Privacy policy
1. Data controller
Controller: Jon Bergerandi Loidi
Tax ID (NIF): 44333908M
Address: Herrikobarra 1, 20800 Zarautz (Gipuzkoa), Spain
Phone: +34 608 06 22 14
Email: [email protected]
2. What data we process
When you book: first name and surname, email, phone number, country, dates of stay, number of guests and the details needed for payment.
When you contact us through the form, by email or on WhatsApp: your name, contact details and the content of your message.
Guest registration: the identity data that accommodation providers are legally required to collect (identity document, date of birth, nationality and any other data required).
3. Why we process it and on what legal basis
Managing your booking and stay: performance of the accommodation contract (Art. 6(1)(b) GDPR).
Answering your enquiries: your consent and steps taken at your request before entering into a contract (Art. 6(1)(a) and 6(1)(b) GDPR).
Guest registration and reporting to the authorities, as well as invoicing and tax obligations: compliance with legal obligations (Art. 6(1)(c) GDPR).
Protecting the forms against spam and abuse: legitimate interest in the security of the website (Art. 6(1)(f) GDPR).
Your data are not used to send advertising or to make automated decisions.
4. How long we keep it
For as long as our relationship lasts and, afterwards, for the periods required by law: three years for guest registration records and the periods set by tax legislation for invoices. Enquiries that do not lead to a booking are kept for as long as needed to answer them and for no more than one year.
5. Who we share it with
Data are not disclosed to third parties except where required by law (for example, to the law enforcement authorities for guest registration or to the Gipuzkoa Provincial Tax Office). To provide the service we rely on the following providers, who process data on the controller's behalf:
Lodgify: website and booking management.
Stripe: payment processing.
Chekin: guest registration.
Google: protection of the contact form (reCAPTCHA).
Some of these providers may process data outside the European Economic Area; in that case they do so with the safeguards provided for in the GDPR, such as the European Commission's standard contractual clauses. If you book through Booking.com, Airbnb or another platform, that platform processes your data under its own privacy policy.
6. Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent at any time, by writing to [email protected] and stating which right you wish to exercise. If you believe your request has not been properly handled, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
7. Changes to this policy
This policy may be updated to reflect changes in the law or in the service. In the event of any discrepancy between versions, the Spanish version shall prevail. Last updated: September 2026.
