Privacy policy
Last updated: October 2026 · CALAFUSTERETA C.B. · HUTG-059493-42
1. Data controller
CALAFUSTERETA C.B. · tax ID E55343727 · Carrer Pi i Margall, 30, 17600 Figueres (Girona), Spain · info@calafustereta.cat · +34 661 814 272. Given its size it is not required to appoint a data protection officer; please send any question to info@calafustereta.cat.
2. What data we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email, phone, country | Managing the booking, sending the confirmation and coordinating the stay | Performance of the contract (art. 6.1.b GDPR) |
| Dates, accommodation, number of adults, children and babies, notes | Providing the service and calculating the price and tourist tax | Performance of the contract (art. 6.1.b GDPR) |
| ID document, date of birth and details of the other travellers (including the relationship of minors) | Guest register and reporting to the Mossos d'Esquadra (Royal Decree 933/2021) | Legal obligation (art. 6.1.c GDPR) |
| Billing and payment details | Charging, refunding and meeting tax obligations | Contract and legal obligation |
| Card saved with Stripe, if you authorise it when booking | Guarantee for the security deposit: charging proven damage (clause 5 of the terms) | Performance of the contract (art. 6.1.b GDPR) and legitimate interest in claiming damage (art. 6.1.f GDPR) |
| Name, email and message from the contact form | Answering your enquiry | Consent and legitimate interest in replying |
| Email, if you tick the box | Sending you offers and news from Ca La Fustereta | Consent (art. 6.1.a GDPR; art. 21 Spanish e-commerce act) |
| IP address and technical connection data | Website security and abuse prevention | Legitimate interest (art. 6.1.f GDPR) |
| Browsing data (Google Analytics) | Aggregated website usage statistics | Consent (cookies) |
Payments: card details are handled directly by Stripe; we never see or store them (only the last 4 digits and the payment status). If you authorise the card security deposit when booking, Stripe saves the card linked to your booking and we can only use it for the damage charges set out in clause 5 of the terms; it is detached automatically 30 days after check-out, or the day after a cancellation (while a damage claim is open, once it is settled).
Marketing emails: only if you expressly agree. You can unsubscribe at any time with the link in each email or by writing to info@calafustereta.cat.
3. How long we keep it
| Data | Period |
|---|---|
| Guest register (ID document, date of birth, other travellers) | 3 years from the stay (Royal Decree 933/2021); then deleted automatically |
| Booking and billing data | 6 years (Commercial Code and tax law) |
| Contact form enquiries | 1 year from the last message |
| Marketing emails | Until you withdraw consent |
| Technical security logs (IP) | 14 days |
| Web analytics | 14 months |
| Data of payments never completed | Deleted within 1 day |
| Proof of acceptance of the terms (accepted wording, date, IP and browser), damage claims and date changes | 3 years after the stay; then deleted automatically |
| Card saved for the security deposit | Up to 30 days after check-out, or until the day after a cancellation; while a damage claim is open, until it is settled. Then detached automatically |
4. Who we share it with
Data is shared with the authorities only when required by law (Mossos d'Esquadra for the guest register, the Spanish and Catalan tax agencies) and with providers acting as our data processors:
| Provider | Service | Location and safeguards |
|---|---|---|
| OVH SAS | Server running the website and the booking database | France (EU) |
| Stripe Payments Europe Ltd. / Stripe, Inc. | Card payments | Ireland (EU) and USA · EU-US Data Privacy Framework and standard contractual clauses |
| Resend, Inc. | Sending booking emails | USA (servers in the EU) · standard contractual clauses |
| GitHub, Inc. | Encrypted backups (only we hold the decryption key) | USA · EU-US Data Privacy Framework |
| Google Ireland Ltd. / Google LLC | Web analytics, only with your consent | Ireland (EU) and USA · EU-US Data Privacy Framework |
We never sell or share data for marketing purposes. We also handle bookings coming from Airbnb and Booking.com; for those, the platforms are responsible for the data you gave them.
5. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw consent at any time, by writing to info@calafustereta.cat with a copy of your ID. We reply within one month.
If you believe we have not handled your data properly, you can complain to the Spanish Data Protection Agency (aepd.es).
6. Security
- Encrypted connection (HTTPS) across the whole website.
- ID documents and dates of birth are stored encrypted (AES-256) on our server and are never sent by email or to payment platforms.
- Daily encrypted backups.
- Access to the management panel uses a single-use link sent by email, 24-hour sessions and an extra code for any operation involving money.
- Card details never go through our systems.
7. Minors
Only adults can make bookings. The data of travelling minors (including what is needed for the guest register) is provided by the responsible adult, who declares that they hold legal representation or authorisation.
8. Health data
We do not ask for health data. Only if you request a cancellation for force majeure may you send a medical certificate, without a diagnosis; it is treated confidentially and deleted once the request is resolved.
9. Cookies
See our Cookie Policy.
10. Changes to this policy
If we make significant changes, we will announce them on the website and, if you have an active booking, by email.