Data Protection & Privacy
Who is responsible for your data
Casa Rovira is the data controller for the personal data collected through this check-in application.
Legal basis
Your identity, address, and stay details are collected because Real Decreto 933/2021 legally requires registering every traveller with the Mossos d'Esquadra (a legal obligation, GDPR Article 6(1)(c)). Booking and tourist tax details are processed to administer your reservation and the tourist tax owed for your stay (performance of a contract, GDPR Article 6(1)(b)).
Purpose limitation
Your data is used only for guest registration compliance and tourist tax administration. It is not used for marketing, and it is not shared with any third party other than the legally mandated police registration submission (SIP-HOTELS, Mossos d'Esquadra).
Data collected
Identity and document details, postal address, nationality, contact information, and stay dates for each traveller; booking details and tourist tax figures for the reservation as a whole. Identity document images (ID/passport photos) are not collected.
Encryption
All of the data above is encrypted at rest (AES-256-CBC) using keys specific to your booking, so that even access to the underlying storage does not expose it in readable form.
Retention
Traveller registration data and registration-card records are kept for 3 years after your departure date, per Real Decreto 933/2021. Tourist tax invoice records are kept for 4 years after your departure date, per Spain's general fiscal retention period (Ley General Tributaria). Both are deleted automatically once these periods elapse.
Your rights
You may request access to, rectification of, or erasure of your data, as well as restriction of or objection to its processing, and data portability. Erasure requests are honored immediately for any data no longer subject to the legal retention periods above; data still within a mandatory retention period can only be deleted once it elapses.
To exercise any of these rights, contact info@casarovira.es.
You also have the right to lodge a complaint with the Agencia Española de Protección de Datos (AEPD) if you believe your data has been processed unlawfully.