{"id":405,"date":"2024-09-01T14:31:09","date_gmt":"2024-09-01T12:31:09","guid":{"rendered":"http:\/\/casaarume.dintea.org\/privacy-policy\/"},"modified":"2026-10-25T17:22:47","modified_gmt":"2026-10-25T16:22:47","slug":"privacy-policy","status":"publish","type":"page","link":"https:\/\/casaarume.com\/en\/privacy-policy\/","title":{"rendered":"Privacy policy"},"content":{"rendered":"\n<section class=\"ar-sec\"><div class=\"ar-wrap\" style=\"max-width:820px\">\n<p class=\"ar-lead\" style=\"font-size:18px;line-height:1.7\">This page explains what personal data we handle when you book or browse <strong style=\"font-weight:500\">casaarume.com<\/strong>, what we use it for, who else sees it, how long we keep it and what you can ask of us.<\/p>\n\n<h2>1. Who is responsible for your data<\/h2>\n<p>Data controller: <strong style=\"font-weight:500\">Dintea Capital, S.L.<\/strong>, the company that operates the rural guest house <strong style=\"font-weight:500\">Arume Rural House<\/strong>.<\/p>\n<ul class=\"ar-lista\">\n<li>Address of the guest house: Catasueiro 42, Outes (A Coru&ntilde;a), Spain<\/li>\n<li>Data protection enquiries: <a href=\"mailto:legal@casaarume.com\">legal@casaarume.com<\/a><\/li>\n<li>General enquiries: <a href=\"mailto:info@casaarume.com\">info@casaarume.com<\/a><\/li>\n<\/ul>\n<p>Given the size and nature of the business we are not required to appoint a data protection officer. The controller answers data protection questions directly, at the address above.<\/p>\n<p>The applicable law is Regulation (EU) 2016\/679 (GDPR) and Spanish Organic Law 3\/2018 on the protection of personal data and the guarantee of digital rights (LOPDGDD).<\/p>\n\n<h2>2. What data we handle<\/h2>\n<p><strong style=\"font-weight:500\">Identification and contact.<\/strong> Name and surname, postal address, telephone, email and the language you write to us in.<\/p>\n<p><strong style=\"font-weight:500\">Booking data.<\/strong> Room, arrival and departure dates, number of guests, booking number, amount and any request you make when booking.<\/p>\n<p><strong style=\"font-weight:500\">Guest register.<\/strong> Spanish law requires us to record and report to the Ministry of the Interior the details of everyone who stays: name and surnames, sex, type and number of the identity document, date of issue, date of birth, nationality, place of residence, telephone, email, arrival and departure dates and, where a minor is travelling, their relationship to the adult. This is <a href=\"https:\/\/casaarume.com\/en\/traveller-registration\/\">Royal Decree 933\/2021<\/a>. <strong style=\"font-weight:500\">We do not ask for or keep a copy or photograph of your document<\/strong>: the rule requires the data to be recorded, not the document to be kept, and holding copies we do not need would run against data protection law.<\/p>\n<p><strong style=\"font-weight:500\">Payments.<\/strong> The charge is processed by our payment provider. We see the amount, the date, the outcome and the last four digits of the card; <strong style=\"font-weight:500\">we never store the full card number or its security code<\/strong>. If you tick the box to save your card, it is the payment provider that holds it, not us.<\/p>\n<p><strong style=\"font-weight:500\">Allergies and dietary needs.<\/strong> Only if you tell us, so that we can get your breakfast right. This is health data and we handle it solely with your consent; we delete it when your stay ends.<\/p>\n<p><strong style=\"font-weight:500\">Browsing.<\/strong> IP address, device and browser type, and the technical cookies needed for the basket, your account and the language you choose.<\/p>\n<p>Other than the allergies you choose to tell us about, we do not handle special categories of data: no ethnic origin, no political or religious views, no trade union membership, no sex life.<\/p>\n\n<h2>3. What we use it for, and on what legal basis<\/h2>\n<p><strong style=\"font-weight:500\">Managing your booking and your stay<\/strong> &mdash; confirming it, charging it, sending you the arrival instructions and looking after you while you are here. Legal basis: performance of the contract.<\/p>\n<p><strong style=\"font-weight:500\">Meeting legal obligations<\/strong> &mdash; reporting the guest register to the Ministry of the Interior, issuing and keeping invoices and meeting tax and accounting duties. Legal basis: legal obligation.