Tesoros del Sur
My bookings

Legal

Privacy policy

Courtesy translation. The Spanish version is the only legally binding one: see the original text.

This text governs the processing of the personal data that the owner of the site collects through tesorosdelsur.es, in accordance with the General Data Protection Regulation (EU 2016/679) and Spanish Organic Act 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights.

Data controller

Covasa Patrimonio SL — Tax ID B88711817 — C/ Real de Anzola, 28, 18291 Anzola, Pinos Puente (Granada), Spain
info@tesorosdelsur.es · +34 958 46 11 92

Purposes of the processing

  • To manage the user's registration and personal area on the website.
  • To process bookings, their payment and the associated operational communications (confirmations, changes, reminders).
  • To carry out the online check-in and the traveller register required of accommodation establishments by Spanish Royal Decree 933/2021.
  • To answer enquiries sent through the contact channels.
  • To compile usage statistics of the site from technical data.

Legal basis

  • Performance of the booking contract (art. 6.1.b GDPR) to process bookings, payments and operational communications.
  • Compliance with legal obligations (art. 6.1.c GDPR): the documentary register of travellers and its communication to the authorities (RD 933/2021), and tax and accounting obligations.
  • Consent (art. 6.1.a GDPR) for registering as a user and for analytics cookies.

Data we process

  • Identification and contact data: first name and surname, email, telephone, postal address.
  • From the traveller register (all guests, companions included): type and number of the identity document, support number, images of the document, sex, date of birth, nationality, relationship in the case of minors, and signature.
  • From the booking and its payment: dates, accommodation, amounts and bank card details, which are processed through a secure payment gateway; we do not store the full card number in our systems.
  • Technical data: IP address (and its approximate location) and cookies (see the cookie policy).

Document verification

The photographs of the identity document provided at check-in are processed with an automatic reading tool to extract the data required by RD 933/2021 and to verify that they are legible. The result can always be reviewed and corrected, and images that do not pass verification are not stored.

Retention

  • Data are kept while the account is active and, afterwards, for the applicable legal periods (tax, accounting). The user may request their deletion at any time by writing to info@tesorosdelsur.es.
  • The traveller register (including the images of the document and the signature) is kept for three years, the period required by RD 933/2021; after that it is deleted.

Recipients

  • SES.HOSPEDAJES (State Secretariat for Security, Spanish Ministry of the Interior): communication of the traveller register, as a legal obligation.
  • The payment institution that processes card payments.
  • Technology providers acting as data processors (hosting of the systems in the EU and automatic document verification), under contract and with safeguards in accordance with art. 28 GDPR.
  • Google Ireland Ltd. (Google Analytics), only if you accept the analytics cookies; this may involve transfers to Google LLC in the USA, covered by the EU–US Data Privacy Framework. See the cookie policy.
  • Apart from those cases, data are not disclosed to third parties unless legally required.

Rights

The user may exercise at any time their rights of access, rectification, erasure, objection, restriction and portability by writing to info@tesorosdelsur.es, enclosing a copy of an identity document. They may also lodge a complaint with the Spanish Data Protection Agency (aepd.es).

Last updated: May 18, 2026