Due to the entry into force of the General Data Protection Regulation 2016/679 (GDPR) and Organic Law 3/2018, on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), this privacy policy has been updated. Below, you will find information related to the data processing carried out by RURAL CANTÁBRICO DE HOSTELERÍA, S.L.
- DATA CONTROLLER
The Data Controller is the owner of this website, whose full details are available in the Legal Notice. - NOTICE, POLICY, AND SECURITY MEASURES
The Data Controller, taking into account the nature, scope, context, and purposes of the processing, has implemented all necessary technical and organizational measures to ensure compliance with data protection regulations. This is in accordance with the provisions of Articles 24 et seq. of the General Data Protection Regulation and Article 28 of Organic Law 3/2018.
Likewise, the application of appropriate security measures to the processing of personal data, as required by applicable regulations, is guaranteed to ensure full compliance.
- DATA CATEGORY, PURPOSE, AND LEGAL BASIS FOR PROCESSING.
This website uses the following forms to collect different types of data, depending on the purpose:
Contact form: identification, contact, and other data that the user may provide. This data will be used to respond to inquiries.
Registration form: identification, contact, billing, payment, commercial, and service data. This data will be used to create a user account that allows you to access the functionalities of our website as a client, and thus enable us to provide you with the services offered. Also for administrative management purposes and after-sales and customer loyalty services.
Content subscription form: contact information. This will be used for the periodic sending of newsletters and other information requested by the user.
Reservation form: identification and contact information. This will be used for making, modifying, or canceling reservations.
Promotions or raffles: identification and contact information. This will be used for conducting raffles and communicating with the winners, as indicated in the specific terms and conditions of each promotion.
The legal basis for this processing is the informed and freely given consent that the user must provide before submitting any information through the form. This consent may be withdrawn at any time without affecting processing carried out previously. Other processing may also be carried out based on compliance with legal obligations or contractual performance, as applicable.
In addition, the website may obtain information through cookies (see cookie policy).
- SOURCE AND CATEGORIES OF THE DATA PROCESSED.
Personal data is obtained directly from the data subject. If, in any case, data is obtained from other sources, appropriate information will be provided regarding its origin, as well as the categories of data involved.
- DATA RETENTION PERIOD.
The data will be retained for as long as necessary to carry out the entrusted procedures and tasks, as well as to fulfill the other purposes for which it was collected, and in all cases, taking into account the legally required time limits.
Once the data is no longer active, it will be deleted or, if necessary, blocked, remaining accessible only to Judges and Courts, the Public Prosecutor’s Office, or the competent Public Administrations for the enforcement of any potential liabilities arising from the processing, during the applicable statute of limitations. Once this second period has expired, the data will then be destroyed. All of this will be done, where applicable, in compliance with Article 32 of the LOPDGDD (Spanish Organic Law on the Protection of Personal Data and Guarantee of Digital Rights). - RECIPIENTS: DATA TRANSFERS AND INTERNATIONAL TRANSFERS.
Data transfers are not contemplated, except when necessary for compliance with a legal provision or for the performance of a contract.
Data processors who perform services on behalf of the controller may have access to your personal data; that is, those service providers who need access to your personal data for the functional or operational development of the service to be offered.
Furthermore, international data transfers are not contemplated. Should such transfers occur, they will be carried out with the necessary authorization and requirements. - SOCIAL NETWORKS.
The data of friends or followers on social networks may be processed by the data controller to interact with them and keep them informed of its activities, services, and promotions. This data will be processed based on the legal grounds of their consent and will be kept as long as they remain a “friend” or “follower.” They may revoke their consent at any time, without this affecting the lawfulness of the processing carried out previously. Providing data for this purpose is voluntary; however, if they do not provide it, they will not be able to be a “friend” or “follower” on the platforms or media where the data controller operates.
Furthermore, if this website offers a user registration option and allows registration via social networks, the personal data specifically processed for this purpose will come from the relevant social network, to which the user will have previously provided said data for the purposes outlined in its corresponding privacy policies. The categories of data processed and collected from the relevant social network would be those listed in the registration form itself and those relating to the data you have provided to said social network. If, in order to register on this website, additional data beyond that provided by the social network is required, this data will be requested and must be completed separately in the registration form, subject to its applicable privacy policies.
- MINORS.
Minors may not use the services available through this website without the prior authorization of their parents or legal guardians, who will be solely responsible for all actions taken through this website by such minors under their care, including completing any forms that may exist and, where applicable, checking the corresponding boxes.
Regarding the specific matter of personal data protection, and in accordance with Articles 8 of the GDPR and 7 of the LOPDGDD, only individuals over the age of fourteen may lawfully consent to the processing of their personal data. For individuals under fourteen years of age, the consent of their parents or guardians, as their legal representatives, is required for processing, and such processing will only be considered lawful to the extent that they have authorized it. Under no circumstances will data related to the professional or financial situation, or the privacy of other family members, be obtained from a minor without the prior consent of the latter.
- RIGHTS AND ADDITIONAL INFORMATION ON DATA PROTECTION.
The data subject has the right to obtain confirmation as to whether RURAL CANTÁBRICO DE HOSTELERÍA, S.L. processes personal data concerning him or her, as well as the right to access his or her personal data, request the rectification of inaccurate data, or, where appropriate, request its erasure when, among other reasons, the data is no longer necessary for the purposes for which it was collected.
In certain circumstances, the data subject may request the restriction of the processing of his or her data, in which case it will only be retained for the exercise or defense against possible legal claims.
Likewise, in certain circumstances and for reasons related to his or her particular situation, the data subject may object to the processing of his or her data. RURAL CANTÁBRICO DE HOSTELERÍA, S.L. will cease processing the data, except for compelling legitimate grounds, or for the exercise or defense against possible legal claims. Similarly, the data subject has the right to data portability where technically feasible and in certain circumstances.
Furthermore, any previously given consent may be withdrawn at any time.
On the other hand, and where applicable, the data subject has the right not to be subject to decisions based solely on the automated processing of their data, including profiling. In such hypothetical cases where such processing and decision-making take place, the data subject would be duly informed accordingly.
The data subject may raise any questions they deem relevant regarding this policy, obtain additional information on data protection, and exercise their rights as legally provided. To do so, they must send a communication to: RURAL CANTÁBRICO DE HOSTELERÍA, S.L., C/ Aguirre, 3 bajo (28009 Madrid) or by email to: direccion@pazodatrave.com, indicating the corresponding request and attaching a copy of their national identity document or other document proving their identity and entitling them to exercise their rights. If you are acting through a representative, you must also provide a copy of the represented party’s ID (or equivalent document) and documentation proving the representative’s authority to act on your behalf.
You can obtain the forms for exercising your various data protection rights on the website of the Spanish Data Protection Agency (AEPD). You can also obtain these forms directly from the AEPD itself.
If you believe your rights have not been properly addressed, you may file a complaint with the Spanish Data Protection Agency: www.aepd.es.
Updated: April 2026