PRIVACY POLICY

Last updated: September 2026

This Privacy Policy explains how the personal data of users, customers and guests of Hostal Rosell Boutique are collected, used and protected in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights, and any other applicable regulations.

1. DATA CONTROLLER

The controller responsible for processing personal data is:

Owner: H. Vergero C.B.
Trading name: Hostal Rosell Boutique
Tax Identification Number (NIF): E16506446
Address: Carrer de Rosell, 4, 07820 Sant Antoni de Portmany, Illes Balears, Spain
Telephone: +34 600 02 88 17
Email: hostalrosell@gmail.com
Website: https://www.hostalrosell.com

2. PERSONAL DATA WE MAY PROCESS

Depending on the relationship maintained with the user or guest, Hostal Rosell Boutique may process identification and contact data such as name, surname, identity document, nationality, date of birth, address, telephone number and email address.

We may also process information relating to the booking and stay, such as arrival and departure dates, number of guests, room type, requests or preferences relating to the stay and booking reference.

Where necessary, billing information and data relating to transactions or payment methods may also be processed. Data strictly necessary to process certain payments may be processed directly by financial institutions or payment service providers.

Technical and browsing data may also be processed when users access the website, in accordance with our Cookie Policy.

When users contact us through forms, email, telephone, WhatsApp, social media or other available channels, we may process the information contained in those communications in order to manage and respond to their requests.

Data may be provided directly by the data subject or, in certain cases, may come from booking platforms, travel agencies, intermediaries or other persons who have legitimately made a booking on behalf of the guest.

3. PURPOSES OF PROCESSING AND LEGAL BASIS

Booking and stay management

We process the data necessary to manage availability requests, quotations, bookings, modifications, cancellations, payments, check-in, stays, check-out and other services related to accommodation.

The legal basis is the implementation of pre-contractual measures requested by the data subject and the performance of the accommodation contract.

Handling enquiries and requests

We process the information provided in order to respond to enquiries, requests for information, special requests, incidents or communications made by the user.

The legal basis will be the implementation of pre-contractual measures, performance of the contractual relationship or, where applicable, our legitimate interest in appropriately handling and managing communications relating to our activity.

Compliance with legal obligations

We process certain data when necessary to comply with legal obligations applicable to the establishment's activity, including tax, accounting and administrative obligations and those relating to the registration and communication of traveller information.

In particular, Hostal Rosell Boutique is subject to the obligations established by Spanish Royal Decree 933/2021 of 26 October concerning documentary registration and the communication of information by persons carrying out accommodation activities.

The legal basis for this processing is compliance with a legal obligation.

Payment, invoicing and accounting management

The necessary data may be used to manage payments, deposits, refunds, invoices and accounting and tax obligations associated with the booking or stay.

The legal basis is the performance of the contract and compliance with applicable legal obligations.

Communications relating to bookings

We may contact guests by email, telephone, SMS, WhatsApp or other means they have provided in order to send necessary information relating to their booking or stay, such as confirmations, arrival instructions, payment requests, check-in information or service communications.

These communications form part of the management of the booking and are not considered advertising or marketing communications.

The legal basis is the performance of the contract or the implementation of pre-contractual measures.

Marketing communications

Where the user has given consent, we may send commercial information about news, promotions, offers or services from Hostal Rosell Boutique.

The user may withdraw consent at any time using the unsubscribe mechanism included in the communication or by writing to hostalrosell@gmail.com.

The withdrawal of consent will not affect the lawfulness of processing carried out before its withdrawal.

Statistics and service improvement

We may use internal information to produce statistics, analyse the operation of our services and improve the customer experience.

Where such processing is based on information linked to an identifiable individual, it will be carried out on the basis of our legitimate interest, provided that the rights and freedoms of the data subject do not prevail.

Processing derived from analytical cookies or other technologies requiring consent will only take place where the user has provided such consent.

Security and defence of rights

We may process data where necessary to prevent fraudulent use, protect our systems, manage claims or exercise or defend our rights.

The legal basis will be our legitimate interest in protecting our activity and our rights and, where applicable, compliance with legal obligations.

4. DATA RETENTION

Personal data will be retained for the time necessary to fulfil the purpose for which they were collected and subsequently for the periods required by applicable legislation or for the time necessary to address potential liabilities.

Data relating to bookings, invoicing and contractual relationships may be retained for the applicable statutory periods under tax, commercial, contractual and administrative legislation.

Data included in the mandatory documentary register for accommodation activities will be retained for the legally established period, currently three years from the end of the accommodation service, in accordance with Spanish Royal Decree 933/2021.

Data used for marketing communications will be retained until the data subject withdraws consent or requests to stop receiving such communications.

Data relating to enquiries or requests will be retained for the time necessary to deal with them and subsequently for the period required to address any potential liabilities.

