Privacy Policy

The controller of your personal data is Posada de Los Palacios SLU, with tax ID (NIF) B05765771 and registered address at Calle Navarro Ledesma, 4, 45002 Toledo. For any privacy matter, write to us at admin@posadadelospalacios.com.

We process the data you give us when you use the contact form (name, phone number, email address, postcode and message), when you make a booking (contact details, dates of stay and the information needed to process payment) and when you contact us by email, phone or WhatsApp.

If you accept analytics cookies, we also process data about your browsing for statistical purposes, such as the pages you view, the type of device and your approximate location.

In addition, the law requires us to record certain guest data needed for check-in, such as name, identity document and nationality.

We use your data to answer your enquiries, on the basis of your consent or of pre-contractual measures taken at your request; to manage your booking and your stay, because this is necessary to perform the accommodation contract; and to comply with our legal obligations, such as the traveller register under Royal Decree 933/2021 and our tax and accounting obligations.

If you tick the offers box on the form, we will use your email address to send you offers and news from the Posada, on the basis of your consent. You can unsubscribe at any time using the link included in each email or by writing to us. If the box is not ticked, we will not send you any marketing communications.

We use browsing data to measure use of the website and improve it, always with your consent. You can withdraw it at any time from “Cookie settings” in the Cookie Policy.

We keep enquiry data for as long as necessary to deal with each enquiry. Booking data is kept for as long as our relationship with you lasts and, afterwards, for the retention periods required by law, such as those set by tax legislation.

Traveller register data is kept for three years, in accordance with Royal Decree 933/2021. Data used to send you offers is kept until you unsubscribe. Finally, analytics data is kept for the retention period set in Google Analytics.

Traveller register data is managed with Cloudbeds and passed to the Spanish Ministry of the Interior through its SES.HOSPEDAJES platform, as required by law. We may also disclose data to the tax authorities or other authorities when a law requires us to do so.

Some providers process data on our behalf, always under a contract that obliges them to protect it: Cloudbeds (booking engine and property management), Spaceship (email), Google (Google Analytics, if you accept analytics cookies), Cloudflare (website hosting) and Web3Forms (sending the contact form). If any of them processes data outside the European Economic Area, it does so with the safeguards required by the General Data Protection Regulation.

If you activate the interactive map, Google receives technical data about your connection, such as your IP address, and processes it in accordance with its own privacy policy.

You can access, rectify or erase your data, object to its processing or ask for it to be restricted, request its portability and withdraw any consent you have given us. To do so, write to us at admin@posadadelospalacios.com stating which right you wish to exercise.

If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

We apply appropriate technical and organisational measures to protect your data against loss, unauthorised access or misuse.

Data controller: Posada de Los Palacios SLU

Purpose: To ensure the safety of people, facilities and property by capturing and recording images through 8 video surveillance points located in various common areas of the establishment. No recordings are made in rooms or private spaces.

Legal basis: The controller’s legitimate interest in ensuring the safety of people, facilities and property.

Retention: Images will be kept for a maximum of one month from when they are captured. Where images are recorded that show acts against the integrity of people, property or facilities, they will be kept and made available to the competent authority under the terms and within the periods established by law.

Recipients: Images may be disclosed to the law enforcement agencies and to the courts when there is a legal reason that justifies it.

Rights: Data subjects may exercise their data protection rights by sending a request to admin@posadadelospalacios.com, proving their identity where necessary.