Privacy policy

You can use buiigo without giving us any data. We only process the technical data needed to serve and protect the website, whatever you tell us if you write to us, and public information about properties. We don’t sell data to anyone.

• Controller: ⟦TITULAR⟧ (Tax ID ⟦NIF⟧)
• Address: ⟦DOMICILIO⟧
• Contact: ⟦EMAIL⟧

We are not required to appoint a data protection officer. For any privacy question, write to that email address.

To show you the website, your browser automatically sends technical data such as your IP address, browser and device type, language, the page you request and the date and time.

• Purpose: serving pages, keeping the site secure (for example, stopping attacks or abuse) and fixing technical errors.
• Legal basis: our legitimate interest in offering a secure, working website (Art. 6(1)(f) GDPR).
• Who processes it: Cloudflare, our network, caching and security provider, as a data processor. Our server, located in Spain, does not keep access logs with your IP address; it only records technical errors without personal data.
• Retention: only as long as necessary for those purposes, under Cloudflare’s retention policies.

What you type in the search box (a destination, dates, number of guests or whether you’re travelling with pets) is only used to show you suggestions and results. Dates and guests travel in the page address and we don’t store them linked to you.

We record each click on an affiliate link with the listing, the page language, the approximate country (which Cloudflare infers from your connection) and the date and time. We don’t store your IP address or any identifier, so the record is anonymous and cannot identify you. We use it for statistics and to reconcile commissions.

We then redirect you to Stay22 and the booking site, which process your data as independent controllers under their own privacy policies. We don’t see or control what you do there (searches, bookings, payments); Stay22 only reports bookings to us in aggregate form so that commissions can be calculated.

• Data: your email address, your name if you give it, and what you tell us.
• Purpose: replying to you and dealing with your request, including requests to exercise your rights or to remove a listing.
• Legal basis: handling your request and our legitimate interest in doing so (Art. 6(1)(b) and 6(1)(f) GDPR); for rights requests, compliance with a legal obligation (Art. 6(1)(c) GDPR).
• Retention: while we deal with your enquiry and, afterwards, for the period during which liability may arise (three years at most), unless the law requires longer.
• Who processes it: our email provider, as a data processor.

To show you photos and maps, your browser connects directly to these services, which receive your IP address and technical browser data:

• Google (googleusercontent.com): property photos. Google Privacy Policy.
• OpenFreeMap (openfreemap.org): map images and labels, only when the map appears on screen.
• GetYourGuide (getyourguide.com): activities, only if you allow it in the third-party content notice or with “Show activities”; it may use its own cookies and identifiers. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with “Cookie settings”.

Legal basis: our legitimate interest in showing you photos and maps of properties (Art. 6(1)(f) GDPR). “Get directions” links open Google Maps only if you click them.

Listings show public information about establishments (name, address, location, photos, ratings and guide prices), obtained mainly from Google Maps. It usually relates to businesses, but it may include data about individuals, for example when a property bears its owner’s name.

We process it on the basis of our legitimate interest in providing useful travel information (Art. 6(1)(f) GDPR), and only while the property remains active in the sources. If you are the owner, you can object or ask us to correct or remove the listing by writing to ⟦EMAIL⟧.

We don’t sell or pass on your data to third parties unless required by law. Our providers process data on our behalf under a data processing agreement.

Some providers, such as Cloudflare and Google, may process data outside the European Economic Area. Where they do, they rely on the EU–US Data Privacy Framework or on standard contractual clauses approved by the European Commission.

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time by writing to ⟦EMAIL⟧. We will reply within one month at most and, if necessary to handle the request, we may ask you to prove your identity.

If you believe we have not handled your rights properly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es) or with the data protection authority in your country.

buiigo is not aimed at children under 14 and we do not knowingly collect their data.

The whole website uses an encrypted connection (HTTPS) and we apply technical and organisational measures to protect data. We don’t make automated decisions that affect you or build profiles about you.

If we change this policy, we will publish the new version here. If the change is significant, we will highlight it on the website. Last updated: October 1, 2026.