PRIVACY POLICY — ALDATSEA DIGITAL CHECK-IN

During check-in, identification, contact, residence, and stay data necessary to manage accommodation and comply with applicable legal obligations are processed. This includes data and images of identity documents (National ID, passport, or others).

No facial recognition or any other biometric processing is performed. The document image is used solely to extract the text data it contains.

If traveling with minors, their details are also registered, which must be provided by their parent or legal guardian.

Data is processed to:

• Manage check-in and your stay, on the basis of contract performance or pre-contractual measures (Art. 6.1.b GDPR).
• Comply with the legal obligation to report traveller details to the competent authorities, pursuant to Royal Decree 933/2021, of 26 October, establishing documentary registration and information obligations for natural or legal persons engaged in lodging and motor vehicle rental activities (Art. 6.1.c GDPR).
• Verify identity document information when necessary for the above purposes.

Legally required data is necessary to comply with applicable obligations. If not provided, it will not be possible to complete the check-in.

Your data is not used for commercial purposes, profiling, or to make automated decisions producing legal effects concerning you.

Competent authorities. Data required by regulations is reported to the Ministry of the Interior via the SES.Hospedajes system.

Data processors. To provide the service, providers are used who process data on behalf of the controller under a corresponding data processing agreement:

• Google Cloud (artificial intelligence service, configured in a European Union region): assists in reading information from identity documents. According to verified configuration, submitted content is not cached or retained as content of requests and responses.
• Cloudflare: manages domain DNS. Check-in traffic does not pass through its proxy network: traveller connections reach the Hetzner server directly.
• Hetzner Online GmbH (Germany): hosts the check-in application and data, with servers in the European Union.

Document processing takes place in a European region. However, Google is a US-headquartered company, so data access or transfer to that country may occur. These transfers are covered by the EU-US Data Privacy Framework (European Commission adequacy decision) or, in its absence, standard contractual clauses approved by the European Commission.

Check-in data is deleted from the Aldatsea application within a maximum period of 24 hours from the confirmation of its successful transmission to SES.Hospedajes. If the transmission fails, data will be retained only for the time necessary to complete it.

This deletion affects only data stored in the Aldatsea application. It does not affect data already reported to SES.Hospedajes, the retention of which corresponds to the Public Administration according to applicable law.

Document images are processed temporarily and the application does not store them on disk.

Appropriate technical and organizational measures are applied to protect personal data against unauthorized access, loss, alteration, or misuse, including communications encryption (HTTPS), restricted access to data, and automatic deletion following transmission to SES.Hospedajes.

You may exercise your rights of access, rectification, erasure, objection, restriction of processing, and portability, where applicable, by writing to the email address indicated in Section 1. We will respond within a maximum period of one month.

Please note that certain rights may be limited when processing is necessary to comply with a legal obligation, such as reporting traveller data to the authorities.

You may also lodge a complaint with the Spanish Data Protection Agency (AEPD): https://www.aepd.es/

This policy may be updated when required by regulatory changes or modifications in data processing activities. The applicable version will always be the one published during check-in, with its corresponding update date.