Privacy Policy

Last updated: 8 March 2026

1. Data Controller

  • Data Controller: Almudena Ruiz de las Peñas
  • Tax ID (NIF): 46830730Q
  • Postal address: Calle Real 34, Lores (La Pernía, Palencia), 34848, Spain
  • Email: hola@cumbresdelores.com
  • Phone: +34 616 090 849

2. Personal data we collect

At Cumbres de Lores we collect personal data that you voluntarily provide through:

  • Contact and booking enquiry form: name, email, phone number, dates of stay, number of guests and message.
  • Email: data included in any communications you send us.
  • Phone: data provided during phone calls.

3. Purpose of processing

We process your personal data for the following purposes:

  • To handle enquiries and bookings.
  • To maintain communication regarding your stay.
  • To comply with applicable legal obligations (guest register, invoicing).
  • To send you commercial communications about our services, only if you have given express consent.

4. Legal basis for processing

  • Performance of a contract: processing is necessary to manage your booking and stay (Article 6.1.b GDPR).
  • Consent: for sending commercial communications (Article 6.1.a GDPR).
  • Legal obligation: compliance with the guest register requirements and tax obligations (Article 6.1.c GDPR).
  • Legitimate interest: to improve our services and manage the commercial relationship (Article 6.1.f GDPR).

5. Retention period

We will retain your personal data for the time necessary to fulfil the purpose for which it was collected:

  • Booking data: for the duration of the contractual relationship and 5 years thereafter (tax obligations).
  • Guest register: 3 years in accordance with current legislation.
  • Commercial communications: until you withdraw your consent.
  • Contact form: 12 months from the last communication if no booking is made.

6. Recipients of the data

Your personal data may be shared with:

  • Law enforcement authorities: mandatory guest register in accordance with current Spanish legislation.
  • Tax authorities: in compliance with tax obligations.
  • Service providers: who assist us in providing the service (hosting, email), under the appropriate data processor agreements.

We do not transfer data internationally outside the European Economic Area.

7. Your rights

You may exercise the following rights in relation to your personal data:

  • Access: to know what personal data we process about you.
  • Rectification: to request the correction of inaccurate or incomplete data.
  • Erasure: to request the deletion of your data when no longer necessary.
  • Objection: to object to the processing of your data in certain circumstances.
  • Restriction: to request the restriction of processing in cases provided for by law.
  • Portability: to receive your data in a structured, commonly used format.

To exercise any of these rights, please email hola@cumbresdelores.com indicating your full name and the right you wish to exercise, attaching a copy of your ID document.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es if you consider that the processing of your data does not comply with current legislation.

8. Security measures

We have adopted the necessary technical and organisational measures to guarantee the security of your personal data, including protection against unauthorised access, alteration, disclosure or destruction.

9. Cookies

This website uses cookies. For more information, see our Cookie Policy.

10. Changes

We reserve the right to amend this Privacy Policy to adapt it to legislative or case-law developments. In the event of significant changes, we will inform you through our website.