Privacy policy

1. Data controller

The controller of your personal data is BEMAUS S.L., with tax ID (CIF) B44861656, with registered address at C/Arroyo de la Retuerta 12, 28750 San Agustín de Guadalix, Madrid. Contact: info@lacasadelconvento.com · Phone: +34 91 197 47 25. In compliance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD), we inform you how your data is processed.

2. Data we process

• Identity and contact: first name, surname, email address and phone number.
• Booking data: dates, rooms, services, preferences and any notes you choose to include.
• Tax data: when required by the amount or requested by you, a tax identification document (NIF/NIE/CIF or passport) for issuing the payment document.
• Payment data: payment is processed directly on the bank payment gateway; your card details never pass through or are stored on our servers.
• Traveller registration: for stays, the data required by traveller registration regulations (Royal Decree 933/2021).

3. Purposes and legal bases

• Managing and confirming your booking — performance of the contract (art. 6.1.b GDPR).
• Communicating with you about the booking: confirmations, changes, cancellations and payment documents — performance of the contract (art. 6.1.b).
• Issuing and keeping payment documents and accounting records — legal obligation (art. 6.1.c).
• Complying with traveller registration obligations and reporting to the competent authorities — legal obligation (art. 6.1.c).
• Ensuring platform security and preventing fraud — legitimate interest (art. 6.1.f).
• Sending you our own marketing communications — only with your express consent (art. 6.1.a).

4. Data retention

Data is kept for the duration of the contractual relationship and thereafter for the periods required by tax and accounting regulations (generally four to six years). Traveller registration data is kept for the legally established period (three years). Once these periods expire, the data is deleted or anonymised.

5. Recipients and processors

Your data may be disclosed to: the bank payment gateway that processes the payment; the technology providers strictly necessary to deliver the service (platform hosting, database, transactional email service and the establishment calendar), acting as data processors under contract; and the competent public authorities and law enforcement agencies where required by law (traveller registration). Data is never shared with third parties for commercial purposes.

6. International transfers

Some of the technology providers mentioned may process data outside the European Economic Area. In such cases, the transfer is covered by the safeguards provided in Chapter V of the GDPR (adequacy decision or standard contractual clauses approved by the European Commission).

7. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to info@lacasadelconvento.com from the same email address used for your booking. You also have the right to withdraw consent at any time where processing is based on it, and to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

8. Minors

The establishment is an adults-only property. This platform does not knowingly collect personal data from minors; if a legal guardian detects data relating to a minor, they may request its deletion through the means indicated above.

9. Automated decisions and security

No automated decisions are made and no profiles are built from your data. The platform applies appropriate technical measures (encrypted communications, access control, audit logs) to protect your data against unauthorised access.

10. Cookies and changes

For information on the cookies and storage mechanisms used by this website, see the cookies policy published on this platform. This policy may be updated to reflect legal or service changes; the version published here is always the current one.