Your information,
with a clear purpose.

Controller and contact

NEXO APEX, S.L., NIF B55467146. Edificio Camí Reial, c/ Camí Reial, 13-17, 3a planta, 43700 El Vendrell, Spain. david@nexoapex.com.

The information we use

Host enquiries include the contact details, property information, dates and requirements you provide. Portal accounts include an email address, a hashed password and account type. We also process listings, photographs, addresses, registration details, bids and access or payment references when you use those features.

We use this information to respond, manage your account, display listings, control subscriber access, process bids and provide support. Do not send identity documents, health information or card numbers through forms or messages.

The contact form collects your email, optional name, subject, message, language, submission date and privacy acknowledgement. We use them to respond and handle your enquiry; the form does not subscribe you to advertising.

Host enquiries require a phone number with its international country code. You can separately allow phone calls and WhatsApp messages about your proposal; both choices start unchecked. We store your choices, their date and the wording version. If you do not allow these channels, we use email. You can withdraw either permission by contacting us above; these choices do not subscribe you to advertising. WhatsApp privacy policy.

Private proposals can offer an overnight stay, an eclipse viewing space without accommodation, or both. We collect the exact address, description, capacity, amenities, availability and local times, indicative price, rules, cancellation terms, access and safety details, registration status, photos and captions. These details let us review the proposal and prepare a future listing. Proposals and photos are not published automatically. Our team receives an email with the details and temporary links to the private photos. Upload only images you have permission to use and avoid unnecessary personal details or identifiable people.

Public and restricted information

Photos, descriptions, the general area and required registration information on a published listing can be public. Exact addresses and prices are restricted to subscribers and the owner. At bidding close, the host and winning guest receive each other’s email address for direct contact. Interest enquiries are not automatically published.

Paid waitlist and review order

We store your email and the preferences you provide: name, country of origin, preferred destination, stay dates, budget, languages, accommodation type, group size and notes. We record the selected amount, payment references and status, confirmation time, refunds or disputes, accepted terms and version, early-review request and review status. Stripe handles payment details; we do not receive your card number.

We use confirmed net payment to order the initial review queue, highest first. Ties use the earliest confirmed payment. Earlier free registrations retain their original date. This order organises our work; it does not decide accommodation allocation or bid ranking. Contact us to correct your details or review an ordering error.

Service emails and opening updates

We send payment confirmation and the purchased review, as well as necessary account, security, billing or bidding emails. Unsubscribe from opening updates using the email link or contact us. Unsubscribing does not itself request a refund or stop messages needed to deliver the purchased service. To withdraw from the paid waitlist or request a refund, use the contact above.

Legal basis

Paid enrollment, requirements review, necessary service notices, requested enquiries and the portal contract rely on GDPR Article 6(1)(b); legal and accounting obligations on Article 6(1)(c); and security and abuse prevention on legitimate interests under Article 6(1)(f). Opening updates for earlier free registrations and optional analytics rely on consent under Article 6(1)(a), which you can withdraw. Accepting service terms does not consent to advertising.

Providers and payments

Authorised staff and necessary hosting, form, storage and email providers may process information to deliver the service. Amazon Web Services (AWS) provides hosting, storage and processing through S3, DynamoDB and Lambda; SES sends account and waitlist emails. Stripe processes waitlist, listing and access charges and their billing details. Cloudflare Turnstile checks forms to prevent abuse. If you accept analytics, Google Analytics measures website usage. NEXO APEX does not receive your card number or process accommodation payments.

We do not sell personal data. Transfers outside the EEA require the applicable GDPR safeguards. Contact us for the current providers and transfer safeguards. AWS, Stripe, Cloudflare, Google.

Retention

Ordinary enquiries without a contract and waitlist preferences will be deleted by 30 September 2027 unless a legal duty or dispute requires retention. Payment, terms-acceptance, review and refund records are retained during the service and for applicable tax and claims requirements. Billing, refund and privacy-rights enquiries are kept as needed to resolve them and meet applicable duties. You can request deletion; we will explain any required retention.

Temporary photo uploads are scheduled for deletion after two days. Private copies saved with a proposal are scheduled for deletion from 1 October 2027. Automatic storage deletion can take a few days to complete. You can request earlier deletion of your proposal and photos.

Cookies and your browser

The essential session cookie keeps you signed in for up to 30 days and is cleared on sign-out. Turnstile protects forms against abuse. We store your cookie choice in your browser and in a cookie for one year. Google Analytics loads only if you accept analytics; reject it or withdraw consent through “Cookie settings” in the footer. We do not use personalised advertising. Analytics cookies _ga and _ga_* have a default duration of two years, which your browser may limit.

Your rights

You can request access, correction, deletion, restriction, portability or object where applicable by contacting us above. You may complain to the Spanish Data Protection Agency or your competent supervisory authority. AEPD.