Last updated: 14 April 2026 In compliance with Regulation (EU) 2016/679 (GDPR) and applicable local data protection law, we inform you of the following: 1. Data Controller Pandora Lanzarote Address: Lanzarote, Las Palmas, Spain Phone: +34 711 08 59 06 Email: 6898917@gmail.com 2. Purpose of Data Processing Your personal data is processed for the following purposes: Responding to contact form enquiries and booking requests Managing reservations and customer communications Sending commercial communications, with express prior consent Improving website performance and user experience via analytics Complying with legal obligations related to accommodation services 3. Legal Basis for Data Processing We process your data under the following lawful bases: User consent — checkbox acceptance on forms Pre-contractual or contractual relationship — to manage enquiries and bookings Legitimate interest — website analytics and security Legal obligation — compliance with applicable law Consent can be withdrawn at any time without affecting prior lawful processing. 4. Personal Data Processed and Source We may collect the following personal information: Name Email address Phone number IP address (collected automatically) Source: contact forms and booking enquiries submitted voluntarily by the user. Users are responsible for the accuracy of the data provided. Data will not be used for purposes other than those listed above. 5. Link Policy This website may contain links to third-party sites. Pandora Lanzarote is not responsible for the content or privacy practices of external sites. Users should review the privacy policies of any third-party services they access. 6. Personal Data Retention Period Data is retained while the business relationship is active, or until the user requests deletion. Data may be retained longer where required by law or to defend legal claims. Withdrawn consent results in data being blocked and retained only as legally required. 7. Confidentiality and Security of Personal Data Pandora Lanzarote implements appropriate technical and organisational measures to protect personal data, including SSL encryption, secure servers, and restricted access. All staff and processors with access to personal data are bound by confidentiality obligations. 8. Data Transfers and Recipients Data will only be shared where legally required or necessary to fulfil services (for example booking or hosting systems). Third-party processors include: Wix — website hosting and contact/booking form management. Privacy policy → https://www.wix.com/about/privacy Each processor is bound by data processing agreements. 9. User Rights Under GDPR, you have the right to: Access — request a copy of your personal data Rectification — correct inaccurate data Erasure — request deletion of your data (“right to be forgotten”) Restriction — limit processing of your data Portability — receive your data in a structured format Objection — object to processing based on legitimate interest To exercise any right, please write to 6898917@gmail.com with the subject line “Data Rights Request”, attaching a copy of your ID. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es