Privacy Policy
Last updated: 3 September 2026
This Privacy Policy explains how City Nest Iberia SL processes the personal data of users of https://citynestiberia.com and the platform at https://app.citynestiberia.com, in accordance with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD).
1. Data controller
- Controller: City Nest Iberia SL
- Tax ID (NIF/CIF): B88765581
- Registered office: Calle Marie Curie 9, 4, 28521 Rivas-Vaciamadrid (Madrid), Spain
- Contact for data protection matters: support@citynestiberia.com
2. What data we process and for what purpose
| Purpose | Data categories | Legal basis |
|---|---|---|
| Responding to enquiries submitted via contact or request forms | Name, email, company, message content | Consent and/or steps prior to entering a contract (Art. 6.1.a / 6.1.b GDPR) |
| Creating and managing client and user accounts on the platform | Name, email, role, company affiliation, authentication data | Performance of a contract (Art. 6.1.b) |
| Managing accommodation bookings and occupant assignments | Booking details, stay dates, occupant contact details | Performance of a contract (Art. 6.1.b) |
| Issuing invoices and meeting accounting/tax obligations | Billing and company identification data | Legal obligation (Art. 6.1.c) |
| Sending service-related (transactional) communications | Email address | Performance of a contract (Art. 6.1.b) |
| Sending commercial communications, where requested | Email address | Consent (Art. 6.1.a) |
| Ensuring the security and proper functioning of the platform | Technical and access data | Legitimate interest (Art. 6.1.f) |
3. Data retention
Personal data is retained for as long as the business relationship is maintained and, thereafter, for the periods required to meet legal obligations — including the six-year retention period for accounting records required by Article 30 of the Spanish Commercial Code (Código de Comercio). Data processed on the basis of consent is retained until consent is withdrawn.
4. Recipients and processors
To provide the service, personal data may be processed by the following providers acting as data processors under the appropriate data processing agreements:
- Supabase — database, authentication and storage hosting (EU (Ireland))
- Vercel — website and application hosting
- Resend — delivery of transactional and, where applicable, commercial email
The site does not currently use any third-party analytics or tracking service, so no analytics provider processes your data. No personal data is sold or transferred to third parties except as described here or where required by law.
5. International transfers
Where any provider processes data outside the European Economic Area, such transfers are carried out on the basis of an adequacy decision of the European Commission or of appropriate safeguards such as the Standard Contractual Clauses. Details of the safeguards applied are available on request at support@citynestiberia.com.
6. Your rights
You may exercise the following rights, free of charge, by writing to support@citynestiberia.com with a copy of an identifying document: access, rectification, erasure (“right to be forgotten”), restriction of processing, data portability, objection, and the right to withdraw consent at any time without affecting the lawfulness of prior processing. If you consider that your rights have not been properly addressed, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).
7. Automated decisions
CityNest Iberia does not make decisions producing legal effects based solely on automated processing of the personal data described in this policy.
8. Data accuracy
Users warrant that the data provided is true and accurate and undertake to notify any changes. Where a user provides third-party data (for example, the details of an occupant), the user warrants that they have informed that person and obtained any necessary legitimacy for the processing.