Last updated: 16 October 2026.
1. Data controller and contact details
The controller of personal data associated with this website is Serendipia Guadalest SL, Spanish tax identification number (NIF) B19913565, with its registered office at Calle Sierra Maigmo 2, 5. 03550 San Juan de Alicante, Alicante, Spain.
You can contact us at hola@noraguadalest.com or by telephone on +34 696 550 220.
2. Scope of this policy
This policy applies to browsing noraguadalest.com and to enquiries you send to NORA using the published contact details. The project is under construction. At this stage, the website does not handle bookings, payments or guest registration.
3. Data, purposes and legal bases
- Enquiries and requests: we process the identification and contact details you provide, the content of your enquiry and any information necessary to respond. Where you ask about a possible stay or service, the legal basis is taking steps at your request before entering into a contract. For other enquiries, it is our legitimate interest in responding to incoming communications and maintaining a relationship with the person who contacts us.
- Operation and security: the systems serving the website may process IP addresses, access dates and times, requested resources, technical browser information and incident logs. The purpose is to deliver content, maintain availability and prevent abusive access. The legal basis is our legitimate interest in providing a secure, operational website, with restricted access to these logs.
- Privacy preferences: your choice regarding cookies and similar technologies is stored so it can be applied on subsequent visits. This storage is necessary to respect the decision you request.
Visit analytics: if you accept the “Analytics” category in the preferences panel, Google Analytics 4 is loaded through Google Tag Manager. It is used to understand page visits, sessions and basic interaction, using browser identifiers and technical information about the device, browser and approximate location. The legal basis is your consent (Article 6(1)(a) of the GDPR), which you can withdraw through “Cookie settings”. Rejecting analytics does not prevent you from browsing the website.
The configuration does not use Google Signals, advertising features, User-ID or automatic measurement of searches, forms or outbound links. Names, email addresses, telephone numbers and other directly identifying personal data must not be sent to Analytics in events or URLs. Arbitrary URL queries and fragments are removed from the URL sent; only the specified campaign attribution parameters are retained.
We will not use an enquiry to subscribe you automatically to marketing communications. Any future subscription will have its own information and unsubscribe mechanism.
4. Source and necessity of the data
Enquiry data comes from the person who contacts us; technical information is generated when browsing. You should only provide the information necessary for us to respond. Do not send health data, identity documents, banking details or information about other people unless it is requested for a justified purpose through an appropriate channel.
If you do not provide a means of contact or the information needed to understand your request, we may be unable to respond. You can browse the public information without sending an enquiry.
5. Retention
Enquiries are retained for the time needed to respond and carry out any related follow-up. Once no longer necessary, the data will be deleted or kept restricted solely where it must be retained to meet legal obligations or address potential liabilities within the applicable limitation periods.
Technical logs are kept for the time necessary for their operational and security purposes. Cookie preferences are reviewed in accordance with the period stated in the Cookie Policy and can be changed at any time.
Retention of individual user and event data in Google Analytics is set to two months, without resetting that period on new visits. This setting does not affect aggregate reports in the same way. Analytics cookies have a configured maximum lifespan of 180 days, without extending it on each page load.
6. Recipients and service providers
We do not sell personal data. Providers involved in hosting, email, support and service security may access it to the extent necessary to perform their role and subject to the applicable obligations as data processors. Data may also be disclosed to authorities or other recipients where legally required.
If you accept analytics, Google Ireland Limited acts as the provider of Google Analytics and Google Tag Manager, with Google LLC and its providers involved in delivering these services. You can read how Google uses information from sites that use its services.
Links to third-party websites are subject to their own policies. Following an external link may disclose technical connection data to that third party.
7. International transfers
If you accept analytics, using Google’s services may involve processing data outside the European Economic Area, including in the United States. Google states that it participates in the EU–US Data Privacy Framework for transfers to Google LLC covered by that certification. Its terms also provide for applicable contractual safeguards where necessary.
You can consult Google’s data transfer frameworks and its data processing terms, or request information and a copy of the relevant safeguards from the controller at the contact email address above.
8. Your rights
You may request access, rectification, erasure, restriction and, where applicable, portability of your data. You may also object to processing based on legitimate interests on grounds relating to your particular situation. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
Send your request to hola@noraguadalest.com or to the controller’s registered office, stating which right you wish to exercise. Additional information to confirm your identity will only be requested where there are reasonable doubts about it. We will respond within the statutory period, generally one month after receipt, without prejudice to any justified extensions allowed by law.
If you believe the processing does not respect your rights, you can lodge a complaint with the Spanish Data Protection Agency (AEPD).
9. Automated decisions and changes
At this stage of the website, no automated decisions producing legal effects or similarly significantly affecting you are made.
This policy will be updated when the purposes, tools or services offered change. The date at the top identifies its version.