1. Data controller
In accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), users are informed that the controller of their personal data is:
- Controller: Jose Javier Martín Altafaj
- National ID (DNI): 29129654Q
- Address: Calle Cataluña
- Email: info@yharaluxe.com
- Website: www.yharaluxe.com
2. Personal data we collect
Yharaluxe only collects the personal data needed to manage user accounts. Specifically:
- Name: Provided when registering.
- Email address: Registration, sign-in and password recovery.
- Password: Stored encrypted (hashed). The plain text is never accessible.
- Favourite hotels: A list linked to the user account.
- Session cookies: Technical cookies that keep the signed-in user’s session active.
Yharaluxe does not collect browsing data for analytics, does not profile users and does not send commercial communications or newsletters.
3. Purposes of processing
The personal data collected is processed for the following purposes:
- Managing the user account (registration, sign-in and password recovery).
- Keeping the user’s preferences (list of favourite hotels).
- Keeping the session active by means of technical cookies.
- Sending strictly transactional emails (password reset).
4. Legal basis for processing
The legal basis for processing the data is:
- User consent (Art. 6.1.a GDPR): When the user voluntarily registers an account on the platform.
- Performance of a contract (Art. 6.1.b GDPR): To provide the user account service requested.
- Legitimate interest (Art. 6.1.f GDPR): Technical maintenance of the session and security of the platform.
5. Data retention
Personal data is kept for as long as the user account remains active. When the user deletes their account, all of their personal data (profile data, list of favourites and sessions) is permanently deleted.
6. Recipients and data sharing
Yharaluxe does not transfer or share personal data with third parties, except where required by law. An email service provider is used only to send transactional emails (password reset), acting as a data processor under Article 28 GDPR.
7. User rights
Under Articles 15 to 22 GDPR, users may exercise the following rights at any time:
- Access: Find out which of their personal data we process.
- Rectification: Correct inaccurate or incomplete data.
- Erasure: Request that their data be deleted.
- Objection: Object to processing in certain cases.
- Restriction: Request that processing be restricted.
- Portability: Receive their data in a structured format.
- Withdrawal of consent: Withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
To exercise these rights, send an email to info@yharaluxe.com stating the right you wish to exercise and attaching a copy of your identity document.
Users can also delete their account directly from the profile page at any time, which permanently erases all of their personal data.
8. Security measures
Yharaluxe applies appropriate technical and organisational measures to protect personal data against unauthorised access, loss or alteration. These include:
- Passwords are stored using secure hashing algorithms, so the original text cannot be recovered.
- Session cookies are set with the HttpOnly and Secure attributes to prevent unauthorised access.
- All communications use encrypted HTTPS.
9. Changes to this Privacy Policy
Yharaluxe reserves the right to amend this Privacy Policy to adapt it to legislative or technological developments. Any substantial change will be announced to users by means of a notice on the website.
10. Supervisory authority
If users believe that their data protection rights have been infringed, they may lodge a complaint with the Spanish Data Protection Agency (AEPD):
- Address: C/ Jorge Juan, 6 — 28001 Madrid
- Website: www.aepd.es
Last updated: October 2026