Privacy Notice

The controller is Casa Marea Sunzal, with domicile at Cerromar, El Sunzal, Department of La Libertad, El Salvador. Email: privacidad@casamareasunzal.com. The designated channel for notices is electronic mail.

ARCO-POL requests (access, rectification, erasure, objection, portability, right to be forgotten, and restriction) and requests to withdraw consent are received and handled by the controller through the Casa Marea Sunzal privacy channel. Requests shall be submitted through the rights form or to the email address indicated above.

On 12 September 2026, the Agencia de Ciberseguridad del Estado (ACE) left without effect the 16 September 2026 deadline to appoint a data-protection officer, stating that no action is required in that regard until further official guidance is issued. This Notice will be updated if a new ACE disposition so requires.

Depending on the data subject’s interaction with the Site, the following categories may be processed:

• Browsing data: Internet protocol address, device type, pages viewed, and referring URL.
• Cookie preferences: the choice among strictly necessary cookies, analytics, and maps, stored in the browser.
• Data supplied to exercise rights: name, domicile, email or telephone for notices, identity document, description of the data concerned, and the right invoked.
• Booking data (where a reservation is later completed on a third-party platform): identification, contact, and stay details processed by that platform under its own notice.

No sensitive personal data are requested on this Site (including data revealing health, religion, biometrics, sexual orientation, or other intimate information). No person is obliged to provide such data. The lodging is adults-only; data of children and adolescents are not sought.

Processing is carried out in accordance with Article 5(g) of the Law, on the following bases, as applicable:

• the data subject’s free, specific, informed, express, and individualized consent, for audience measurement and Google Maps;
• performance of a contract to which the data subject is party, or of pre-contractual measures, where the data subject writes in connection with a stay;
• compliance with a legal obligation incumbent on the controller;
• the controller’s legitimate interests in operating and securing the Site, provided such interests do not override the data subject’s rights and freedoms.

Personal data are processed solely for the following purposes:

• Purposes requiring consent: measuring visits to the Site (Google Analytics) and displaying the location map (Google Maps), including the related international transfers.
• Purposes that do not require additional consent: making the Site available, storing the cookie choice, handling ARCO-POL requests, establishing, exercising, or defending legal claims, and complying with applicable law.

Data shall not be processed for purposes other than those informed. If a further purpose is contemplated, the data subject shall be informed in advance and a new authorization obtained, without prejudice to the right to withdraw the original consent.

The Site uses strictly necessary cookies and, only where consent is granted, analytics and map cookies, as described in the Cookie Policy. Consent may be withdrawn at any time through the Site footer or that policy, without retroactive effect on processing that was already lawful.

The following processors may access personal data as necessary to operate the Site. Where analytics or maps are accepted, data may be transferred outside El Salvador:

• Google LLC and affiliated companies (Google Analytics and Google Maps), with servers outside El Salvador;
• Supabase, for storage of Site photographs;
• Meta Platforms, solely if the data subject activates an embedded Instagram video or post;
• the hosting provider of the Site, including backup and contingency copies of the Site on that infrastructure.

Processors are required to afford a level of protection no lower than that mandated by Salvadoran law. Personal data are not sold. If a booking channel (for example, Airbnb or a direct-booking operator) is enabled, that provider shall be controller of the data the guest supplies on its platform.

The Site does not maintain a guest database on this domain beyond communications received when rights are exercised.

The cookie choice is stored in the browser until the data subject deletes or amends it. Communications relating to ARCO-POL requests are retained for the time necessary to respond (twenty business days, extendable by a further twenty for a justified cause) and to demonstrate compliance with the Law. Analytics records, if consented to, are retained for the minimum period configured for the measurement property, limited to the purpose of understanding Site use.

Thereafter, data shall be erased, blocked, or anonymized, unless a legal obligation or the establishment, exercise, or defence of claims requires longer retention.

The Site is served over HTTPS. Access to analytics tools and the privacy mailbox is restricted to persons who operate Casa Marea. Processors are required to implement measures of confidentiality, integrity, and availability.

In the event of a personal-data security breach, the controller shall notify the Agencia de Ciberseguridad del Estado (ACE), the Office of the Attorney General of the Republic, and the affected data subjects, within a maximum of seventy-two hours from becoming aware of the incident, in the terms of Article 25 of the Law.

The data subject, in person or through a representative with special authority, may request access, rectification, erasure, objection, portability, the right to be forgotten, and restriction of processing, and may withdraw consent. Exercise of these rights is free of charge, save the actual cost of physical copies or postal dispatch if requested. Transmission by electronic mail is free of charge.

The controller shall reply within twenty business days, extendable by a further twenty for a justified cause. Withdrawal of consent shall be processed within five business days. Incomplete requests shall be subject to a single request for additional information, to be cured within ten business days. If the controller is not competent, the petitioner shall be so informed within five business days.

Requests shall be submitted through the rights form or to privacidad@casamareasunzal.com. In the event of disagreement with the decision, the data subject may lodge a complaint with the Agencia de Ciberseguridad del Estado (ACE).

Lodging is offered exclusively to adults. The controller does not knowingly collect personal data of children or adolescents. If it becomes known that a minor has supplied information, it shall be erased upon request, without prejudice to the superior interest of the child as provided by applicable law.

Amendments to this Notice shall be published on this same page, with an updated date. Material changes shall additionally be indicated in the cookie banner on the first visit following the amendment.