Privacy Policy

Last updated: 10 June 2026

This policy explains how Domus Aedes handles your personal data when you use our stay-concierge service at concierge.domusaedes.com. We comply with the EU General Data Protection Regulation (GDPR) and Spanish data-protection law (LOPDGDD).

1. Who we are (data controller)

Domus Aedes SP, S.L. — CIF B21771068, registered office Avenida Diagonal 534, 08006 Barcelona, Spain. Contact: contact@domusaedes.com.

For stays located in Morocco, Domus Aedes MA, S.A.R.L. (RC 619007, Casablanca) may act as joint controller for the limited purpose of arranging that stay.

2. What we collect

• You give us: your name, phone number (WhatsApp/mobile), and your stay request — destination, dates, number of guests, budget and any notes.
• Automatically: if you accept cookies, a device/advertising identifier, IP address and browser information used for advertising measurement (see §6). Our hosting and security logs briefly record IP addresses to prevent abuse.
• If you reserve: payment confirmation data from our payment processor (we never see or store your full card number).

3. Why we use it, and our legal basis

You can withdraw consent at any time — reply STOP to any message, or email us — without affecting processing already carried out.

4. Who processes your data for us

• LeadConnector / HighLevel — our CRM and WhatsApp/SMS messaging platform.
• Meta Platforms Ireland — WhatsApp Business messaging, and advertising measurement via the Meta Pixel and Conversions API. Identifiers such as your phone number are hashed (irreversibly) before being sent for measurement.
• Stripe Payments Europe — processes the reservation hold and any payment; Stripe is the card data controller and is PCI-DSS certified.
• Telecommunications carriers — deliver SMS/MMS to mobile numbers (used mainly for US numbers).
• Apify, OpenStreetMap/Nominatim — used to search accommodation; they receive your destination and dates, never your contact details.
• Fly.io — our application hosting.

Some of these providers are based outside the EEA (e.g. the United States). Transfers rely on the EU Standard Contractual Clauses or an equivalent safeguard.

5. How long we keep it

Your request and contact details are kept while your enquiry is active and for up to 24 months afterwards (to handle follow-ups and our records), unless you ask us to delete them sooner. Payment and invoicing records are kept for the period required by Spanish tax law (generally up to 6 years). Consent and opt-out records are kept as proof of compliance.

6. Cookies & advertising measurement

On your first visit we ask whether you accept measurement cookies. Nothing loads until you choose. If you accept, we load the Meta Pixel and may also send a matching server-side event via Meta's Conversions API, both used only to measure how our ads perform. If you reject, no Meta cookie or script is loaded and no advertising identifier is collected — the concierge form still works fully. You can change your mind by clearing the da_consent cookie in your browser and reloading. We do not use cookies to build profiles or to sell your data.

7. Your rights

Under the GDPR you may request access, correction, deletion, restriction, portability, and objection to processing, and you may withdraw consent at any time. Write to contact@domusaedes.com and we will respond within one month. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es) or your local supervisory authority.

8. Children

Our service is intended for adults (18+). We do not knowingly collect data from minors.

9. Changes

We may update this policy; the "last updated" date above will change and, for material changes, we will make the new version available here before it takes effect.