<\/p>\n<p><strong style=\"font-weight:500\">Answering your questions<\/strong> through the contact form or by email. Legal basis: performance of the contract or, if you have not booked yet, our legitimate interest in replying to people who write to us.<\/p>\n<p><strong style=\"font-weight:500\">Security and fraud prevention<\/strong> &mdash; protecting the site and detecting fraudulent payments. Legal basis: legitimate interest.<\/p>\n<p><strong style=\"font-weight:500\">Allergies and special requests.<\/strong> Legal basis: your consent.<\/p>\n<p>We do not send marketing emails or a newsletter. If we ever do, it will be with your prior consent and you will be able to unsubscribe at any time.<\/p>\n\n<h2>4. Who else sees your data<\/h2>\n<ul class=\"ar-lista\">\n<li>The <strong style=\"font-weight:500\">Spanish Ministry of the Interior<\/strong>, through the SES.HOSPEDAJES platform, because Royal Decree 933\/2021 requires it.<\/li>\n<li>Our <strong style=\"font-weight:500\">payment provider<\/strong>, which processes the charge and holds the card details. Part of that processing may involve an international transfer, covered by the standard contractual clauses approved by the European Commission.<\/li>\n<li><strong style=\"font-weight:500\">IONOS<\/strong>, which provides the voice assistant that answers one of our phone numbers, on the terms set out in section 5.<\/li>\n<li><strong style=\"font-weight:500\">Dinahosting S.L.<\/strong>, the Spanish company that hosts the website, with servers located in Spain.<\/li>\n<li>Our <strong style=\"font-weight:500\">bank and our accountants<\/strong>, for payment, invoicing and tax purposes.<\/li>\n<li><strong style=\"font-weight:500\">Public authorities and the courts<\/strong>, where the law obliges us to hand data over.<\/li>\n<\/ul>\n<p>We do not sell your data and we do not pass it to anyone for advertising. Those who handle it on our behalf are contractually required to use it only on our instructions.<\/p>\n\n<h2>5. If you call us: the voice assistant<\/h2>\n<p>One of our numbers, <a href=\"tel:+34941689356\">+34&nbsp;941&nbsp;68&nbsp;93&nbsp;56<\/a>, is answered by an AI voice assistant: the IONOS AI Receptionist service, which processes the content of the conversation on our instructions in order to answer, take note or alert us. The system uses automatic speech recognition, language analysis and, where applicable, speech generation.<\/p>\n<p>The conversation may be recorded or transcribed. If so, you are told at the start of the call and you may hang up at any time to avoid it: you can also write to <a href=\"mailto:info@casaarume.com\">info@casaarume.com<\/a>, which we read and answer ourselves.<\/p>\n<p>During the call we process what you say, the technical connection data &mdash; date, time and duration &mdash;, any details you give voluntarily, such as your name or phone number, and the interaction data needed to carry the conversation.<\/p>\n<p>The legal basis is Article 6(1)(b) GDPR where the call serves to prepare or perform your booking, and Article 6(1)(f), our legitimate interest in handling calls efficiently, in all other cases.<\/p>\n<p>To provide the service, IONOS uses sub-processors, mainly for hosting, speech recognition and language analysis, which may process data in the United States. Those transfers rely on the adequacy decision under Article 45 GDPR where the provider is certified under the EU&ndash;US Data Privacy Framework and, failing that, on standard contractual clauses under Article 46(2)(c), with additional safeguards. The requirements of Article 44 are met.<\/p>\n<p>Pseudonymised data may be used for training purposes to improve the system, in such a way that tracing it back to an individual is impossible or very difficult. No automated decisions with legal effects within the meaning of Article 22 GDPR are taken.<\/p>\n<p>This data is kept only for as long as those purposes require and is then deleted or anonymised.<\/p>\n<h2>6. How long we keep it<\/h2>\n<p>We keep your data for as long as the relationship lasts and then for the periods the law imposes:<\/p>\n<ul class=\"ar-lista\">\n<li><strong style=\"font-weight:500\">Contractual claims:<\/strong> five years, the general limitation period (article 1964 of the Spanish Civil Code).<\/li>\n<li><strong style=\"font-weight:500\">Commercial books and records:<\/strong> six years from the last entry (article 30 of the Commercial Code).<\/li>\n<li><strong style=\"font-weight:500\">Tax records:<\/strong> four years (article 66 of the General Tax Act).