1. Data Controller In compliance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights, users are hereby informed that personal data provided through this website will be processed by: Trade name: Laguna de Valfría Data Controller: PG L&L CONSULTING Tax ID (NIF/CIF): A80678386 Registered or tax address: Calle de Jesús 2. 4ºB. 28014. Madrid Email: info@valfria.com

2. Personal Data We May Process Depending on the relationship maintained with PG L&L CONSULTING, the following categories of personal data may be processed: • Identification and contact details, such as name, surname, address, telephone number or email address. • Information relating to enquiries and requests for information. • Information necessary to manage bookings, stays and contracted services. • Billing and payment information. • Information required to comply with legal obligations relating to guest registration and reporting. • Technical data relating to use of the website, where applicable, in accordance with our Cookie Policy. Personal data may be provided directly by the user or, where a reservation is made through an authorised platform or intermediary, received from such third party.

3. Purposes of Processing PG L&L CONSULTING may process personal data for the following purposes: Enquiries and Requests for Information To manage and respond to enquiries received through contact forms, email, telephone or other available communication channels. Management of Bookings and Stays To manage availability requests, reservations, amendments, cancellations, payments, invoicing, communications relating to the stay and the provision of contracted services. Compliance with Legal Obligations To comply with legal, tax, accounting and administrative obligations applicable to tourist accommodation activities. In particular, PG L&L CONSULTING may collect, record and communicate guest information required under Spanish regulations governing documentary registration and reporting obligations applicable to accommodation providers. Marketing Communications Where the user has expressly given consent, PG L&L CONSULTING may send information regarding news, offers, experiences or services related to the accommodation. The user may withdraw such consent at any time. Website Operation and Analytics To manage the proper operation and security of the website and, where the user has given consent, to analyse how the website is used or carry out other activities through cookies or similar technologies. Further information is available in our Cookie Policy.

4. Legal Basis for Processing The legal basis will depend on the purpose for which the personal data is processed: Management of enquiries and booking requests: implementation of pre-contractual measures requested by the data subject or, where applicable, the user's consent. Management of bookings and stays: performance of the contract entered into between PG L&L CONSULTING and the guest. Invoicing and compliance with tax and administrative obligations: compliance with legal obligations applicable to PG L&L CONSULTING. Registration and reporting of guest information: compliance with legal obligations arising, among other regulations, from Spanish Royal Decree 933/2021 of 26 October and other applicable legislation. Marketing communications: consent of the data subject where legally required. Analytics, advertising or other non-essential cookies: consent of the user, in accordance with applicable legislation. Withdrawal of consent shall not affect the lawfulness of processing carried out before such consent was withdrawn.

5. Data Retention Personal data will only be retained for as long as necessary to fulfil the purpose for which it was collected and, subsequently, for the periods required to comply with any applicable legal obligations or liabilities. Data relating to bookings, invoicing and financial transactions will be retained for the periods required under applicable tax, commercial and other legislation. Information included in guest registration records will be retained for the legally established period. Where the regime applicable to professional accommodation providers applies, such records will be retained for three years from the end of the contracted service or stay. Data used exclusively for marketing communications will be retained until the user withdraws consent or requests its deletion. Data obtained through cookies will be retained for the periods specified in the Cookie Policy.

6. Recipients of Personal Data Personal data will not be sold or transferred to third parties for commercial purposes. It may be accessed by service providers necessary for the operation of PG L&L CONSULTING, such as technology providers, website hosting companies, booking systems, payment service providers, administrative, accounting or management service providers, always subject to the corresponding contractual and confidentiality obligations. Personal data may also be disclosed to public authorities, law enforcement agencies, tax authorities, courts or other bodies where there is a legal obligation to do so. In particular, information relating to guests and reservations may be communicated to the competent authorities in accordance with Spanish legislation applicable to accommodation establishments.

7. Booking and Payment Platforms Where a reservation is made through external platforms, travel agencies, booking portals or payment service providers, such third parties may process certain personal information in accordance with their own privacy policies. Once PG L&L CONSULTING receives the information necessary to manage the reservation or provide the contracted service, such information will be processed in accordance with this Privacy Policy. PG L&L CONSULTING recommends reviewing the privacy policies of any external platforms used before providing personal information through them.

8. International Data Transfers Certain technology providers used by PG L&L CONSULTING may be located outside the European Economic Area or may use infrastructure located in third countries. Where an international transfer of personal data takes place, PG L&L CONSULTING will apply the safeguards required by applicable legislation, including, where appropriate, European Commission adequacy decisions, Standard Contractual Clauses or other legally recognised mechanisms.

9. User Rights Users may exercise at any time the rights recognised under applicable data protection legislation, including: • Access to their personal data. • Rectification of inaccurate or incomplete data. • Erasure of personal data where applicable. • Restriction of processing. • Objection to processing where applicable. • Data portability in the cases provided for by law. • Withdrawal of consent at any time where processing is based on consent. To exercise these rights, the data subject may contact: Email: info@valfria.com Postal address: Calle de Jesús 2. 4ºB The request must allow the data subject to be properly identified and specify the right they wish to exercise. If the user considers that the processing of personal data infringes applicable legislation, they may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos – AEPD).

10. Information Security PG L&L CONSULTING will implement appropriate technical and organisational measures to protect personal data against loss, alteration, unauthorised access, disclosure or unlawful processing, taking into account the nature of the data, the risks involved and the state of the art. Access to personal data will be restricted to those individuals and service providers who require such access in order to perform the corresponding functions or services.

11. Data Relating to Minors Minors should only provide personal data where necessary for the provision of the service and in accordance with applicable legislation. Where information relating to minors is required under guest registration regulations, the legally required information will be collected. PG L&L CONSULTING will not knowingly use information relating to minors for marketing communications.

12. Automated Decision-Making and Profiling Unless expressly stated otherwise, PG L&L CONSULTING does not make decisions that produce legal effects or significantly affect users based solely on automated processing of their personal data.

13. Amendments to the Privacy Policy PG L&L CONSULTING may amend this Privacy Policy where necessary as a result of changes in legislation, technology or the services provided. The current version will be available on this website at all times.

Last updated: September 2026.