Privacy Policy

This policy explains how we process the personal data you provide through the Hotel Cortiguera website, its forms and communications relating to enquiries, bookings and hotel services.

Controller and contact
Data controller: Dega Investments, S.L. Spanish tax identification number: B16603862. Contact address: Calle Cacho Regatillo 9, 39350 Cortiguera, Suances, Cantabria, Spain.
Privacy and data rights contact: info@hotelcortiguera.com.

Data we process
We process the identification and contact details you provide, the contents of your enquiry, stay dates, guest numbers and preferences needed to handle bookings, events or other requested services. Where applicable, the billing, payment and statutory guest registration details needed to arrange your stay will be requested.
Browsing may generate technical data such as your IP address and access or incident logs. Mandatory fields are identified on each form. Without that information, we may be unable to handle your request. Do not send identity documents, full payment card details or medical information through free-text fields.
If you provide information about other people, you must be entitled to do so and inform them of this policy. If a service requires health information, for example to arrange a specific adjustment, an appropriate channel will be provided and explicit consent requested where required.

Purposes and legal bases
Enquiries and proposals. We answer requests and prepare quotes or bookings at your request as steps before entering into a contract (GDPR Article 6(1)(b)). General enquiries unrelated to a potential contract are handled on the basis of our legitimate interest in responding to people who contact us (Article 6(1)(f)).
Contracts and legal duties. We manage booked services and related communications to perform the contract (Article 6(1)(b)). We comply with applicable tax, accounting and sector-specific duties on the basis of Article 6(1)(c).
Security. We process only the information needed to protect the website, prevent misuse and address incidents, on the basis of our legitimate interest in keeping our services secure (Article 6(1)(f)). You may object under the conditions set out in the GDPR.
Marketing. If you ask to receive news or offers and give separate consent, we will use your details for that purpose (Article 6(1)(a)). Subscribing is optional. You may unsubscribe through each message or by contacting us.

Who receives your data
Providers of web hosting, maintenance, email, enquiry management and booking services may access data subject to the appropriate contractual data protection terms. Data may also be disclosed to payment providers, professional advisers and authorities where necessary to provide the service or comply with a legal duty.
Necessary information may be shared with providers involved in a service you request. Statutory guest registration duties may require disclosure to competent authorities. If the booking process identifies another entity as controller, its privacy information will be provided before the relevant data is collected.
We will not sell your data. Membership of the same business group does not in itself authorise another entity to use your information for advertising or unrelated purposes.

International transfers
Access to data from outside the European Economic Area, including by technology providers or providers of a service you request, requires a valid basis for an international transfer.
Transfers must rely on an adequacy decision or appropriate safeguards, such as standard contractual clauses, as applicable. GDPR Article 49 exceptions may only be used where their conditions are met. You may ask for information about international recipients and a copy of the applicable safeguards using our privacy contact address.

How long we keep data
We retain enquiries for as long as necessary to answer and follow up on the request. If you enter into a contract, we retain the relevant data during the contractual relationship and afterwards for the statutory retention periods and limitation periods applicable to each type of record.
Data used for marketing communications is retained until you withdraw consent or unsubscribe. Security logs are retained only as long as necessary to detect and resolve incidents. Where required by Spanish law, data is restricted and retained solely to address potential liabilities, then deleted when the applicable periods expire.

Your rights
You may request access to, rectification or erasure of your data, restriction of processing, data portability and the right to object where applicable. You may withdraw consent at any time without affecting the lawfulness of earlier processing.
To exercise your rights, contact the controller using the email or postal address above and explain which right you wish to exercise. We will request further identity information only if there are reasonable doubts about your identity. We will normally respond within one month. If a lawful extension is necessary, we will tell you why and how long it will take.
You may lodge a complaint with the Spanish Data Protection Agency at www.aepd.es, without first having to complain to us.

Automated decisions
Enquiries and quote requests will be handled with involvement from our team. Data from these enquiries will not be used to make decisions based solely on automated processing that produce legal effects or similarly significantly affect you.

Cookies and linked services
Cookies and similar technologies are explained in the website’s Cookie Policy and settings panel. Cookies requiring consent may only be used after that consent has been obtained, and you may change your choices. Sending an enquiry does not mean agreeing to optional cookies or subscribing to marketing.

Updates
We may update this policy to reflect changes to our services or data processing. If a change requires further information or fresh consent, we will provide it before starting the relevant processing.