Legal
Legal notice & privacy
Last updated: 29 September 2026
Legal notice
In accordance with Article 10 of Spanish Law 34/2002 on Information Society Services and Electronic Commerce (LSSI-CE), this website is owned by:
- Company
- Olotiko Spain S.L.
- Tax ID (NIF)
- B93184372
- Address
- Camino de Cantalobos, 18690 Almuñécar, Spain
- info@cantalobos.com
- Telephone
- +46 101 - 705 600
The website is operated under the name Palacio de Cantalobos. Bookings are completed in our booking system at book.cantalobos.com, which has its own terms.
Use of the website
The information on this website is for general guidance. Prices, availability and descriptions may change, and only a confirmed booking is binding. We are not responsible for the content of external websites that we link to.
Intellectual property
All texts, photographs, logos and design on this website belong to Olotiko Spain S.L. or are used with permission. They may not be copied or reused without our written consent.
Applicable law
This legal notice is governed by Spanish law. Consumers may bring a dispute before the courts of their place of residence, as provided by law.
Privacy policy
Olotiko Spain S.L. (NIF B93184372), at the address above, is responsible for your personal data. You can contact us about anything in this policy at info@cantalobos.com.
What we collect and why
- Purpose
- Answering booking requests and enquiries sent through our forms or by email
- Data
- Name, email address, telephone, company (optional), dates, number of guests, details of your event, your message and preferred language
- Legal basis
- Steps before a contract, taken at your request (GDPR Art. 6(1)(b)). For general questions: our legitimate interest in answering you (Art. 6(1)(f))
- How long we keep it
- Up to 24 months after our last contact. If you book, as long as the booking and Spanish accounting and tax law require
- Purpose
- Protecting our forms against spam and abuse (Google reCAPTCHA)
- Data
- IP address, browser and device information, and how you interact with the form
- Legal basis
- Our legitimate interest in keeping our forms secure (Art. 6(1)(f))
- How long we keep it
- Loaded only when you start filling in a form. Google's own retention applies
- Purpose
- Understanding how the website is used (Google Analytics)
- Data
- Pages visited, time of visit, approximate location, device and browser type, and a random identifier stored in a cookie. Google Analytics does not store your IP address
- Legal basis
- Your consent (Art. 6(1)(a)), which you can withdraw at any time under Cookie settings
- How long we keep it
- 14 months
- Purpose
- Measuring and improving our advertising on Facebook and Instagram (Meta Pixel)
- Data
- Pages visited, actions such as sending an enquiry, browser and device information, IP address and an identifier stored in a cookie
- Legal basis
- Your consent (Art. 6(1)(a)), which you can withdraw at any time under Cookie settings
- How long we keep it
- Our cookie: 3 months. Meta keeps data according to its own policy
- Purpose
- Answering your questions in the chat assistant on our website (Alba, an AI assistant provided by Qliva)
- Data
- Your messages and the replies, any contact details you choose to give, the page and language, a random session identifier, and IP address and browser information used for security
- Legal basis
- Our legitimate interest in answering visitors' questions (Art. 6(1)(f)). If you ask us to contact you: steps before a contract, taken at your request (Art. 6(1)(b))
- How long we keep it
- Conversations up to 180 days, technical logs up to 90 days. If you ask us to contact you, as for enquiries above
- Purpose
- Delivering the website
- Data
- IP address and browser type, used only to deliver the pages
- Legal basis
- Our legitimate interest in running the website (Art. 6(1)(f))
- How long we keep it
- Not stored
| Purpose | Data | Legal basis | How long we keep it |
|---|---|---|---|
| Answering booking requests and enquiries sent through our forms or by email | Name, email address, telephone, company (optional), dates, number of guests, details of your event, your message and preferred language | Steps before a contract, taken at your request (GDPR Art. 6(1)(b)). For general questions: our legitimate interest in answering you (Art. 6(1)(f)) | Up to 24 months after our last contact. If you book, as long as the booking and Spanish accounting and tax law require |
| Protecting our forms against spam and abuse (Google reCAPTCHA) | IP address, browser and device information, and how you interact with the form | Our legitimate interest in keeping our forms secure (Art. 6(1)(f)) | Loaded only when you start filling in a form. Google's own retention applies |
| Understanding how the website is used (Google Analytics) | Pages visited, time of visit, approximate location, device and browser type, and a random identifier stored in a cookie. Google Analytics does not store your IP address | Your consent (Art. 6(1)(a)), which you can withdraw at any time under Cookie settings | 14 months |
| Measuring and improving our advertising on Facebook and Instagram (Meta Pixel) | Pages visited, actions such as sending an enquiry, browser and device information, IP address and an identifier stored in a cookie | Your consent (Art. 6(1)(a)), which you can withdraw at any time under Cookie settings | Our cookie: 3 months. Meta keeps data according to its own policy |
| Answering your questions in the chat assistant on our website (Alba, an AI assistant provided by Qliva) | Your messages and the replies, any contact details you choose to give, the page and language, a random session identifier, and IP address and browser information used for security | Our legitimate interest in answering visitors' questions (Art. 6(1)(f)). If you ask us to contact you: steps before a contract, taken at your request (Art. 6(1)(b)) | Conversations up to 180 days, technical logs up to 90 days. If you ask us to contact you, as for enquiries above |
| Delivering the website | IP address and browser type, used only to deliver the pages | Our legitimate interest in running the website (Art. 6(1)(f)) | Not stored |
You do not have to give us any personal data, but without contact details we cannot answer your request. We do not sell your data, and we do not use it for automated decisions or profiling.
Who receives your data
Our service providers process data on our behalf and only on our instructions:
- Amazon Web Services: hosting of the website and delivery of form messages, on servers in the EU.
- Google: Google Analytics (only with your consent) and Google reCAPTCHA. For reCAPTCHA, Google's Privacy Policy and Terms of Service also apply.
- Meta: the Meta Pixel (only with your consent). When you allow marketing cookies, Meta Platforms Ireland Ltd receives data about your visit and is jointly responsible with us for collecting it; how Meta then uses it is described in Meta's Privacy Policy.
- Qliva (Pelilo AB, Sweden): the chat assistant Alba, which is an AI, not a person. Conversations are stored on servers in Stockholm (EU). To write a reply, parts of the conversation are sent to an AI model provider that may process them outside the EU, including in the United States, under the European Commission's Standard Contractual Clauses, and may not use them to train its models. See also Qliva's privacy policy for the assistant.
- Our email and IT service providers, who store the messages we receive.
Google and Meta may process data in the United States. Google LLC and Meta Platforms, Inc. are certified under the EU–US Data Privacy Framework, which the European Commission recognises as providing an adequate level of protection. We share your data with others only where the law requires it.
Your rights
You can ask to access, correct or delete your data, to restrict or object to its processing, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time. Email info@cantalobos.com and we will answer within one month.
If you believe we handle your data incorrectly, you can complain to the Spanish Data Protection Agency (www.aepd.es) or to the data protection authority in your country.