1. Data Controller
The controller responsible for processing your personal data within the meaning of the General Data Protection Regulation (GDPR) and the Spanish Data Protection Act (LOPDGDD) is:
- Controller: [Company name incl. legal form]
- NIF/CIF: [NIF/CIF]
- Address: [Registered address – street and no., postal code, town, province]
- Email: info@meravaprivate.com
- Phone: +49 175 6842396
2. Data We Collect
Depending on how you interact with us, we process the following categories of personal data:
- Contact and booking enquiries (contact form, booking dialogue, WhatsApp, Telegram, email): name or pseudonym, email address, phone number and the information you provide in your message.
- Reviews: reviews are submitted anonymously; we do not collect real names. To prevent abuse and spam, the IP address is processed for a short period only.
- Navigation and usage data: when you visit the website, technically necessary data is processed (IP address, date and time of access, browser type, device, pages viewed) and — subject to your consent — data from web-analytics cookies (see section 9).
We apply the principle of data minimisation: we only process the data required for the respective purpose.
3. Purposes of Processing
- Handling your enquiries and arranging suitable companionship
- Processing and organising bookings and the related communication
- Publishing moderated, anonymous reviews
- Ensuring the security and functionality of the website
- Fulfilling legal obligations
- subject to consent: audience measurement and improvement of the website (web analytics)
No online payment processing takes place on this website.
4. Legal Bases
- Performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR): handling enquiries, processing bookings and related communication.
- Consent (Art. 6(1)(a) GDPR): use of non-essential cookies and web analytics, as well as any promotional communication. Consent may be withdrawn at any time with effect for the future.
- Legitimate interest (Art. 6(1)(f) GDPR): security of the website and prevention of spam and fraud.
- Legal obligation (Art. 6(1)(c) GDPR): compliance with tax and commercial retention obligations.
5. Retention Period
We store personal data only for as long as is necessary for the purposes stated:
- Enquiry and booking data: for the duration of the business relationship and thereafter until the statutory retention periods expire.
- Data of tax or commercial relevance: in accordance with statutory periods (in Spain up to six years for certain records).
- IP data for spam prevention: for a short period only.
Once the applicable periods have expired, the data is deleted or anonymised.
6. Recipients and Processors
To provide our services, we use carefully selected providers that process data on our behalf and in accordance with our instructions (processing under Art. 28 GDPR):
- Hosting and email: World4You Internet Services GmbH (Austria, EU)
- Communication channels: WhatsApp (Meta Platforms Ireland Ltd.) and Telegram
- Web analytics: Google (Google Analytics, Google Tag Manager)
- Tax advisory: within the scope of legal obligations
Where providers process data outside the EU or EEA (e.g. in the USA), this is done on the basis of appropriate safeguards under Art. 46 GDPR, in particular the EU Standard Contractual Clauses (SCC). Data is disclosed to other third parties only where required by law.
7. Your Rights
You have the right of access, rectification, erasure, restriction of processing, data portability and the right to object to processing. You may withdraw any consent given at any time with effect for the future.
To exercise your rights, simply send a message to info@meravaprivate.com or to the address stated above.
8. Right to Lodge a Complaint with the Supervisory Authority
You have the right to lodge a complaint with a data protection supervisory authority. In Spain, this is the Agencia Española de Protección de Datos (AEPD, www.aepd.es). We kindly ask you to contact us first so that we can resolve your concern directly.
9. Cookies and Web Analytics
This website uses technically necessary cookies required for its operation. In addition — solely with your consent given via the cookie banner — we use web-analytics services (Google Analytics, Google Tag Manager) to understand and improve the use of the website. You can adjust or withdraw your consent at any time with effect for the future via the cookie settings.
10. Security
We take appropriate technical and organisational measures in accordance with Art. 32 GDPR to protect your data against loss, misuse and unauthorised access. Communication takes place via encrypted channels.
11. Changes to This Privacy Policy
We reserve the right to amend this privacy policy in order to adapt it to changed legal or technical circumstances. The version published on this page at any given time shall apply.
Last updated: 26 June 2026