Information for guests

This page explains how your personal data is handled when you book directly, complete online check-in or register as a traveller at a property that uses TuGuardés. It is a translation for your convenience; if there is any discrepancy, the Spanish version prevails.

1. Controller

The owner of the property where you are staying. To exercise your rights or ask any question, contact them using the details shown in the check-in form or in your booking confirmation.

2. What data is processed

When you book: the lead guest's name and surnames, email, phone, country, optional comments, dates, number of adults and of children by age band (no dates of birth), price, payment method and the terms you accepted. The property uses this data to process your booking, keep you informed of its status, handle cancellations and refunds, and make check-in easier. The contract and payments are between you and the owner; TuGuardés does not issue the accommodation invoice.

The data required by Spanish traveller-registration rules: name and surnames, sex, date of birth and nationality; type and number of identity document and, where applicable, the document support number; address, phone and email; arrival and departure dates, number of travellers and, where the law requires it, the relationship between them; and the booking and payment-method details required by law (never the full card number).

3. Purpose

To register your stay and report your data to the authorities, as Spanish law requires of accommodation providers. It is not used for advertising or shared for commercial purposes.

4. Legal basis

To process and manage your booking: performance of the contract, or steps you request before entering into it (Article 6(1)(b) GDPR). Accepting the booking terms does not mean consenting to marketing.

Compliance with a legal obligation (Article 6(1)(c) GDPR), set out in Article 25 of Spanish Organic Law 4/2015 on the protection of public safety and in Royal Decree 933/2021. Providing this data is mandatory: without it the stay cannot go ahead.

5. Recipients

• The Spanish Ministry of the Interior, through the SES.Hospedajes platform, and the law-enforcement authorities. The courts and the public prosecutor may also have access. The property submits the report to SES.Hospedajes immediately and, at the latest, within 24 hours of your arrival.
• TuGuardés, as processor, which stores your data, with your identity document encrypted, on servers in the European Union (Cloudflare, EU jurisdiction) and prepares the report file for the property. Its service providers are listed in the privacy policy (in Spanish).

If you choose to pay by card, you enter your card details on the payment page hosted by Stripe. The charge goes directly to the owner's Stripe account. TuGuardés keeps the identifiers and statuses of payments and refunds, but never receives or stores your card number or security code. For a deposit plus balance, and only with your express authorisation, Stripe stores the payment method and the remaining amount is requested on the date shown before you book. Your bank may ask for further authentication through your private link.

6. Retention

Booking data is kept while your stay is managed and for as long as the property's contractual or legal obligations require. The booking-management link expires 90 days after check-out. The owner can export their data; if they close their account, TuGuardés deletes it after 30 days. The owner must keep outside the platform whatever their own obligations require.

Traveller-registration data is kept for three years after the end of your stay, in accordance with Article 5.3 of Royal Decree 933/2021, and then deleted.

7. Your rights

You can exercise your rights of access, rectification, erasure, objection and restriction with the property. Some rights, such as erasure, may be limited while there is a legal obligation to keep the data. If you write to TuGuardés ([email protected]), we will forward your request to the property so they can handle it. If you believe your rights have not been respected, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

8. More information

The booking form uses Cloudflare Turnstile to prevent automated requests: a security check is validated on the server together with the IP address and hostname. Rate limits store a cryptographic summary of the IP address, which is not written to the logs. The public form does not use session cookies or store booking data on your device. The booking-management link is confidential: anyone who has it can view and cancel that booking.

The relationship between the property and TuGuardés is governed by the data processing agreement (in Spanish). The check-in form does not use cookies or local storage in your browser; the code in your link is not sent to the server in the address (see the cookie policy, in Spanish).

Contract and payment

Your contract is with the owner of the property, who is the merchant and receives the charges in their Stripe account. TuGuardés provides the technology. If you choose a deposit, your acceptance of the remaining amount and its date is recorded; your bank may ask for authentication. An expired link to pay the balance does not cancel a confirmed booking: both parties are notified. To prepare the payment, your name, email, booking reference, amount and transaction metadata are sent to Stripe in the owner's account. Card details are entered directly with Stripe. The confirmation is not an invoice.

More about the providers: Turnstile privacy and Stripe privacy.