1. Data controller

ROCAFORT STUDENT LIVING COOP V (hereinafter, "RSL") is the entity responsible for processing the personal data collected through the website https://www.rocafort-studentliving.com and its associated contact channels.

2. What data we collect and how

RSL may process the following personal data, depending on how you get in touch:

• Web contact form: name, email address and the content of your message.
• Direct email: the data you voluntarily include in your message.
• Phone: the data provided verbally during the call.
• Booking process: full name, contact details and any information needed to formalise the accommodation arrangement.

RSL does not collect special category data (health, ethnic origin, political views, etc.) through the Website, nor does it request banking details via this channel.

3. Purposes and legal basis for processing

3.1 Responding to enquiries and information requests

When you send us a message via the contact form, by email or by phone, we process your data to reply and handle your enquiry.

Legal basis: consent of the data subject (Art. 6(1)(a) GDPR), given by voluntarily submitting the message. You may withdraw your consent at any time; this does not affect the lawfulness of processing carried out prior to withdrawal.

3.2 Managing bookings and the contractual relationship

When an enquiry leads to a booking or the signing of an accommodation contract, we process the data necessary to perform that contract: check-in and check-out coordination, operational communications during your stay and incident management.

Legal basis: performance of a contract to which the data subject is party (Art. 6(1)(b) GDPR).

3.3 Compliance with legal obligations

In certain circumstances we are required to retain or disclose data in order to comply with accounting, tax or other obligations imposed by Spanish law (for example, tax regulations or guest registration requirements applicable to tourist accommodation).

Legal basis: compliance with a legal obligation applicable to the controller (Art. 6(1)(c) GDPR).

3.4 Legitimate interest in service improvement

RSL may use aggregated, non-identifiable information about how the Website is used in order to improve its operation and user experience. This processing does not allow any individual to be directly identified.

Legal basis: legitimate interests pursued by the controller (Art. 6(1)(f) GDPR), provided they are not overridden by the interests or fundamental rights of the data subject.

4. Retention periods

• Commercial enquiries that do not lead to a contract: data will be retained for a maximum of one year from the last contact. After that period, if no contractual relationship exists, the data will be erased or anonymised.
• Data linked to a contractual relationship: retained for the duration of the contract and, thereafter, for as long as required by applicable law — at minimum five years for accounting and tax obligations (Spanish General Tax Act and related regulations) and six years under the Spanish Commercial Code.
• Data processed to comply with legal obligations: the retention period is determined by the specific regulation that justifies the processing.

5. Recipients and data processors

RSL does not sell or transfer personal data to third parties for their own commercial purposes. Data may be shared with the following categories of recipients only to the extent necessary to provide the service:

• Web hosting provider: the company responsible for the technical hosting of the Website. It acts as a data processor under contract with RSL and applies appropriate security guarantees. Current provider: Hostinger (servers in France, EU).
• Email service provider: the service used to manage email communications. It also acts as a data processor. Current provider: Hostinger (servers in France, EU).
• Google LLC (Google Analytics and Google Maps): Google acts as a data processor for web analytics (Google Analytics 4, ID G-SMDEK675RP) and maps (Google Maps Embed). Both services are only activated after your explicit consent in the cookie panel («analytics» and «marketing» categories respectively). If you do not accept these categories, no Google script is loaded and no data processing takes place. This implies a transfer of data to the United States (see section 6).
• Public authorities: where legislation requires data to be disclosed to bodies such as the Spanish Tax Agency, Social Security or other competent authorities.

6. International data transfers

As a general rule, RSL processes data within the European Economic Area (EEA). However, some service providers used (in particular Google LLC) may involve the transfer of data to countries outside the EEA, including the United States.

In such cases, transfers are carried out with the appropriate safeguards provided for in Regulation (EU) 2016/679 (GDPR), such as the Standard Contractual Clauses adopted by the European Commission or, where applicable, existing adequacy decisions.

7. Your rights

Under the GDPR and Spanish data protection law, you may exercise the following rights over your personal data at any time:

• Access: obtain confirmation of whether RSL processes data about you and, if so, access to that data.
• Rectification: request the correction of inaccurate or incomplete data.
• Erasure ("right to be forgotten"): ask for your data to be deleted when, among other reasons, it is no longer necessary for the purpose for which it was collected.
• Objection: object to the processing of your data where it is based on legitimate interests, unless RSL demonstrates compelling legitimate grounds that override your interests.
• Restriction of processing: request that processing be restricted in certain circumstances (for example, while a rectification request is being verified).
• Portability: receive the data you have provided to us in a structured, commonly used format and transmit it to another controller, where processing is based on consent or a contract and is carried out by automated means.

How to exercise your rights

You can exercise any of these rights by sending an email to [email protected], stating in the subject line the right you wish to exercise and attaching a copy of your national ID card or other identity document. RSL will respond within a maximum of one month of receipt.

Right to lodge a complaint

If you consider that the processing of your data does not comply with applicable law, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos — AEPD), the competent supervisory authority in Spain, at www.aepd.es.

8. Security measures

RSL has implemented the technical and organisational measures necessary to ensure the security of personal data and to prevent its alteration, loss, unauthorised processing or access, taking into account the state of the art, the nature of the data stored and the risks involved, as required by Article 32 of the GDPR.

These measures include access controls, encrypted communications via HTTPS and internal security incident management procedures.

9. Minimum age

Use of this Website and submission of personal data through it is restricted to persons aged 14 and over, in accordance with Article 7 of Spanish Organic Law 3/2018 (LOPDGDD). If you are under 14, you must not provide us with your data without the prior consent of your parents or legal guardians. Should RSL become aware that it has received data from a minor without such consent, it will delete it immediately.

10. Changes to this policy

RSL may update this privacy policy to reflect changes in legislation, case law or its own activities. Any significant changes will be communicated via the Website with sufficient notice. The date of the last update appears at the bottom of this document.

Last updated: 27 April 2025