Privacy Policy

Last updated: 5 October 2026

1. Data Controller

  • Data Controller: Almudena Ruiz de las Peñas
  • Tax ID (NIF): 46830730Q
  • Postal address: Calle Real 34, Lores (La Pernía, Palencia), 34848, Spain
  • Email: hola@cumbresdelores.com
  • Phone: +34 616 090 849

2. Personal data we collect

At Cumbres de Lores we collect personal data that you voluntarily provide through:

  • Contact and booking enquiry form: name, email, phone number, dates of stay, number of guests and message.
  • Online pre-booking: name, email, phone number (optional), dates of stay, number of guests, whether you are bringing a dog and message. To check that the email address is yours we send you a single-use code: we do not store the code, only an encrypted fingerprint of it, and also an encrypted fingerprint of your IP address to limit attempts.
  • Email: data included in any communications you send us.
  • Phone: data provided during phone calls.

3. Purpose of processing

We process your personal data for the following purposes:

  • To handle enquiries and bookings.
  • To manage the online pre-booking: checking your email, provisionally holding the dates, sending you the deadline and payment instructions for the deposit and protecting the form against abuse.
  • To maintain communication regarding your stay.
  • To comply with applicable legal obligations (guest register, invoicing).
  • To send you commercial communications about our services, only if you have given express consent.
  • To analyse statistically, through Google Analytics 4, how the website is used and certain interactions, in order to assess its operation, its content and the effectiveness of the contact channels — only if you have consented to analytics.
  • To count how many enquiries we receive each month through the contact form and in which language. We only keep monthly totals (for example, “October: 7 in Spanish, 1 in English”): from your enquiry we only use its language to add one to the month’s total, and we do not keep the time of sending, the stay dates, the number of guests or any other data. This count uses no cookies and does not access your device.

4. Legal basis for processing

  • Performance of a contract: processing is necessary to manage your booking and stay, and for the pre-contractual steps you ask us to take, such as the online pre-booking (Article 6.1.b GDPR).
  • Consent: for sending commercial communications (Article 6.1.a GDPR).
  • Consent (analytics): for non-essential web analytics via Google Analytics 4 (Article 6.1.a GDPR). We do not rely on legitimate interest as the basis for web analytics with Google Analytics 4.
  • Legal obligation: compliance with the guest register requirements and tax obligations (Article 6.1.c GDPR).
  • Legitimate interest: to improve our services, manage the commercial relationship and keep the monthly count of form enquiries described in section 3 (Article 6.1.f GDPR). This basis does not apply to web analytics with Google Analytics 4.

5. Retention period

We will retain your personal data for the time necessary to fulfil the purpose for which it was collected:

  • Booking data: for the duration of the contractual relationship and 5 years thereafter (tax obligations).
  • Guest register: 3 years in accordance with current legislation.
  • Commercial communications: until you withdraw your consent.
  • Contact form: 12 months from the last communication if no booking is made.
  • Online pre-booking: the data are deleted from the web server 90 days after the pre-booking is confirmed, cancelled or the dates are released; if it becomes a booking, they are then kept as booking data. Verification codes and IP fingerprints are deleted within 24 hours.
  • Monthly enquiry count: it holds only totals per month and language, with no data about individuals; we keep it indefinitely for statistical purposes.
  • Web analytics (Google Analytics 4): two distinct periods apply: (a) the browser cookies/identifiers (_ga, _ga_<ID>) expire after 2 years; (b) the data-retention period within Google Analytics is set in the tool itself and is a separate concept. We have set that period to 14 months.

6. Recipients of the data

Your personal data may be shared with:

  • Law enforcement authorities: mandatory guest register in accordance with current Spanish legislation.
  • Tax authorities: in compliance with tax obligations.
  • Service providers: who assist us in providing the service (hosting and email, both with Hostinger), under the appropriate data processor agreements.
  • Content delivery network: the Rates and Contact pages load the date-picker library from jsDelivr, which receives your IP address and browser details in order to serve the file. It processes no other data and stores nothing on your device. See the Cookie Policy for details.
  • Google (Google Analytics 4): provider of the web analytics, acting as a data processor on behalf of Cumbres de Lores. It only receives data if you allow analytics; it is not used for advertising.

Except for web analytics, we do not transfer data internationally outside the European Economic Area (EEA). If you enable analytics, the use of Google Analytics 4 may involve processing of data by Google outside the EEA; Google states that it safeguards such transfers through the EU Standard Contractual Clauses and its certification under the EU–US Data Privacy Framework.

7. Your rights

You may exercise the following rights in relation to your personal data:

  • Access: to know what personal data we process about you.
  • Rectification: to request the correction of inaccurate or incomplete data.
  • Erasure: to request the deletion of your data when no longer necessary.
  • Objection: to object to the processing of your data in certain circumstances.
  • Restriction: to request the restriction of processing in cases provided for by law.
  • Portability: to receive your data in a structured, commonly used format.

To exercise any of these rights, please email hola@cumbresdelores.com indicating your full name and the right you wish to exercise, attaching a copy of your ID document.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es if you consider that the processing of your data does not comply with current legislation.

8. Security measures

We have adopted the necessary technical and organisational measures to guarantee the security of your personal data, including protection against unauthorised access, alteration, disclosure or destruction.

9. Cookies and analytics

By default, this site only stores the choice you make in the cookie notice in your browser; it sets no cookies of its own for other purposes. With your consent, two independent elements are enabled: web analytics (Google Analytics 4), which measures site usage statistically, and the Google map, which may set third-party cookies. Neither is loaded until you allow it. The full detail of categories, providers, cookies and durations is in the Cookie Policy.

Data we never send to analytics. We do not send Google Analytics or any measurement tool data that directly identifies you: name, email, phone, form message, postal address, booking reference or exact stay dates as parameters. Analytics is limited to aggregated or pseudonymised usage information.

Fresh consent when analytics is enabled. When we enable Google Analytics 4, we invalidate any analytics consent obtained beforehand and ask you to decide again, since it may have been given when analytics was not yet identified or active.

10. Changes

We reserve the right to amend this Privacy Policy to adapt it to legislative or case-law developments. In the event of significant changes, we will inform you through our website.