Once the corresponding periods have expired, the data will be deleted or, where legally required, blocked for the periods established by applicable regulations.

5. RECIPIENTS OF PERSONAL DATA

Personal data will not be sold to third parties.

However, data may be disclosed or made available to third parties where necessary to manage a booking, provide contracted services or comply with a legal obligation.

Such recipients may include:

• Public authorities, law enforcement bodies and other authorities where there is a legal obligation.
• Financial institutions, banks and payment service or payment platform providers.
• Booking engine providers, hotel management systems, web hosting, email, information technology, technical support and other services necessary for our activity.
• Tax, accounting, legal or other professional advisers where necessary.
• Booking platforms, travel agencies or intermediaries where the booking is managed through those channels.

Where a provider processes personal data on behalf of Hostal Rosell Boutique, it will act as a data processor and will be subject to the contractual and confidentiality obligations required by data protection legislation.

6. INTERNATIONAL DATA TRANSFERS

Some technology providers used to provide our services may be located outside the European Economic Area or may process information outside it.

Where international transfers of personal data take place, they will only be carried out where there is a valid legal basis and the safeguards required by the GDPR are applied, such as an adequacy decision by the European Commission, Standard Contractual Clauses or other legally recognised mechanisms.

7. GOOGLE USER DATA AND GOOGLE PEOPLE API

Certain functionalities used by Hostal Rosell Boutique may connect to Google services through the Google People API.

Where the user expressly authorises this connection, the application may access only the permissions and data necessary to provide the requested functionality.

The application may access:

Existing contacts: to consult the contact list and check whether a person already exists, thereby avoiding duplicate contacts.

Data required to create contacts: name, email address and telephone number where provided.

Access to these data is used solely to automate the management and creation of contacts in Google Contacts and to avoid duplicates.

Data obtained through Google APIs are not used for personalised advertising, advertising profiling, sale of data, training artificial intelligence models or any purpose other than those expressly described in this policy.

Google data will not be shared with third parties except where strictly necessary to provide the requested functionality, ensure service security, comply with a legal obligation or where the user has expressly authorised such disclosure.

Access to and processing of these data will be limited to the time necessary to provide the corresponding functionality and, where applicable, comply with relevant legal obligations.

Users may revoke permissions from the security settings of their Google account and may request deletion of data relating to this integration by writing to hostalrosell@gmail.com.

Information received from Google APIs is used in accordance with the Google API Services User Data Policy, including its Limited Use requirements where applicable.

8. DATA SUBJECT RIGHTS

Users may exercise the rights recognised by data protection legislation at any time.

They may request access to their personal data, rectification of inaccurate data, erasure where appropriate, restriction of processing, objection to processing and data portability where applicable.

Where processing is based on consent, consent may be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal.

To exercise these rights, users may contact:

H. Vergero C.B. — Hostal Rosell Boutique
Carrer de Rosell, 4
07820 Sant Antoni de Portmany
Illes Balears, Spain
Email: hostalrosell@gmail.com

The request must allow the data subject to be properly identified and must specify the right they wish to exercise. Where necessary to verify the identity of the applicant, additional information or documentation may be requested, limited to what is strictly necessary for that verification.

If the user believes that the processing of personal data does not comply with applicable legislation, a complaint may be lodged with the Spanish Data Protection Agency (AEPD) through www.aepd.es.

9. MANDATORY NATURE OF CERTAIN DATA

Fields marked as mandatory in forms are necessary in order to manage the corresponding request, booking or service.

If the user does not provide the necessary data, Hostal Rosell Boutique may be unable to process the request, complete the booking or provide certain services.

Requested data that are not identified as mandatory are voluntary.

The user guarantees that the data provided are accurate, complete and up to date and undertakes to communicate any relevant changes.

Where a person provides personal data relating to third parties, they must have sufficient legal grounds to do so and, where appropriate, must have previously informed those persons.

10. AUTOMATED DECISION-MAKING

Hostal Rosell Boutique does not make decisions based solely on automated processing that produce legal effects concerning users or similarly significantly affect them, unless expressly stated otherwise and there is a legal basis permitting such processing.

11. DATA SECURITY

Hostal Rosell Boutique applies appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss or alteration, as well as against unauthorised access, disclosure or processing.

The measures applied are determined taking into account the nature of the data processed, the existing risks, the state of the art and the characteristics of the processing.

However, no system connected to the Internet can guarantee absolute security, and protection measures are therefore reviewed and updated where necessary.

12. CHANGES TO THIS PRIVACY POLICY

Hostal Rosell Boutique may update this Privacy Policy where necessary as a result of legislative changes, modifications to data processing activities or the incorporation of new services or providers.

The current version will be the version published on the website and will indicate the date of its latest update.