PRIVACY POLICY
Last updated: 11 October 2026
At Casa Buen Camino we process your personal data with respect and in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). This policy explains what data we process, why, for how long and what rights you have.
Summary
- Controller: José María Domínguez Lage (Casa Buen Camino).
- We use your data to manage your booking and stay and to comply with the guest registration required by law.
- We do not sell your data or send you unsolicited advertising.
- We only share it with those the law requires or with providers needed to deliver the service.
- You can exercise your rights by writing to reservas@casabuencamino.com.
1. Data controller
- Identity: José María Domínguez Lage
- Tax ID (NIF): 44090311R
- Postal address: Rego da Raña 23, 15810 Arzúa, A Coruña, Spain
- Email: reservas@casabuencamino.com
- Phone: +34 653 02 98 23
We have not appointed a data protection officer as it is not mandatory; for any question you can contact us using the details above.
2. What data we process, why and on what legal basis
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Managing your booking and stay | Name, contact details, dates, number of guests and communications | Performance of the accommodation contract (Art. 6.1.b GDPR) | During the stay, then blocked until possible liabilities expire |
| Guest registration and entry report to the State Security Forces | Identity, sex, date of birth, nationality, ID document, address, contact details, number of guests and relationship between them, and payment details | Legal obligation (Art. 6.1.c GDPR; Royal Decree 933/2021) | 3 years from the end of the stay, under Royal Decree 933/2021 |
| Invoicing and tax obligations | Identification and transaction data | Legal obligation (Art. 6.1.c GDPR) | Periods set by tax and commercial law (up to 6 years) |
| Answering enquiries by email, phone or WhatsApp | Name, contact details and message content | Pre-contractual measures and legitimate interest in replying (Art. 6.1.b and 6.1.f GDPR) | As long as needed to answer the enquiry and, if no booking follows, up to 12 months |
| Receiving and handing over luggage sent by backpack transport companies | Name, phone number and origin provided by the company or the guest | Performance of the service and legitimate interest (Art. 6.1.b and 6.1.f GDPR) | Until the luggage is handed over |
| Website usage statistics (Google Analytics) | Browsing data pseudonymised through cookies | Consent (Art. 6.1.a GDPR) given in the cookie banner | As per the COOKIE POLICY (up to 2 years) |
Guest registration data is necessary to stay with us: without it we cannot complete the stay. All other data is voluntary. Please provide accurate data; if you give us details of companions, you declare that you are authorised to do so. We do not make automated decisions or create profiles.
3. Security and identity documents
We do not store photographs or photocopies of your identity documents on our own devices, phone galleries or private clouds. Registration is done through the CheckingScan service and any temporary image is deleted from our systems once it is completed. We apply reasonable technical and organisational measures (restricted access, passwords, updates). If a security breach occurred that put your rights at risk, we would notify the Spanish Data Protection Agency within 72 hours and, where appropriate, the people affected.
4. Recipients
Your data may be disclosed to:
- The State Security Forces and the tax authorities, under a legal obligation.
- CheckingScan, the guest registration platform, which acts as a data processor.
- The website hosting and maintenance provider (Hostinger) and the email and messaging providers needed to communicate with you, as data processors.
- WhatsApp (Meta), if you write to us through that channel, under its own terms.
- Booking platforms (Booking.com, Airbnb, Agoda), from which we receive your booking details and which process them under their own policies.
- Google (Google Maps, Google Analytics and Google reviews), only as set out in the COOKIE POLICY and with your consent where required.
Some providers may process data outside the European Economic Area; in that case they rely on appropriate GDPR safeguards (adequacy decision, standard contractual clauses or other valid mechanisms). We do not sell your data or disclose it for commercial purposes.
5. Photographs and social media
We will not publish photographs or videos in which you can be identified without your prior specific consent.
6. Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent given at any time (without affecting the lawfulness of earlier processing), by writing to reservas@casabuencamino.com. We may ask for a copy of an identity document to verify your identity. We will reply within one month, extendable as permitted by law. If you believe we have not handled your rights properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
7. Minors
Data of minors is processed under the same registration obligation and is provided by their parents or guardians.
8. Cookies
The use of cookies is explained in the COOKIE POLICY.
9. Changes to this policy
We may update this policy to adapt it to legal or service changes. The version published at any given time, with its update date, is the valid one.