Privacy Policy: Casa Roca Hotel

This Privacy Policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by Espais Roca SL, in respect of your relationship with us as a customer or a potential customer.

As the operator of this website and the Casa Roca Hotel property, we inform you which personal data we collect, what your data is used for, and what it means for you when you use our personalized services. To provide the greatest possible protection for your privacy, we comply with the data protection regulations in accordance with Spanish law (LOPD-GDD) and the General Data Protection Regulation (GDPR).

1. Data Controller and Service Provider

The data controller is Espais Roca SL (B57996704), with its registered address at Llotgeta 4, Palma 07002, Baleares, Spain.

This website is hosted, and the booking engine is provided by Mirai España, SL (B80039340), with its registered office at Fuencarral 6, 4º, 28004 Madrid, Spain. Mirai acts as a Data Processor on behalf of the Hotel for the purpose of managing online reservations.

2. Information We Collect

We will collect personal data on this website and during the booking/check-in process only if you, the user, provide it directly to us (e.g., your name, email address, home address, and telephone number).

2.1 Identification and Stay Data: In compliance with Spanish Citizen Security laws (Ley Orgánica 4/2015), we are legally required to collect identification data from every guest (including full name, date of birth, identity document number, home address and nationality) for the purpose of guest registration with the Spanish authorities (SES.HOSPEDAJES).

2.2 Financial Data: We collect payment information through our secure Payment Service Providers (such as Stripe or Revolut) to fulfil the accommodation agreement. Credit card details provided via the Mirai booking engine are processed using advanced encryption and firewall technology.

2.3 Automated Information: When you visit our website, we automatically collect certain information about your device, including web browser, IP address, time zone, and cookies.

3. Use of Your Information

We use the information we collect for the following purposes:

• Reservation Management: To process, modify, or cancel reservations made through our website or third-party partners.

• Legal Obligations: To fulfill the mandatory reporting of guest data to the Spanish National Police or Civil Guard.

• Contractual Obligations: To provide the accommodation and any ancillary services (tours, transfers, etc.) you have requested.

• Communication: To notify you about changes to our service or website, and to handle any inquiries or complaints.

• Marketing: If you provide explicit consent, to provide you with newsletters or information on products and services similar to those previously purchased.

4. Video Surveillance (CCTV)

The Hotel uses security cameras throughout the common areas and on the exterior of the property to protect guests, staff, and property.

• Retention: In accordance with the Agencia Española de Protección de Datos (AEPD) regulations, video and audio recordings are stored for a maximum period of 30 days.

• Access: Recordings may be accessed by authorized personnel or provided to law enforcement/judicial authorities as part of a legal investigation or security incident.

• Signage: Information posters regarding the existence of CCTV are placed at the entrances of the property as required by Spanish law.

5. Disclosure and Transfer of Your Information

We do not rent, sell, or share user information with third parties except as described in this policy:

• Mirai España, SL: Personal data entered into the reservation form is transferred to Mirai for the purpose of correctly managing your booking.

• Regulatory Bodies: We disclose guest data to the Spanish government and law enforcement authorities to comply with mandatory security reporting.

• Subcontractors: We may transfer data to trusted third-party vendors who assist in website operation, payment processing, review collection, or product delivery. A full current list of such providers is available on request. 

• International Transfers: If our service providers (e.g., cloud storage) are located outside the European Economic Area (EEA), we ensure compliance through Standard Contractual Clauses (SCCs) or other approved safeguards.

6. Your Rights

Under the LOPD-GDD and GDPR, you have the following rights:

• Access: Request confirmation of what personal information we hold relating to you.

• Rectification: Have inaccurate information corrected.

• Erasure (Right to be Forgotten): Request deletion of your data (except where we have a legal obligation to retain it, such as for tax or police records).

• Objection/Restriction: Object to certain types of processing or request restriction of use.

• Data Portability: Receive your data in a structured, machine-readable format.

To exercise these rights, please contact us at: Llotgeta 4, Palma 07002, Baleares, Spain, or email us at hola@casaroca.com.

7. Data Security

We implement strict technical and physical safeguards to prevent data loss, unfair use, alteration, or unauthorized access. Our technology partners also adopt legal protections and technical measures to ensure the protection and confidentiality of the data they process on our behalf.