Privacy Policy

Last updated: 14 October 2026

1. Data controller

The data controller for personal data collected through the Wellestar website is:

ECONMERCE SDR, S.L.
CIF: B39793096
Address: Peña Sagra 2F, 39011 Santander, Cantabria, Spain
Email: [email protected]
Telephone: +34 637 742 778

2. Personal data we may collect

Depending on how you interact with the website, we may collect:

• Contact details, such as your name, email address and telephone number.
• Enquiry and booking information, including requested dates, number of guests and relevant communications.
• Information required to prepare quotations, administer reservations and issue invoices.
• Payment and transaction information necessary to confirm and manage bookings. Card details entered into Stripe's payment interface are handled through Stripe's payment services.
• Your email address, if you subscribe to our newsletter.
• Information you submit when applying to an open call or residency.
• Technical information generated when you use the website, such as your IP address and device and browser information.

We request only information reasonably necessary for the relevant purpose.

3. Purposes and legal bases

We may process personal data for the following purposes:

Responding to enquiries. To answer questions and provide information requested by you. The legal basis is taking steps at your request before entering into a contract or, where appropriate, our legitimate interest in responding to correspondence.

Managing bookings and accommodation. To assess requests, communicate availability, confirm reservations, provide the agreed service and manage changes or cancellations. The legal basis is taking steps at your request and performing the contract.

Open calls and residency applications. To review applications, assess candidates and communicate decisions. The legal basis is taking steps at your request before entering into a contract.

Payments and invoices. To arrange payments, reconcile transactions, issue invoices and meet accounting and tax obligations. The legal bases are performance of the contract and compliance with legal obligations.

Security and website operation. To protect the website, prevent misuse and maintain its functionality, where applicable. The legal basis will depend on the processing involved, including legitimate interests where appropriate.

Newsletter. If you subscribe through the website, we will first send you a confirmation email, and we will add you to our mailing list only once you confirm. We will then use your email address to send you occasional emails about stays, residencies and news from Casa Azul. The legal basis is your consent, which you may withdraw at any time using the unsubscribe link in every email.

Cookies. This website does not use analytics or advertising cookies. See our Cookie Policy for details.

4. Payments through Stripe

When Stripe is used to process a booking payment, payment information will be processed through the Stripe services integrated into the website.

Stripe may process personal data under its own privacy terms and may act as an independent controller for certain activities.

Wellestar does not intend to store full payment-card details on its own systems.

5. Recipients and service providers

Personal data may be shared, where necessary, with:

• Stripe, which processes card payments for bookings.
• Cloudflare, which hosts and delivers the website and provides security and performance services.
• Brevo, which manages our newsletter mailing list and sends confirmation and newsletter emails.
• Resend, which sends us notification emails when an enquiry or booking request is submitted through the website.
• Hostbrid, which hosts our email accounts.
• Google, which provides the application forms (Google Forms) used for open calls.
• Accountants, professional advisers and public authorities, where required by law.

The company legally responsible for providing the accommodation will also receive the data needed to manage your booking, where it is different from the website operator. We do not sell personal data.

6. International transfers

Some of the providers listed above, such as Stripe, Cloudflare, Resend and Google, may process personal data outside the European Economic Area, including in the United States. Where this happens, the transfer relies on safeguards recognised under data-protection law, such as the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.

7. Retention

Enquiry information will be retained for as long as necessary to respond to the enquiry and manage any resulting relationship.

Booking, payment and invoice records will be retained for the periods required by applicable accounting, tax and other legal obligations, and for as long as necessary to establish or defend legal claims.

Data processed on the basis of consent will be retained until consent is withdrawn, subject to any other applicable legal retention obligation.

8. Your rights

Subject to applicable law, you may request access to your personal data, rectification, erasure, restriction of processing, portability, or object to processing.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise your rights, contact [email protected]. We may request information necessary to verify your identity.

You may also lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) at www.aepd.es.

9. Security

Appropriate technical and organisational measures will be used to protect personal data against unauthorised access, loss, alteration or disclosure. No internet transmission or storage system can be guaranteed to be completely secure.

10. Third-party websites

The website may link to third-party websites. Their privacy practices are governed by their own policies.

11. Changes to this policy

This Privacy Policy may be updated to reflect changes in the website, its services or applicable law. The latest version will be published on the website.

12. Contact

For privacy questions or requests concerning personal data, contact [email protected].