Last updated: 30 October 2026
This Privacy Policy explains how KAY MANAGEMENT MARBELLA S.L. ("KAŸ", "we", "us") collects and uses personal data when you visit kay-mgmt.com, enquire about or book a stay, entrust us with the management of your property, or subscribe to our newsletter. We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
1. Who is responsible for your data
Data controller: KAY MANAGEMENT MARBELLA S.L.
Tax ID (CIF): B75725887
Address: Autop. del Mediterráneo, km 176, Oficina 9, 29602 Marbella, Málaga, Spain
Telephone: +34 664 82 06 70
Email for privacy requests: info@kay-mgmt.com
We have not appointed a Data Protection Officer, as we are not legally required to. Any privacy question can be sent to the email above.
2. What data we collect and why
Website visitors
Data: IP address, device and browser information, pages viewed and, only if you consent, cookie identifiers used for analytics and advertising. Purpose: operating and securing the website, measuring its use and showing relevant advertising. Legal basis: our legitimate interest for strictly necessary functions; your consent for analytics and advertising cookies (see our Cookie Policy).
Enquiries and booking requests
Data: name, email, phone, travel dates, number of guests and any information you include in your message. Purpose: answering your enquiry and preparing a proposal. Legal basis: steps taken at your request before entering into a contract.
Guests who book a stay
Data: identification and contact details, booking details, payment information, billing details, signed rental agreement, security deposit or damage waiver details, vehicle registration plates where required for access to the property, and communications with you. Card payments are handled by our payment service providers; we do not store full card numbers on our own systems. Purpose: managing your booking, payments, invoicing, access to the property, guest support and the protection of the property. Legal basis: performance of the contract; compliance with tax and accounting obligations.
Mandatory guest registration. Spanish law (Royal Decree 933/2021) requires us to record the identity document details of every adult guest and report them to the Ministry of the Interior through the SES.HOSPEDAJES platform. You may send these details by email, WhatsApp or through an online check-in platform such as Chekin. Legal basis: compliance with a legal obligation. Retention: 3 years, as set out in that regulation.
Guest screening. To protect our homes, some bookings are screened by our property management system's verification service (Guesty Screen & Protect). It checks the information you provide to assess the risk of fraud or damage. Legal basis: our legitimate interest in preventing fraud and protecting the properties we manage. Our team reviews the result before any booking is declined; you may ask for human review and express your point of view.
Property owners
Data: identification and contact details, ID document, bank details, property documents and information, tax information and management contract. Purpose: managing the services agreed with you, paying your income, accounting and legal compliance. Legal basis: performance of the contract; compliance with legal obligations.
Newsletter and marketing
Data: email address, and the pages and emails you interact with. Purpose: sending news about our homes, services and the Costa del Sol. Legal basis: your consent when you subscribe. For past guests and owners we may send information about similar services, as permitted by article 21.2 of Law 34/2002 (LSSI); you can object at any time with the unsubscribe link in every email.
Suppliers and job applicants
Data: contact and professional details you send us. Purpose: managing the commercial relationship or the selection process. Legal basis: contract or pre-contractual steps; your consent for CVs.
3. How long we keep your data
Enquiries that do not become a booking: up to 12 months.
Booking, contract and invoicing data: for the duration of the relationship and afterwards for as long as required by law (generally 6 years for accounting records and 4 years for tax purposes).
Guest registration data (SES.HOSPEDAJES): 3 years.
Owner data: for the duration of the management contract and the legal limitation periods afterwards.
Newsletter: until you unsubscribe.
Cookies: see our Cookie Policy.
4. Who we share your data with
We do not sell your data. We share it only when necessary with:
Public authorities, when required by law (for example the Ministry of the Interior through SES.HOSPEDAJES, the Tax Agency or courts).
The owner of the property you stay in, where we act on the owner's behalf and to the extent needed for your stay.
Service providers acting on our behalf (data processors) under contracts that protect your data: Guesty (booking and property management, including Guesty Screen & Protect), PriceLabs (pricing), Klaviyo (newsletter), Google (Workspace email, Analytics, Ads, Maps and Fonts), Microsoft (OneDrive), Notion (internal workspace), SignNow (electronic signature), Framer (website hosting), Cloudflare (booking connection), Chekin (online check-in), WhatsApp Business (Meta) for guest communication, payment service providers, our external accountants, and cleaning and maintenance partners who need guest names and arrival details.
Booking platforms such as Airbnb or Booking.com, when you book through them. They act as separate controllers under their own privacy policies.
5. International transfers
Some of our providers (for example Google, Microsoft, Klaviyo, Notion, Cloudflare, Meta and Guesty) may process data outside the European Economic Area, including in the United States. In those cases transfers rely on an adequacy decision such as the EU-US Data Privacy Framework, or on the European Commission's Standard Contractual Clauses.
6. Your rights
You can request access to your data, rectification, erasure, restriction of processing, data portability, and object to processing, including for marketing. Where processing is based on consent, you can withdraw it at any time without affecting earlier processing. Send your request to info@kay-mgmt.com; we may ask you to confirm your identity. We will reply within one month.
If you believe your rights have not been respected, you can file a complaint with the Spanish Data Protection Agency (AEPD), www.aepd.es.
7. Minors
Our services are not directed at people under 18, and bookings must be made by an adult. Details of minors staying in a property are processed only where required by law (guest registration) and provided by their parent or guardian.
8. Security
We apply appropriate technical and organisational measures to protect your data against loss, misuse or unauthorised access, and require the same of our providers.
9. Changes to this policy
We may update this policy to reflect legal or operational changes. The date at the top shows the latest version.