<\/li>\n<li><strong style=\"font-weight:500\">Guest register:<\/strong> three years, under Royal Decree 933\/2021.<\/li>\n<li><strong style=\"font-weight:500\">Allergies and stay requests:<\/strong> deleted when the stay ends.<\/li>\n<\/ul>\n<p>When data is corrected or erased it is blocked &mdash; kept but not used, except to make it available to courts or public authorities &mdash; for the applicable limitation period, as article 32 of the LOPDGDD requires. After that it is deleted.<\/p>\n\n<h2>7. Your rights<\/h2>\n<p>You can ask us at any time for:<\/p>\n<ul class=\"ar-lista\">\n<li><strong style=\"font-weight:500\">Access:<\/strong> to know what data we hold about you and receive a copy.<\/li>\n<li><strong style=\"font-weight:500\">Rectification:<\/strong> to correct anything wrong or incomplete.<\/li>\n<li><strong style=\"font-weight:500\">Erasure:<\/strong> to delete it, where it is no longer needed or you withdraw your consent.<\/li>\n<li><strong style=\"font-weight:500\">Restriction:<\/strong> to keep it without using it while a disagreement is resolved.<\/li>\n<li><strong style=\"font-weight:500\">Portability:<\/strong> to receive it in a reusable format or have us send it to another controller.<\/li>\n<li><strong style=\"font-weight:500\">Objection:<\/strong> to object to processing based on our legitimate interest, on grounds relating to your particular situation.<\/li>\n<li><strong style=\"font-weight:500\">Withdrawal of consent<\/strong> you have given, without affecting what was done before.<\/li>\n<\/ul>\n<p>Write to <a href=\"mailto:legal@casaarume.com\">legal@casaarume.com<\/a>. We will reply within one month. Some requests we cannot grant &mdash; erasing the guest register before three years have passed, for instance, because the law requires us to keep it &mdash; and in that case we will explain why.<\/p>\n<p>If you are not satisfied, you can complain to the <strong style=\"font-weight:500\">Spanish Data Protection Agency<\/strong>: calle Jorge Juan 6, 28001 Madrid, <a href=\"https:\/\/www.aepd.es\" target=\"_blank\" rel=\"noopener\">www.aepd.es<\/a>.<\/p>\n\n<h2>8. Children<\/h2>\n<p>In Spain, children under fourteen cannot give consent on their own behalf (article 7 of the LOPDGDD). Bookings are always made by an adult, who provides the details of everyone travelling with them.<\/p>\n\n<h2>9. Security<\/h2>\n<p>The site runs entirely over an encrypted connection and we have put technical and organisational measures in place to protect your data. If a breach nevertheless occurred that posed a risk to you, we would tell you and notify the supervisory authority.<\/p>\n<p>One useful warning: <strong style=\"font-weight:500\">we will never email you asking for your card details or your password<\/strong>. If you receive a message claiming to be from us that asks for them, do not reply &mdash; forward it to <a href=\"mailto:legal@casaarume.com\">legal@casaarume.com<\/a>.<\/p>\n\n<h2>10. Changes to this policy<\/h2>\n<p>If we change anything material we will publish it here and, where the change affects you significantly, we will let you know by email. This page always carries the current version.<\/p>\n<p class=\"ar-sm\" style=\"margin-top:28px\">Last updated: 25 October 2026.<\/p>\n<\/div><\/section>\n","protected":false},"excerpt":{"rendered":"<p>This page explains what personal data we handle when you book or browse casaarume.com, what we use it for, who else sees it, how long we keep it and what you can ask of us. 1. Who is responsible for your data Data controller: Dintea Capital, S.L., the company that operates the rural guest house [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"open","template":"","meta":{"footnotes":""},"class_list":["post-405","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/casaarume.com\/en\/wp-json\/wp\/v2\/pages\/405","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/casaarume.com\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/casaarume.com\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/casaarume.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/casaarume.com\/en\/wp-json\/wp\/v2\/comments?post=405"}],"version-history":[{"count":3,"href":"https:\/\/casaarume.com\/en\/wp-json\/wp\/v2\/pages\/405\/revisions"}],"predecessor-version":[{"id":2132,"href":"https:\/\/casaarume.com\/en\/wp-json\/wp\/v2\/pages\/405\/revisions\/2132"}],"wp:attachment":[{"href":"https:\/\/casaarume.com\/en\/wp-json\/wp\/v2\/media?parent=405"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}