Privacy Policy – La Escribana

Version of October 2026. This version replaces the policy of January 2019. Download the Privacy Policy (PDF, English) · Versión en español (PDF)

1. Who is responsible for your data

Your data is processed by Persimmon, S.L.U., a Spanish company trading under the registered trade mark La Escribana, with tax identification number B-90352998 and address at Carretera de la Esclusa 9 acc, 41011 Sevilla, Spain. It is registered with the Andalusian Tourism Register under number CR/SE/00027.

You can reach us about anything in this policy, including to exercise your rights, at [email protected] or at the postal address above. Our data protection contact — including our Data Protection Officer — can be reached at the same e-mail address, marking the subject “DPO”.

2. What this policy covers

This policy applies to personal data we process when you visit www.la-escribana.com, when you contact us by form, e-mail, telephone or chat, and when you enquire about, book or stay at the property.

If you book through a platform such as Airbnb, Booking.com, Vrbo, Tripadvisor or Expedia, that platform also processes your data as an independent controller and its own privacy policy applies to that processing. We receive the data needed to manage your stay and, from that point on, we are a separate controller for it. We do not control what the platform does with your data before it reaches us.

3. What we collect

Bookings and stays: name, surname, nationality, date of birth where the registration rules require it, identity document number, e-mail address, telephone number, postal address, the dates and conditions of your stay, the number of guests and their composition, preferences you tell us about, and any special requests.
Payments and deposits: the fact and amount of payments received, the bank account or card details needed to process them, and the settlement of the security deposit. We do not store full card numbers: card payments are handled by the payment provider.
Enquiries and correspondence: what you write to us through the contact form, by e-mail or in the live chat, together with your name and contact details.
Technical data: IP address, date and time of access, the page requested, the referring page, browser and operating system, generated when you browse the site. See section 12 on cookies.

We do not ask for sensitive data (health, religion, political opinions, sexual orientation). If you choose to tell us something of that kind — for example a dietary requirement or an accessibility need — we use it only to accommodate you during the stay, on the basis of your explicit consent, and we do not record it in any other system.

4. Why we process your data, and on what legal basis

To manage your booking and your stay — taking the reservation, confirming it, communicating with you before and during the stay, taking payment, settling the deposit and handling any damage or claim. Legal basis: performance of the contract with you (Article 6(1)(b) GDPR).
To comply with legal obligations — in particular the registration of travellers required by Spanish law (see section 5), invoicing and tax rules, and the prevention of money laundering where it applies. Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR).
To answer your enquiry — before any contract exists. Legal basis: pre-contractual measures at your request (Article 6(1)(b)) and, for enquiries that go no further, our legitimate interest in replying to people who write to us (Article 6(1)(f)).
To keep the site secure and working — technical logs, prevention of abuse and of automated attacks. Legal basis: our legitimate interest in operating a secure service (Article 6(1)(f)).
To defend ourselves against claims — keeping the evidence of a booking and of the communications around it. Legal basis: our legitimate interest in establishing, exercising or defending legal claims (Article 6(1)(f)).
To send you commercial communications — only if you have asked for them. Legal basis: your consent (Article 6(1)(a)), which you can withdraw at any time.

Where we rely on legitimate interest, you may object at any time (section 10). We have weighed that interest against your rights and consider that it does not override them, given the limited data involved and the safeguards described in this policy.

5. Registration of travellers

Spanish law (Royal Decree 933/2021, in force since 2 December 2024, and the Andalusian tourism rules) requires us to register the identity of travellers and to report the stay to the Ministry of the Interior through the SES Hospedaje system. This obliges us to ask every traveller aged 14 or over for their identity document and to record the data it contains, and to report the stay within 24 hours of arrival. We cannot accept a guest who does not provide it.

This processing is a legal obligation, not a choice, and it is not covered by consent. The data is reported only to the authorities, kept only for as long as the rules require, and is not used for any other purpose.

6. Who else sees your data

We do not sell your data and we do not share it for anyone else’s marketing. It is accessible to the following, only as far as necessary:

Our booking management system, which holds reservations, guest records and the associated correspondence. It is operated by a provider established in the United States (see section 7).
Payment and banking providers, which process your card or transfer and the return of the security deposit.
Our live-chat provider, which processes the messages you send through the chat window on the site.
Our hosting provider, which operates the servers on which the site runs, located in the European Union, and Cloudflare, Inc., which provides content delivery, the network tunnel and protection against automated attacks.
Public authorities, where the law requires it: the Ministry of the Interior through SES Hospedaje, the tax administration, and the Guardia Civil or National Police where they lawfully request it.
Our professional advisers, insurers and banks, where needed to handle a claim, an incident or the return of a deposit.

