Privacy policy

Data controller

For anything concerning your data, write to that address or call the hotel and say it is about data protection.

What we process and why

Purpose	Data	Legal basis
Managing your booking and your stay	Name and surname, phone, email, dates, room and any requests you make	Performance of the accommodation contract (Art. 6.1.b GDPR)
Guest register and report to the authorities	Identification details, ID card or passport, date of birth, nationality, address, relationship for minors, and signature	Legal obligation: Spanish Royal Decree 933/2021 and Organic Law 4/2015 (Art. 6.1.c GDPR)
Payment and invoicing	Tax and payment details; card data is handled by the bank and the payment gateway, the hotel does not store it	Legal obligation and performance of the contract
Answering your calls and messages	Whatever you provide in your enquiry	Legitimate interest in answering enquiries (Art. 6.1.f GDPR)
Answering you in the website chat and preventing misuse of it	Whatever you type in the chat, the email address you give if you ask for a booking link, and the network you write from	Legitimate interest in answering enquiries and protecting the service (Art. 6.1.f GDPR)
Understanding which pages of the site are useful	Aggregated browsing data (pages viewed, source, device)	Your consent (Art. 6.1.a GDPR), which you may withdraw at any time
Sending you hotel offers, if you ask for them	Name and email	Your consent

Fields marked as required are needed for the stated purpose: without them the booking cannot be completed nor the guest register fulfilled.

Check-in and the guest register

Spanish public safety rules require every accommodation in Spain to collect the details of each person staying and report them to the authorities. This is not optional, for the hotel or for the guest. That is why check-in asks for the details of every person staying in each room, not just the person who booked.

The website assistant

The «Front desk» button on this site opens an automated assistant, not a person. It says so from its first line, and it says so again if you ask.

It can answer questions and check real prices and availability. It does not make the booking: when you want to book, it asks only for your email address and sends you a link so you can finish the booking yourself in the Mews engine. That way your personal details and your card go straight from you to Mews, without passing through the chat.

Do not type card details, identity documents or health data into the chat. None of it is needed for anything the assistant can do.

What you write in the chat is stored so that pending matters can be followed up, to improve the answers and to detect misuse of the service. It is kept for twelve months and then deleted. The network you write from is stored alongside it, truncated (for example 88.21.14.0), which is what makes it possible to stop anyone trying to overload the service.

The text of the conversation is processed by Google Ireland Ltd. as data processor, through its language model, in order to compose the reply. The email with the link is sent by the hotel's own mailbox.

If you would rather not use the assistant, write to info@pensionplayaterreros.com or call 923 72 04 84 and reception will help you just the same.

Who else sees your data

• Mews Systems s.r.o., the property management system where reservations and guest profiles live, acting as data processor.
• The competent authorities (National Police or Guardia Civil), for the guest report.
• Banks and payment gateways, to charge the stay.
• The channel you booked through (Booking.com, Expedia and similar), when the booking comes from one of them.
• Google Ireland Ltd., if you accept analytics or advertising cookies, and whenever you use the chat, to compose the assistant's replies.
• The tax authorities, where the law requires it.

Your data is never sold. Some providers may process data outside the European Economic Area; where that happens it relies on the European Commission's standard contractual clauses or an adequacy decision.

How long we keep it

• Booking and stay data: for the duration of the relationship and then blocked for the applicable limitation periods.
• Guest register: three years from the stay, as required by Royal Decree 933/2021.
• Invoicing and accounting: six years (Spanish Commercial Code) and four for tax purposes.
• Consent for marketing messages: until you withdraw it.
• Website chat conversations: twelve months.

Your rights

You may request access to your data, its rectification or erasure, restriction of processing, object to it and request portability. You may also withdraw any consent given, without affecting processing carried out beforehand.

Write to info@pensionplayaterreros.com or to the hotel's address, attaching a copy of an identity document. You will receive an answer within one month.

If you believe your rights have not been respected, you may lodge a complaint with the Spanish Data Protection Agency: aepd.es, C/ Jorge Juan 6, 28001 Madrid.

Security

Technical and organisational measures are in place: access limited to staff who need it, encrypted connections (HTTPS) and third-party systems with their own safeguards.

Cookies

Cookies and browser storage are explained in the cookie policy.

Last updated: 14 September 2026.