1. Who processes your data
- Controller: Playa Mango La Herradura, S.L.
- Tax ID (NIF): B16463697
- Address: Paseo Andrés Segovia 32, 18690 La Herradura, Almuñécar (Granada), Spain
- Contact and rights requests: playamango2024@gmail.com · +34 651 596 111
- Data Protection Officer: not applicable. We have not appointed a DPO, as none of the cases in article 37 GDPR apply.
2. What we process, why, and on what basis
a) Event enquiries
When you fill in the form on the Events page, we process: name, email, phone, event type, number of guests, planned date and your message.
- Purpose: to reply and prepare a proposal for your celebration.
- Legal basis: pre-contractual steps at your request (art. 6.1.b GDPR). You write to ask us for a quote, and we process your data in order to give you one.
- Retention: 6 months from your enquiry, unless it leads to a contract, in which case it is kept for the duration of that relationship and any applicable statutory limitation periods.
- How it travels: the form emails the information to our own account through the provider Resend. It is not stored in any website database.
b) Table bookings via WhatsApp
The booking form on the home page works differently, and it is worth being clear: it sends nothing to our servers. All it does is compose a message from what you typed and open your WhatsApp app with that text ready. You decide whether to send it. If you do not press send in WhatsApp, we receive nothing at all.
- What we receive if you send it: name, phone, date, time, number of people and any comments.
- Purpose: to handle your booking.
- Legal basis: pre-contractual steps at your request (art. 6.1.b GDPR).
- Retention: 6 months.
- Please note: the conversation happens in WhatsApp, a Meta service with its own terms and privacy policy, separate from this website.
c) Website analytics
If you accept it in the cookie notice, we use Google Analytics 4 to understand in aggregate how the site is used (most viewed pages, language, device type) in order to improve it.
- Legal basis: your consent (art. 6.1.a GDPR), which you can withdraw at any time.
- Cookie detail: section 3.
d) Location map
The Google Maps map only loads if you accept it. Until then you will see a placeholder. When it loads, Google may receive your IP address and browser data.
- Legal basis: your consent (art. 6.1.a GDPR).
e) Google reviews
The reviews shown on the home page are public and obtained from Google. We do not process your data to display them: they show the public name and rating of whoever wrote each review, linked to its source.
3. Cookies
3.1 What they are
Cookies are small files a website stores on your device. They remember information — for example, the choice you made about cookies themselves — or measure in aggregate how the site is used.
3.2 Our starting point: nothing runs without your permission
Everything is rejected by default. Until you explicitly choose in the notice, this site loads neither analytics nor the Google map. We do not apply "consent by continued browsing": if you do not choose, nothing is activated.
The only cookie stored without your permission is the one that remembers precisely your choice about cookies, because without it we would have to ask you again on every page.
3.3 Which cookies we use
Technical cookie (always on, exempt from consent)
| Cookie | Owner | Duration | Purpose |
|---|---|---|---|
pm_consent | Playa Mango | 1 year | Stores which cookie categories you accepted or rejected. It measures nothing and does not identify you. |
"Analytics" category (only if you accept)
Service: Google Analytics 4 (Google Ireland Ltd.). It tells us in aggregate which pages are most visited, in which language and from which device type, so we can improve the site.
| Cookie | Owner | Duration | Purpose |
|---|---|---|---|
_ga | As set by Google Analytics | Distinguish users | |
_ga_JCHXFVTYHR | As set by Google Analytics | Maintain session state |
"Map" category (only if you accept)
Service: Google Maps (Google Ireland Ltd.). Until you accept, you will see a placeholder with a button to load it. When it loads, Google may receive your IP and browser data.
| Cookie | Owner | Duration | Purpose |
|---|---|---|---|
__Secure-ENID | Google (.google.com) | As set by Google | Preferences and security for Google services |
3.4 How to change or withdraw your choice
You can change your mind at any time from the cookie settings link in the footer. Withdrawing consent does not affect data already collected beforehand.
One limitation you should know about, and we would rather say it plainly: when you withdraw consent, we delete the cookies under our own domain (pm_consent, _ga and _ga_JCHXFVTYHR). However, the `__Secure-ENID` cookie belongs to `google.com`, not to us, and browsers deliberately prevent one website from deleting another domain's cookies. That cookie will stay on your device until it expires on its own or until you remove it from your browser settings. This is not a fault of this website: it is how browsers work.
You can also block or delete cookies from your browser settings:
- Chrome: Settings → Privacy and security → Cookies and other site data
- Firefox: Settings → Privacy & Security → Cookies and Site Data
- Safari: Preferences → Privacy → Manage Website Data
- Edge: Settings → Cookies and site permissions
Note that blocking all cookies may affect how this and other websites work.
4. Who else accesses your data
Only the providers needed for the site to work, always as processors under a contract meeting article 28 GDPR:
| Provider | Purpose | Location |
|---|---|---|
| Resend | Emailing us your event enquiry | USA |
| Google Ireland Ltd. | Analytics (GA4) and map, only if accepted | EU / USA |
| Hetzner | Server hosting | Germany (EU) |
| Cloudflare | Content delivery network | Global |
International transfers. The server hosting this site is in Germany, within the European Union. Some of the providers above, however, may process data outside the European Economic Area. In those cases the transfer relies on the safeguards in chapter V GDPR:
- Resend applies the European Commission's Standard Contractual Clauses and adheres to the EU-U.S. Data Privacy Framework.
- Google processes data through Google Ireland Ltd.; Google LLC is certified under the EU-U.S. Data Privacy Framework and additionally applies the Standard Contractual Clauses.
- Cloudflare applies the Standard Contractual Clauses and adheres to the Data Privacy Framework.
We do not sell or share your data with third parties for other purposes. It would only be disclosed to public authorities where legally required.
5. We do not send you marketing
We do not send commercial communications by email or WhatsApp. The data you give us is used only to handle your specific request. If this ever changes, we would ask you separately and explicitly.
6. Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time, and withdraw your consent where processing is based on it (withdrawal does not affect processing carried out beforehand).
- How: email playamango2024@gmail.com stating which right you are exercising. We may ask you to confirm your identity.
- Response time: one month, extendable under article 12 GDPR.
- Complaints: if you believe we have not handled your request properly, you may complain to the Spanish Data Protection Agency (www.aepd.es).
7. Security and minors
We apply reasonable technical and organisational measures to protect your information, including encrypted HTTPS across the whole site.
This site is not aimed at children under 14 and we do not knowingly collect their data.
8. Changes to this policy
We may update this policy if the services we use or the applicable rules change. The version in force is always the one published on this page, with its update date.
Last updated: 30 September 2026