All providers acting on our behalf are bound by a data processing agreement and may use your data only on our documented instructions.

7. Transfers outside the European Economic Area

Our hosting and the live-chat service are provided within the European Union. Our booking management system is operated from the United States, so the data of a booking is transferred outside the EEA. That transfer is covered by the European Commission’s Standard Contractual Clauses and, where the recipient is certified, by the EU–US Data Privacy Framework (adequacy decision of 10 July 2023). Cloudflare is likewise established in the United States and is certified under the same framework. You may ask us for a copy of the safeguards applied by writing to the address in section 1.

8. How long we keep it

Bookings, invoices and payment records: for six years, as required by commercial and tax law, and for as long afterwards as is needed to defend a legal claim.
Traveller registration records: for the period required by the registration rules, and no longer.
Enquiries that do not lead to a booking: twelve months from our last exchange.
Live-chat conversations: twelve months.
Technical logs: no longer than thirty days, except where they must be kept to investigate a security incident.
Marketing consent and communications: until you withdraw your consent or ask us to stop.

When a retention period ends, the data is deleted or irreversibly anonymised.

9. Security

We apply technical and organisational measures proportionate to the risk, including encrypted transmission (HTTPS), restricted and individually attributable access to the booking system, strong authentication, regular updates of the software on which the site and the booking system run, and backups. No system is perfectly secure; if a breach occurs that is likely to result in a high risk to your rights, we will notify you and the Spanish Data Protection Agency as required by Articles 33 and 34 GDPR.

10. Your rights

You may exercise the following rights free of charge, at any time:

Access: to know whether we process your data and to receive a copy of it.
Rectification: to have inaccurate or incomplete data corrected.
Erasure: to have your data deleted where it is no longer necessary, where you withdraw consent, or where the processing is unlawful. This right is limited by the retention duties in section 8 — we cannot delete an invoice we are obliged to keep.
Restriction: to have processing limited while a question about accuracy or lawfulness is resolved.
Portability: to receive the data you provided in a structured, commonly used, machine-readable format, or to have it sent to another controller.
Objection: to object to processing based on our legitimate interest, including the processing of your data for the defence of claims. If you object, we will stop unless we can show compelling grounds that override your interests.
Withdrawal of consent: for anything based on consent, without affecting the lawfulness of what was done before.

Write to [email protected] or to our postal address, stating which right you are exercising and enclosing a copy of a document proving your identity. We answer within one month, extendable by two further months for complex or numerous requests, and we will tell you if we extend.

If you consider that we have not handled your request correctly, you may complain to the Spanish supervisory authority: Agencia Española de Protección de Datos, Calle de Jorge Juan 6, 28001 Madrid — www.aepd.es. You may also complain to the tourism authority of Andalusia about the service itself.

11. Automated decisions

We do not take decisions about you based solely on automated processing, and we do not build profiles for marketing purposes.

12. Cookies and third-party requests

The site sets no advertising, analytics or profiling cookies. What is used is limited to what is necessary or to what you actively start:

Strictly necessary cookies from the site itself (a session cookie when someone logs in to the administration area) and from Cloudflare, which sets a security cookie to tell human visitors from automated traffic. These are exempt from consent under Article 22.2 of Spanish Law 34/2002.
Live chat. The chat window is provided by a third-party service and, when it loads or when you use it, sets its own cookies and receives your IP address. If you prefer to avoid this, write to us by e-mail instead — the contact details are on every page.
Typefaces are served from a third-party font service, which receives your IP address as part of delivering them.

You can block or delete cookies in your browser at any time; blocking the security cookie may prevent some parts of the site from working.

13. Children

The site is not directed at children. We do not process the data of minors except as part of a family booking, where the registration rules require the identity of travellers aged 14 or over to be recorded.

14. Changes to this policy

We may update this policy when the way we operate or the law changes. The version published on this page is the one in force, and its date appears at the top. If a change materially affects how we use data we already hold, we will tell you before it takes effect.

Version of October 2026. It replaces the version of January 2019.