Skip to content

Privacy policy

This policy explains what personal data we process, why, for how long and what rights you have, under the General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). Version of 5 November 2026.

1. Controller

  • NOXI RENT, S.L. · Tax ID B88022504
  • Calle Alonso Cano 62, 28003 Madrid (Spain)
  • Data protection email: GDPR@noxi.es · Phone: +34 666 16 31 07
  • NOXI has not appointed a data protection officer, as it is not required to.

2. What data we process, why and on what basis

  • Bookings: first name, surname, email, phone, country, ID document, address, dates, guests, arrival time, comments, discount code and amounts. To manage the booking, payment, changes and cancellations and to communicate with you. Basis: the contract (art. 6.1.b GDPR). Fields marked as required are needed to book.
  • Invoicing: the invoice details you give us (name or company name, tax ID and address). Basis: legal obligation (art. 6.1.c GDPR) under tax and commercial law.
  • Guest registration: on arrival, we collect the identity details of all guests required by Royal Decree 933/2021 and report them to the Spanish Ministry of the Interior. Basis: legal obligation (art. 6.1.c GDPR).
  • Access to “My booking”: your email and a one-time code. Basis: the contract, so that you can manage your booking securely.
  • Contact and group request forms: name, email, phone and message. To reply to you and, for groups, to prepare the booking. Basis: your request and pre-contractual steps (art. 6.1.b GDPR).
  • Marketing: only if you tick the offers box, we send you offers and news from NOXI by email and, if you gave us your phone number, by SMS or messaging. Basis: your consent (art. 6.1.a GDPR), which you can withdraw at any time. We keep the date and the version of the conditions you accepted.
  • Usage statistics: when you visit the website we record the page viewed, the language and the date. To count visits without cookies or anything stored on your device, we compute a code from your IP address and browser that changes every day and cannot be used to follow you from one day to the next; the IP address is not stored. Legal basis: our legitimate interest in understanding how the website is used in order to improve it (art. 6.1.f GDPR). You can object by writing to GDPR@noxi.es.
  • Unsubscribe list: if you unsubscribe from marketing communications, we keep your email address and the date to make sure we do not send you marketing again. Legal basis: legal obligation and our legitimate interest in respecting your choice (art. 6.1.c and f GDPR).
  • Security: to prevent abuse, the website limits the number of form submissions per IP address, which is only kept temporarily in the server's memory. Basis: legitimate interest in protecting the service (art. 6.1.f GDPR).

We do not make automated decisions or build profiles with your data. If you book for other people or ask for an invoice in someone else's name, you agree to inform them of this policy.

3. How long we keep it

  • Paid bookings and their change history: 6 years from the check-out date (accounting and tax obligations).
  • Bookings that were never paid: deleted after 30 days.
  • Invoices and invoice requests: 6 years.
  • Guest registration: 3 years, as required by Royal Decree 933/2021.
  • Contact and group requests: 1 year after we deal with them.
  • “My booking” access codes: deleted the next day.
  • Usage statistics: 13 months.
  • Unsubscribe list: for as long as needed to avoid sending you marketing.
  • Consent to marketing communications: until you unsubscribe; then blocked for 3 years to prove that we had it.

4. Who we share your data with

We do not sell or transfer your data. We only share it with the authorities when the law requires it (Ministry of the Interior, tax authorities, courts) and with the providers that process it on NOXI's behalf under a data processing agreement:

  • Stripe Payments Europe, Ltd. (Ireland): payment processing.
  • Supabase, Inc.: website database, with servers in the European Union (Ireland).
  • IONOS: website hosting (European Union).
  • Resend, Inc. (United States): sending booking emails, access codes and marketing communications.
  • Smoobu GmbH (Germany): booking and property management system.

Apartment maps are generated on our server, so your browser does not connect to OpenStreetMap. If you click “Open in OpenStreetMap”, you go to their website, which processes your data as an independent controller.

5. International transfers

Some providers (such as Resend or the Stripe group) may process data in the United States. In those cases, the transfer is covered by the EU-US Data Privacy Framework or the standard contractual clauses approved by the European Commission.

6. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent you have given at any time, by writing to GDPR@noxi.es or to our postal address, stating the right you wish to exercise. We may ask for additional information if needed to identify you. We will reply within one month.

If you believe we have not handled your request properly, you can file a complaint with the Spanish Data Protection Agency (www.aepd.es).

7. Minors

Only people aged 18 or over can book. The details of guests under 18 are provided by the responsible adult and are only used for the stay and the guest registration.

8. Security

We apply technical and organisational measures to protect your data: encrypted connections, access restricted to authorised staff, permission controls in the database and GDPR-compliant providers. Your card details are handled only by Stripe.

9. Cookies

This website only uses technical cookies. Usage statistics do not use cookies (see section 2). See the Cookie policy for details.

10. Changes to this policy

We may update this policy. If the changes are significant, we will let you know on the website or by email.