Privacy policy

Data controller

For anything concerning your data, write to that address or call the hotel and say it is about data protection.

What we process and why

Purpose	Data	Legal basis
Managing your booking and your stay	Name and surname, phone, email, dates, room and any requests you make	Performance of the accommodation contract (Art. 6.1.b GDPR)
Guest register and report to the authorities	Identification details, ID card or passport, date of birth, nationality, address, relationship for minors, and signature	Legal obligation: Spanish Royal Decree 933/2021 and Organic Law 4/2015 (Art. 6.1.c GDPR)
Payment and invoicing	Tax and payment details; card data is handled by the bank and the payment gateway, the hotel does not store it	Legal obligation and performance of the contract
Answering your calls and messages	Whatever you provide in your enquiry	Legitimate interest in answering enquiries (Art. 6.1.f GDPR)
Understanding which pages of the site are useful	Aggregated browsing data (pages viewed, source, device)	Your consent (Art. 6.1.a GDPR), which you may withdraw at any time
Sending you hotel offers, if you ask for them	Name and email	Your consent

Fields marked as required are needed for the stated purpose: without them the booking cannot be completed nor the guest register fulfilled.

Check-in and the guest register

Spanish public safety rules require every accommodation in Spain to collect the details of each person staying and report them to the authorities. This is not optional, for the hotel or for the guest. That is why check-in asks for the details of every person staying in each room, not just the person who booked.

Who else sees your data

• Mews Systems s.r.o., the property management system where reservations and guest profiles live, acting as data processor.
• The competent authorities (National Police or Guardia Civil), for the guest report.
• Banks and payment gateways, to charge the stay.
• The channel you booked through (Booking.com, Expedia and similar), when the booking comes from one of them.
• Google Ireland Ltd., if you accept analytics or advertising cookies.
• The tax authorities, where the law requires it.

Your data is never sold. Some providers may process data outside the European Economic Area; where that happens it relies on the European Commission's standard contractual clauses or an adequacy decision.

How long we keep it

• Booking and stay data: for the duration of the relationship and then blocked for the applicable limitation periods.
• Guest register: three years from the stay, as required by Royal Decree 933/2021.
• Invoicing and accounting: six years (Spanish Commercial Code) and four for tax purposes.
• Consent for marketing messages: until you withdraw it.

Your rights

You may request access to your data, its rectification or erasure, restriction of processing, object to it and request portability. You may also withdraw any consent given, without affecting processing carried out beforehand.

Write to info@pensionplayaterreros.com or to the hotel's address, attaching a copy of an identity document. You will receive an answer within one month.

If you believe your rights have not been respected, you may lodge a complaint with the Spanish Data Protection Agency: aepd.es, C/ Jorge Juan 6, 28001 Madrid.

Security

Technical and organisational measures are in place: access limited to staff who need it, encrypted connections (HTTPS) and third-party systems with their own safeguards.

Cookies

Cookies and browser storage are explained in the cookie policy.

Last updated: 14 September 2026.