Privacy

UPPER is the controller for personal data processed through this website and the authenticated portals. Day-to-day privacy questions should be sent to info@rentalsbyupper.com.

We currently operate as a hospitality platform for exceptional homes in Spain, with bookings settled in euro. If a local host or supplier processes data independently of us, they remain responsible for that processing.

Account data: name, email address, locale preference, and authentication identifiers when you create or sign in to a guest, host, partner, organiser, or reseller workspace.

Booking and stay data: property, dates, guest counts, special requests, payment status, and messages exchanged about a reservation.

Payment data: we do not store full card numbers. Stripe processes card details on our behalf; we retain payment references, amounts in EUR, and the outcome of a charge or refund.

Enquiry data: the contents of contact forms, including intended audience (owners, organisers, partners, resellers) and any documents you attach.

Technical data: IP address, browser type, device, approximate location derived from IP, pages viewed, and diagnostic events needed to keep the service secure and available.

To create and secure your account, send transactional email (confirmations, password resets, stay instructions), and operate the portals.

To take and manage bookings, including availability holds, checkout, refunds, and host payouts where those features are enabled.

To respond to enquiries, onboard hosts and partners, and provide guest care or property operations you have requested.

To protect the platform against fraud, abuse, and unauthorised access, and to meet legal, tax, and accounting duties in Spain.

With your consent, to understand how the public site is used so we can improve it. Analytics stay off until you accept optional cookies.

Contract: processing required to take a booking, run your account, or deliver a stay you have requested.

Legitimate interests: keeping the service secure, diagnosing faults, and answering pre-contract enquiries in a way you would reasonably expect.

Consent: optional analytics and any non-essential cookies. You may refuse or withdraw consent without affecting a booking.

Legal obligation: records we must keep for tax, consumer, or anti-fraud rules applicable in Spain and the EU.

Infrastructure: Supabase (authentication and database), Vercel (hosting), and email delivery so messages actually arrive.

Payments: Stripe, for checkout and payment-intent processing. Stripe acts as an independent controller for some payment data under its own terms.

Operations: hosts, approved service partners, and UPPER staff who need the information to prepare a home or fulfil a stay — never as an open address book.

Monitoring: Sentry for error diagnostics. We do not sell personal data or rent our guest list.

We keep account and booking records for as long as the relationship lasts and for a limited period afterwards where tax or dispute rules require it. Enquiry data that does not become a booking is kept only as long as needed to respond.

Some processors are located outside the EEA. Where that happens we rely on an adequacy decision or Standard Contractual Clauses, together with the security measures those providers publish.

Access to production systems is limited to named operators. Transmission uses HTTPS. No method of transmission is perfectly secure; we treat incidents as operational failures, not marketing footnotes.

You may request access, correction, deletion, restriction, or portability of your personal data, and you may object to processing based on legitimate interests. Where we rely on consent, you may withdraw it at any time.

Authenticated guests can review profile and privacy controls in their portal. For anything those screens cannot do, email info@rentalsbyupper.com. We may need to verify your identity before acting.

You also have the right to lodge a complaint with the AEPD or another EU supervisory authority where you live or work.