Privacy Policy

Last updated: 17 August 2026

1. Data Controller

  • Data Controller: Almudena Ruiz de las Peñas
  • Tax ID (NIF): 46830730Q
  • Postal address: Calle Real 34, Lores (La Pernía, Palencia), 34848, Spain
  • Email: hola@cumbresdelores.com
  • Phone: +34 616 090 849

2. Personal data we collect

At Cumbres de Lores we collect personal data that you voluntarily provide through:

  • Contact and booking enquiry form: name, email, phone number, dates of stay, number of guests and message.
  • Email: data included in any communications you send us.
  • Phone: data provided during phone calls.

3. Purpose of processing

We process your personal data for the following purposes:

  • To handle enquiries and bookings.
  • To maintain communication regarding your stay.
  • To comply with applicable legal obligations (guest register, invoicing).
  • To send you commercial communications about our services, only if you have given express consent.
  • To analyse statistically how the website is used and certain interactions, in order to assess its operation, its content and the effectiveness of the contact channels — only if you have consented to analytics.

4. Legal basis for processing

  • Performance of a contract: processing is necessary to manage your booking and stay (Article 6.1.b GDPR).
  • Consent: for sending commercial communications (Article 6.1.a GDPR).
  • Consent (analytics): for non-essential web analytics via Google Analytics 4 (Article 6.1.a GDPR). We do not rely on legitimate interest as the basis for analytics.
  • Legal obligation: compliance with the guest register requirements and tax obligations (Article 6.1.c GDPR).
  • Legitimate interest: to improve our services and manage the commercial relationship (Article 6.1.f GDPR). This basis does not apply to web analytics.

5. Retention period

We will retain your personal data for the time necessary to fulfil the purpose for which it was collected:

  • Booking data: for the duration of the contractual relationship and 5 years thereafter (tax obligations).
  • Guest register: 3 years in accordance with current legislation.
  • Commercial communications: until you withdraw your consent.
  • Contact form: 12 months from the last communication if no booking is made.
  • Web analytics (Google Analytics 4): two distinct periods apply: (a) the browser cookies/identifiers (_ga, _ga_<container-id>) have a default duration of 2 years, which the browser may shorten; (b) the data-retention period within Google Analytics is set in the tool itself and is a separate concept. GA4 retention configured to 14 months (user and event data), with no reset on new activity.

6. Recipients of the data

Your personal data may be shared with:

  • Law enforcement authorities: mandatory guest register in accordance with current Spanish legislation.
  • Tax authorities: in compliance with tax obligations.
  • Service providers: who assist us in providing the service (hosting and email, both with Hostinger), under the appropriate data processor agreements.
  • Content delivery network: the Rates and Contact pages load the date-picker library from jsDelivr, which receives your IP address and browser details in order to serve the file. It processes no other data and stores nothing on your device. See the Cookie Policy for details.
  • Google (Google Analytics 4): provider of the web analytics, acting as a data processor on behalf of Cumbres de Lores. It only receives data if you allow analytics; it is not used for advertising.

International transfers

The ordinary processing of your contact and booking data, as well as hosting and email, takes place within the European Economic Area (EEA). If you allow analytics, the use of Google Analytics 4 may involve Google processing personal data outside the EEA where necessary to provide the service.

In its data-processing terms, Google acts as a processor and states that it safeguards such international transfers through the EU Standard Contractual Clauses and, where applicable, other transfer solutions it adopts, including adequacy frameworks in force (such as the EU–US Data Privacy Framework). Under those terms, the contracting entity may be Google Ireland Limited, Google LLC or another Google affiliate, depending on the terms accepted in the account. You can review the detail in Google's data-processing terms and in Google's Privacy Policy.

7. Your rights

You may exercise the following rights in relation to your personal data:

  • Access: to know what personal data we process about you.
  • Rectification: to request the correction of inaccurate or incomplete data.
  • Erasure: to request the deletion of your data when no longer necessary.
  • Objection: to object to the processing of your data in certain circumstances.
  • Restriction: to request the restriction of processing in cases provided for by law.
  • Portability: to receive your data in a structured, commonly used format.

To exercise any of these rights, please email hola@cumbresdelores.com indicating your full name and the right you wish to exercise, attaching a copy of your ID document.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es if you consider that the processing of your data does not comply with current legislation.

8. Security measures

We have adopted the necessary technical and organisational measures to guarantee the security of your personal data, including protection against unauthorised access, alteration, disclosure or destruction.

9. Cookies and analytics

By default, this site only stores the choice you make in the cookie notice in your browser; it sets no cookies of its own for other purposes. With your consent, two independent elements are enabled: web analytics (Google Analytics 4), which measures site usage statistically, and the Google map, which may set third-party cookies. Neither is loaded until you allow it. The full detail of categories, providers, cookies and durations is in the Cookie Policy.

Data we never send to analytics. We do not send Google Analytics or any measurement tool data that directly identifies you: name, email, phone, form message, postal address, booking reference or exact stay dates as parameters. Analytics is limited to aggregated or pseudonymised usage information.

Fresh consent when analytics is enabled. When this version is deployed together with Google Analytics 4, any analytics consent obtained beforehand will be invalidated and you will be asked again, since it may have been given when analytics was not yet identified or active.

10. Changes

We reserve the right to amend this Privacy Policy to adapt it to legislative or case-law developments. In the event of significant changes, we will inform you through our website.