Arume Rural House

Privacy policy

This page explains what personal data we handle when you book or browse casaarume.com, what we use it for, who else sees it, how long we keep it and what you can ask of us.

1. Who is responsible for your data

Data controller: Dintea Capital, S.L., the company that operates the rural guest house Arume Rural House.

Given the size and nature of the business we are not required to appoint a data protection officer. The controller answers data protection questions directly, at the address above.

The applicable law is Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the protection of personal data and the guarantee of digital rights (LOPDGDD).

2. What data we handle

Identification and contact. Name and surname, postal address, telephone, email and the language you write to us in.

Booking data. Room, arrival and departure dates, number of guests, booking number, amount and any request you make when booking.

Guest register. Spanish law requires us to record and report to the Ministry of the Interior the details of everyone who stays: name and surnames, sex, type and number of the identity document, date of issue, date of birth, nationality, place of residence, telephone, email, arrival and departure dates and, where a minor is travelling, their relationship to the adult. This is Royal Decree 933/2021. We do not ask for or keep a copy or photograph of your document: the rule requires the data to be recorded, not the document to be kept, and holding copies we do not need would run against data protection law.

Payments. The charge is processed by our payment provider. We see the amount, the date, the outcome and the last four digits of the card; we never store the full card number or its security code. If you tick the box to save your card, it is the payment provider that holds it, not us.

Allergies and dietary needs. Only if you tell us, so that we can get your breakfast right. This is health data and we handle it solely with your consent; we delete it when your stay ends.

Browsing. IP address, device and browser type, and the technical cookies needed for the basket, your account and the language you choose.

Other than the allergies you choose to tell us about, we do not handle special categories of data: no ethnic origin, no political or religious views, no trade union membership, no sex life.

3. What we use it for, and on what legal basis

Managing your booking and your stay — confirming it, charging it, sending you the arrival instructions and looking after you while you are here. Legal basis: performance of the contract.

Meeting legal obligations — reporting the guest register to the Ministry of the Interior, issuing and keeping invoices and meeting tax and accounting duties. Legal basis: legal obligation.

Answering your questions through the contact form or by email. Legal basis: performance of the contract or, if you have not booked yet, our legitimate interest in replying to people who write to us.

Security and fraud prevention — protecting the site and detecting fraudulent payments. Legal basis: legitimate interest.

Allergies and special requests. Legal basis: your consent.

We do not send marketing emails or a newsletter. If we ever do, it will be with your prior consent and you will be able to unsubscribe at any time.

4. Who else sees your data

  • The Spanish Ministry of the Interior, through the SES.HOSPEDAJES platform, because Royal Decree 933/2021 requires it.
  • Our payment provider, which processes the charge and holds the card details. Part of that processing may involve an international transfer, covered by the standard contractual clauses approved by the European Commission.
  • IONOS, which provides the voice assistant that answers one of our phone numbers, on the terms set out in section 5.
  • Dinahosting S.L., the Spanish company that hosts the website, with servers located in Spain.
  • Our bank and our accountants, for payment, invoicing and tax purposes.
  • Public authorities and the courts, where the law obliges us to hand data over.

We do not sell your data and we do not pass it to anyone for advertising. Those who handle it on our behalf are contractually required to use it only on our instructions.

5. If you call us: the voice assistant

One of our numbers, +34 941 68 93 56, is answered by an AI voice assistant: the IONOS AI Receptionist service, which processes the content of the conversation on our instructions in order to answer, take note or alert us. The system uses automatic speech recognition, language analysis and, where applicable, speech generation.

The conversation may be recorded or transcribed. If so, you are told at the start of the call and you may hang up at any time to avoid it: you can also write to info@casaarume.com, which we read and answer ourselves.

During the call we process what you say, the technical connection data — date, time and duration —, any details you give voluntarily, such as your name or phone number, and the interaction data needed to carry the conversation.

The legal basis is Article 6(1)(b) GDPR where the call serves to prepare or perform your booking, and Article 6(1)(f), our legitimate interest in handling calls efficiently, in all other cases.

To provide the service, IONOS uses sub-processors, mainly for hosting, speech recognition and language analysis, which may process data in the United States. Those transfers rely on the adequacy decision under Article 45 GDPR where the provider is certified under the EU–US Data Privacy Framework and, failing that, on standard contractual clauses under Article 46(2)(c), with additional safeguards. The requirements of Article 44 are met.

Pseudonymised data may be used for training purposes to improve the system, in such a way that tracing it back to an individual is impossible or very difficult. No automated decisions with legal effects within the meaning of Article 22 GDPR are taken.

This data is kept only for as long as those purposes require and is then deleted or anonymised.

6. How long we keep it

We keep your data for as long as the relationship lasts and then for the periods the law imposes:

  • Contractual claims: five years, the general limitation period (article 1964 of the Spanish Civil Code).
  • Commercial books and records: six years from the last entry (article 30 of the Commercial Code).
  • Tax records: four years (article 66 of the General Tax Act).
  • Guest register: three years, under Royal Decree 933/2021.
  • Allergies and stay requests: deleted when the stay ends.

When data is corrected or erased it is blocked — kept but not used, except to make it available to courts or public authorities — for the applicable limitation period, as article 32 of the LOPDGDD requires. After that it is deleted.

7. Your rights

You can ask us at any time for:

  • Access: to know what data we hold about you and receive a copy.
  • Rectification: to correct anything wrong or incomplete.
  • Erasure: to delete it, where it is no longer needed or you withdraw your consent.
  • Restriction: to keep it without using it while a disagreement is resolved.
  • Portability: to receive it in a reusable format or have us send it to another controller.
  • Objection: to object to processing based on our legitimate interest, on grounds relating to your particular situation.
  • Withdrawal of consent you have given, without affecting what was done before.

Write to legal@casaarume.com. We will reply within one month. Some requests we cannot grant — erasing the guest register before three years have passed, for instance, because the law requires us to keep it — and in that case we will explain why.

If you are not satisfied, you can complain to the Spanish Data Protection Agency: calle Jorge Juan 6, 28001 Madrid, www.aepd.es.

8. Children

In Spain, children under fourteen cannot give consent on their own behalf (article 7 of the LOPDGDD). Bookings are always made by an adult, who provides the details of everyone travelling with them.

9. Security

The site runs entirely over an encrypted connection and we have put technical and organisational measures in place to protect your data. If a breach nevertheless occurred that posed a risk to you, we would tell you and notify the supervisory authority.

One useful warning: we will never email you asking for your card details or your password. If you receive a message claiming to be from us that asks for them, do not reply — forward it to legal@casaarume.com.

10. Changes to this policy

If we change anything material we will publish it here and, where the change affects you significantly, we will let you know by email. This page always carries the current version.

Last updated: 25 October 2026.

Project co-financed by the European Agricultural Fund for Rural Development · Agader · Deputación da Coruña · Grants and support