Privacy policy

At APM Holdings we process personal data transparently and only to the extent necessary. This policy explains what data we collect through this website and through our relationships with customers, suppliers and job applicants, what we use it for and what your rights are, in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).

1. Data controller

Controller: APM IMPULSE, S.L.U.
Tax ID (NIF): B30553978
Registration details: Mercantile Register of Murcia, volume 13410, folio 207, section 8, sheet MU-3325
Registered address: Calle Valle Guadalentín, 2, Edificio CNN, 1st floor, office 1, Polígono Industrial Marimingo, 30180 Bullas (Murcia), Spain
Telephone: +34 968 65 70 72
Data protection email: admin@apm.holdings

2. What data we process

This policy applies to apm.holdings and to the Gurú Stays accommodation website (stays.apm.holdings). Neither of them sends data to our servers through forms: the Gurú Stays request form only prepares a message that you decide to send us. We only process:

Direct communications: the data you give us when you email or call us.
Job applications: the data in your CV (identification, contact details, education and experience) when you send it to rrhh@apm.holdings.
Business relationships: the professional contact details of people who work for our customers and suppliers, and the data needed to manage orders, shipments, invoicing and payments.
Stays at Gurú Stays: the details of your request (name, dates, number of guests, chosen studio and comments) when you send it to us by WhatsApp, phone or email and, if the stay is confirmed, the data needed for payment and the identification details of all guests that the law requires us to register (such as full name, identity document, date of birth, nationality and contact details).
Browsing data: only if you accept statistics cookies, Google Analytics collects information about how the website is used (pages visited, device and browser type, approximate location). Google Analytics 4 does not store IP addresses.

If you give us data about other people, such as colleagues at your company, you must inform them beforehand.

3. Purposes and legal basis

Answering your enquiries. Legal basis: your consent, given when you contact us.
Managing your job application and considering it in the group's recruitment processes. Legal basis: your consent, given when you send us your CV.
Managing business relationships with customers and suppliers: orders, logistics, documentation, invoicing and collections. Legal basis: performance of the contract and compliance with legal obligations, such as tax, accounting, health and customs obligations.
Managing your Gurú Stays request and, where applicable, the booking and the stay. Legal basis: steps taken at your request prior to entering into a contract, and performance of the contract.
Guest registration at Gurú Stays: reporting guest details to the Spanish Ministry of the Interior. Legal basis: compliance with a legal obligation (Royal Decree 933/2021).
Keeping in touch with contact persons at customer, supplier or interested companies. Legal basis: our legitimate interest, under Article 19 of the LOPDGDD.
Obtaining website usage statistics. Legal basis: your consent, given when you accept statistics cookies, which you can withdraw at any time via “Manage cookies”.

We do not make automated decisions or create profiles with your data.

4. How long we keep data

Enquiries that do not lead to a business relationship: up to one year from the last communication.
Job applications: up to one year from receipt, unless you ask us to delete them earlier.
Stay requests that are not confirmed: up to one year from the last communication.
Guest registration: three years from the stay, as required by Royal Decree 933/2021.
Customers and suppliers: for as long as the business relationship lasts and, afterwards, for the legal retention and limitation periods. For example, six years for commercial records under Article 30 of the Spanish Commercial Code.
Browsing statistics: for the retention period configured in Google Analytics, up to a maximum of 14 months.

5. Who we share data with

We do not sell or transfer your data. We only share it when necessary:

To carry out a transaction: with the carriers, shipping lines, freight forwarders, cold stores, banks and insurers involved.
Where required by law: with the tax authorities, health and customs authorities, and courts.
Guest registration: with the Spanish Ministry of the Interior, through the official platform provided for this purpose, for Gurú Stays guests.
Service providers: our web hosting, email, IT and web analytics (Google Ireland Limited) providers access data only to provide their services to us, as data processors and with the safeguards required by the GDPR.

6. International transfers

Google Analytics may involve access to data from the United States by Google LLC, which is certified under the EU-U.S. Data Privacy Framework, covered by an adequacy decision of the European Commission. In addition, as an exporting group, when a transaction has its destination or origin outside the European Economic Area, we share with the parties involved in that country the data strictly necessary to carry it out, in accordance with Article 49(1)(b) GDPR. If you contact us via WhatsApp, that service is provided by WhatsApp Ireland Limited (Meta group), which processes data under its own privacy policy.

7. Your rights

You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent you have given, without affecting the lawfulness of prior processing. To do so, write to admin@apm.holdings or to our postal address, stating the right you wish to exercise. If we have reasonable doubts about your identity, we may ask for additional information to confirm it.

If you consider that we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

8. Security

We apply appropriate technical and organisational measures to protect your data, such as encrypted connections (HTTPS) across the whole website and restricted access to information.

9. Minors

This website is aimed at professionals and businesses. We do not knowingly collect data from children under 14.

10. Changes to this policy

We may update this policy to reflect legal changes or changes in our activity. The current version will always be published on this page. Please also see our legal notice and our cookie policy.

Last updated: October 2026.