Last updated: November 1st, 2026

 

  1. Information on the Processing of Personal Data

The information collected by ALTA CAPITAL HOSPITALITY SPAIN SL (hereinafter also referred to as “ALTA CAPITAL” or the “Data Controller”) through the following website http://casa-musa.com (hereinafter, the “Website”), as well as the information collected through your relationship with the Data Controller and your use of our services, will be processed with the utmost confidentiality and discretion in accordance with the applicable personal data protection legislation and the provisions of this Privacy Policy.

 

  1. Data Controller

The data controller responsible for the processing of personal data referred to in this Privacy Policy is:

  • Owner: ALTA CAPITAL HOSPITALITY SPAIN SL 
  • Tax ID (NIF): B67040394 
  • Registered address: Avenida Diagonal, 458, Planta 8, 08006 Barcelona, Spain 
  • Contact email: contact@casa-musa.com 

 

  1. Personal Information Collected and Processed by ALTA CAPITAL

ALTA CAPITAL may collect directly through your relationship with us and your use of our services, mainly, the categories of data indicated below: (i) identification and contact data; and (ii) website usage and browsing data, in accordance with the provisions set out in the Cookie Policy.

 

  1. Purposes of the Processing of Your Personal Data and Legal Basis

ALTA CAPITAL may process your personal data for the following purposes and on the following legal bases:

 

  • Management of booking requests, quotations and enquiries relating to stays, weddings, corporate events and retreats.

 

Legal basis: performance of pre-contractual measures at the request of the data subject. Personal data will be processed in order to respond to the data subject’s request and to take, at their request, the necessary steps prior to entering into a contract.

 

  • Managing the contractual relationship once a booking or event has been confirmed.

 

Legal basis: performance of a contract. Personal data will be processed where necessary for the conclusion and performance of a contract to which the data subject is a party.

 

  • Management of accommodation services and compliance with legal obligations applicable to accommodation establishments.

 

Legal basis: compliance with legal obligations. We will process your personal data in order to manage your stay, verify your identity, and comply with the registration, reporting and record-keeping obligations imposed on accommodation establishments under Real Decreto 933/2021.

 

  • Responding to enquiries submitted through the contact form, by email or via WhatsApp.

Legal basis: performance of pre-contractual measures. Where you request availability, a quotation or a booking in your own name, we will process your personal data because this is necessary to respond to your request and, where applicable, to formalize the contract.

Legal basis: legitimate interests. We process your personal data based on our legitimate interest in receiving, managing and responding to communications from users, customers, suppliers and other interested parties.

 

  • Sending marketing communications, only where the user has ticked the relevant consent box.

Legal basis: consent. Personal data will be processed where the data subject has given their freely given, specific, informed and unambiguous consent for one or more specific purposes. The data subject may withdraw such consent at any time, without affecting the lawfulness of processing carried out prior to its withdrawal.

Exception applicable to existing customers in relation to electronic marketing: where applicable, and in accordance with the legislation governing information society services and electronic commercial communications, commercial communications relating to ALTA CAPITAL’s own products or services that are similar to those previously contracted by the customer may be sent on the basis of the legal exemption available for existing customers, provided that they were given the opportunity to object to the processing of their data for marketing purposes both at the time of collection and in each subsequent communication.

 

  • Ensuring the security of our systems and preventing fraud.

Legal basis: legitimate interests. Personal data will be processed on the basis of our legitimate interest in protecting the security of our systems and communications, detecting unauthorised access, and preventing identity theft, fraudulent use or non-payment.

 

  • Defending our rights in the event of potential claims and responding to requests from public authorities.

 

Legal basis: legitimate interests. Personal data will be processed on the basis of our legitimate interest in establishing, exercising or defending legal, administrative or out-of-court claims that may be brought by or against ALTA CAPITAL.

 

Legal basis: compliance with legal obligations. Personal data will be processed where necessary to comply with requests made by courts, tribunals and competent authorities.

 

  • Ensuring compliance with our accounting and tax obligations.

Legal basis: compliance with legal obligations. Personal data will be processed where such processing is necessary to comply with the accounting, fiscal and tax obligations applicable to us.

 

  1. Retention Period for Personal Data

Your personal data will be retained only for as long as is necessary to fulfil the purposes described in this Privacy Policy, ensuring that the processing is adequate, relevant and limited to what is strictly necessary to achieve the purposes for which it is carried out.

Once the personal information collected is no longer useful or necessary for the specific purpose described in the sections above, ALTA CAPITAL shall, in accordance with Article 32 of Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights and Article 17(3) of Regulation (EU) 2016/679 (General Data Protection Regulation), restrict the processing of your personal data in all systems, and such data will be retained solely for the purpose of making it available to the competent authorities in relation to any potential administrative or judicial liabilities and for the establishment, exercise or defence of legal claims during the applicable limitation periods.

Thereafter, your personal data will be permanently deleted.

 

  1. Recipients

Depending on the service requested, certain third parties may process your personal data as independent data controllers. By way of example, where you request a booking for an event, accommodation or any other service offered through our Website, your personal data may, where applicable, be disclosed to financial institutions and payment service providers, as well as to those suppliers whose involvement is necessary for the management and proper provision of the contracted services. Such disclosures are strictly necessary to ensure the provision of the contracted service. In such cases, the privacy information of the relevant third party shall apply.

In addition, your personal data may be disclosed to third parties where necessary to comply with a legal obligation. In such cases, your personal data may be shared with public administrations, as well as with other competent authorities and public bodies.

ALTA CAPITAL engages various service providers that process personal data on its behalf. Appropriate data processing agreements have been entered into with those providers acting as data processors, in accordance with the applicable data protection legislation.

Under no circumstances will ALTA CAPITAL sell your personal data to third parties.

In addition, please note that where personal data is transferred outside the European Economic Area, ALTA CAPITAL ensures that such transfers take place on the basis of one of the transfer mechanisms provided for in Chapter V of Regulation (EU) 2016/679 and that the safeguards required under the applicable data protection legislation are implemented, such as an adequacy decision or the European Commission’s Standard Contractual Clauses, together with supplementary measures where necessary. Further information may be requested through the privacy contact details provided.

 

  1. Privacy Rights

You may exercise your rights of access, rectification, objection, erasure, restriction of processing and data portability at any time, in the cases and to the extent provided for by the applicable legislation. Furthermore, where the processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of any processing carried out prior to its withdrawal. To exercise these rights, you may contact the Data Controller by email at paulaigual@casa-musa.com.

In order to verify your identity, we may request additional information only where there are reasonable doubts concerning the identity of the person submitting the request.

No processing is carried out that involves decision-making based solely on the automated processing of personal data.

In addition, please be informed that you have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

 

  1. Security Measures   

We inform you that the Data Controller has implemented the necessary technical and organisational measures to ensure the security of your personal information and to prevent its alteration, destruction, loss or unauthorised processing.

When determining these measures, factors such as the state of the art, the existing risks, and the nature, scope, context and purposes of the processing have been taken into account.

 

  1. Changes to the Privacy Policy

This Privacy Policy will always remain available to users.

The Data Controller reserves the right to amend this Privacy Policy at its discretion, or as a result of legislative, case law or business practice changes. If the Data Controller makes any material changes to its content, we will notify you through our Website so that you may, if you wish, exercise your rights as a data subject.