Who is responsible for your data
Stay Pepper is operated by Valentina Idrofano, self-employed professional, tax identification number ES0704438E, with business address at Carrer Sant Venat 18, 08770 Sant Sadurní d’Anoia, Barcelona, Spain. Valentina Idrofano is the data controller for the processing described in this policy.
For any privacy question or request, email hello@staypepper.com or write to the address above.
The data we collect
Depending on how you interact with us, we may collect your name, email address, telephone or WhatsApp number, preferred language, destination and travel preferences, dates, departure airport, budget, group composition and the information you choose to include in a travel request.
If you make a booking, we may also collect the identification, contact, traveller, rooming, payment-status, invoicing and trip-management information needed to arrange and perform the travel service. Payment-card details are handled directly by the payment provider and are not stored by Stay Pepper.
We may receive limited technical data needed to operate and protect the website, such as IP address, device and browser information, access time, requested pages and security logs. Information about children must be provided only by a parent or legal guardian. Please do not include health or other sensitive information unless we specifically request it because it is necessary for your journey.
Why we use your data
Travel requests and customer support
We use the information you submit to understand your request, contact you and prepare or discuss a proposal. The legal basis is taking steps at your request before entering into a contract and, where applicable, our legitimate interest in answering and managing enquiries.
Bookings and journey operations
We use traveller and booking data to create and perform the contract, manage rooms and suppliers, provide assistance, handle payments and fulfil legal obligations.
Safety, administration and legal compliance
We process limited data to secure our systems, prevent abuse, keep operational and accounting records and establish, exercise or defend legal claims. The legal bases are legal obligation and legitimate interest.
Marketing
We send newsletters or promotional communications only when you have given separate consent. A request for travel information does not subscribe you automatically, and you can withdraw marketing consent at any time.
How long we keep it
Travel enquiries are normally kept for up to 12 months after the request is closed, unless you ask us to delete them earlier or they become part of a booking.
Booking, payment and accounting records are kept for the periods required by applicable tax, accounting and travel law, generally up to six years, and longer only where necessary for an active claim or another legal obligation. Supplier and operational records are kept only for as long as needed for the journey and any applicable limitation period.
Security logs are retained for a limited period proportionate to their purpose. Data processed solely on the basis of consent is kept until consent is withdrawn or the stated purpose ends.
Your rights
Subject to the conditions of the General Data Protection Regulation, you may request access to your personal data, correction of inaccurate data, deletion, restriction of processing, portability, or object to processing based on legitimate interests. You may withdraw consent at any time without affecting processing carried out before withdrawal.
To exercise a right, email hello@staypepper.com. We may ask for information needed to verify your identity. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es, or with the supervisory authority where you live or work.
Security and automated decisions
We use reasonable technical and organisational measures designed to protect personal data against loss, misuse, unauthorised access and disclosure. Access to the administration area is restricted according to each user’s responsibilities.
We do not make decisions that produce legal or similarly significant effects solely through automated processing. If this changes, we will provide the information and safeguards required by law.
Changes to this policy
We may update this policy when our services, suppliers or legal obligations change. The current version and its update date will always be published on this page. Material changes affecting consent-based processing will be brought to your attention and, where required, we will ask for consent again.
Privacy questions or requests: hello@staypepper.com