (Art. 6(1)(f) GDPR) |
Where the legal basis is legitimate interest, we have carried out the corresponding balancing test; users may object to the processing on the terms set out in the section on rights and may also request information about that balancing test. Data required by contract or by law must be provided: without it, the booking, the check-in and the stay cannot be completed (in the case of the data required by RD 933/2021, refusal to provide it prevents accommodation being given, in accordance with that legislation).
Source of the data (information under Art. 14 GDPR): as a general rule, data is obtained directly from the data subject. However, the details of accompanying guests (including minors) may be provided by the client who makes the booking or completes the check-in. That client warrants that they are authorised to provide such data and undertakes to inform their fellow guests of the content of this Policy before doing so; the categories obtained in this way are the identification data, identity document data, date of birth, nationality and contact details set out above, and they are processed for the purposes of managing the stay and complying with RD 933/2021.
We do not deliberately process special categories of data (Art. 9 GDPR). Please do not include such information in your communications with us.
Personal data may be disclosed to the following recipients:
The contracts required by Article 28 GDPR have been signed with all processors. If you choose to contact us via WhatsApp, your data will also be processed by Meta Platforms Ireland Limited as an independent controller, under its own terms and privacy policy; use of this channel is voluntary and email is always available as an alternative.
The website's typefaces are hosted on our own servers (self-hosted), so no data is transmitted to Google when fonts are loaded.
We do not sell personal data, nor do we disclose it to third parties for commercial purposes.
The use of iGMS Inc. entails an international transfer of data to the United States. That transfer is covered by the Standard Contractual Clauses approved by the European Commission (Implementing Decision (EU) 2021/914), supplemented by appropriate additional technical and organisational measures. In the case of Stripe, any transfers to its US parent company are covered by the EU-U.S. Data Privacy Framework or, failing that, by Standard Contractual Clauses. If you use WhatsApp, Meta may carry out international transfers under its own safeguards (Data Privacy Framework or Standard Contractual Clauses). You may request further information or a copy of these safeguards by writing to reservas@maikhomes.com.
| Category | Retention period |
|---|---|
| Traveller register and guest registration forms (partes de entrada, SES Hospedajes) | 3 years from submission, in accordance with RD 933/2021 |
| Invoices and accounting, tax and commercial records | 4 years for tax purposes (Spanish General Tax Act) and up to 6 years for commercial purposes (Art. 30 of the Spanish Commercial Code) |
| Booking data, stay agreements and seasonal lease agreements | For the duration of the contractual relationship and, thereafter, blocked for the limitation periods applicable to legal actions (as a general rule, up to 5 years, Art. 1964 of the Spanish Civil Code) |
| User account | Until the user requests deletion or closes the account; thereafter, data is blocked for the applicable limitation periods (Art. 32 LOPDGDD) |
| Affiliate data | For the duration of the commercial relationship and, thereafter, for the limitation periods applicable to the resulting tax and commercial obligations |
| Newsletter | Until consent is withdrawn; we will keep the minimum data required to honour the unsubscribe request (suppression list) |
| Cookies | As stated for each cookie in the Cookie Policy |
Any individual may exercise the following rights free of charge:
These rights may be exercised by writing to reservas@maikhomes.com or by post to Maik Holding Investments, S.L., Calle Fernández de la Hoz 52, planta 5, oficina, 28010 Madrid, stating the right being exercised and enclosing sufficient information to verify the applicant's identity (additional documentation will only be requested where there are reasonable doubts as to identity, and always proportionately). We will respond within a maximum of one month, extendable on the terms of Art. 12 GDPR.
No automated decisions producing legal effects are taken, nor is profiling carried out within the meaning of Art. 22 GDPR.
If you believe that the processing of your data breaches the applicable rules, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), C/ Jorge Juan 6, 28001 Madrid, or through its electronic office (www.aepd.es), without prejudice to your right to contact us first to resolve the matter.
Booking apartments and creating user accounts are reserved for persons aged 18 or over. We do not direct our services to minors, nor do we deliberately collect their data as clients. The details of guests who are minors and who accompany adults during the stay will be provided at check-in by the adult responsible for the booking, solely to the extent required by RD 933/2021 (which includes, for children under 14, stating their family relationship with the responsible adult) and for the proper management of the stay.
We apply technical and organisational measures appropriate to the risk (Art. 32 GDPR), including: encryption of communications via TLS/HTTPS; password storage using secure hash functions; need-to-know access control; hosting in data centres located in the European Union (Hetzner, Germany); regular backups; access logging; and payment processing through a PCI-DSS certified gateway (Stripe), so that full card details never pass through our servers. The digital access codes to the apartments are generated and sent only once online check-in has been completed. In the event of a security breach entailing a high risk to the rights of data subjects, they will be notified in accordance with Art. 34 GDPR.
Maik Homes makes mobile applications available to users through the App Store (Apple) and Google Play (Google). The data controller is the same as identified in section 1, and the purposes, legal bases, retention periods and rights described in the preceding sections apply equally to data processed through the apps.
In addition to the above, use of the apps may involve the processing of:
The apps request device permissions only where these are necessary for a specific feature, and each permission may be revoked at any time in the operating system settings. The apps do not use advertising identifiers, nor do they carry out tracking for behavioural advertising purposes.
Downloading the app and any in-app purchases are also governed by the terms and privacy policies of Apple and Google, which act as independent controllers in respect of the data they collect by that means and over which Maik Homes has no control.
The rights set out in section 7, including deletion of the account, may be exercised through the channels indicated there and from within the app itself.
This Privacy Policy may be updated to reflect new legislation, guidance from supervisory authorities or changes to our processing activities (for example, the addition of new processors or tools). The current version will always be published on the website, showing its date. Should a change be substantial and affect processing based on consent, that consent will be requested again.
Last updated: July 2026.
We use first-party cookies that the site needs in order to work: signing in, booking and completing check‑in. The rest are optional and are only switched on if you say so. You can change your mind whenever you like. All the details in our Cookie Policy.
Your session and a record of your cookie choice. Without them you can't sign in, book or check in. They're exempt from consent.
Google Analytics, so we can see which pages get visited and what isn't working. No ads, no profiling. Decline and it never loads.
Only if you reach us through a partner's link, so we can pay them their commission. Declining doesn't affect anything you do here.