Privacy policy and Legal Notice

PRIVACY POLICY

FLATGUEST TURISMO, S.L. informs users of this website about the processing of their personal data, in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).

1. Data controller

Identity: FLATGUEST TURISMO, S.L.
Tax ID (NIF): B-76350727
Address: Avenida Alcalde José Ramírez Bethencourt, 13 - 35004 Las Palmas de Gran Canaria (Las Palmas), Spain
Telephone: +34 744 790 472
E-mail: info@ftsl.pro

2. Data we process

Depending on your relationship with us, we may process: identification and contact data (name and surname, identity document, nationality, date of birth, address, telephone, e-mail); booking data (accommodation, dates, number and details of occupants, preferences, special requests); payment and invoicing data; the image of your identity document and, where applicable, a verification photograph taken during online check-in; browsing data obtained through cookies; and the content of any communications you send us.

The fields marked as mandatory in our forms are necessary for the stated purpose; failure to provide them prevents us from providing the service. If you provide data relating to other occupants, you warrant that you have previously informed them of the content of this policy.

3. Purposes and legal bases

a) Managing the booking, the accommodation contract and assistance during the stay. Legal basis: performance of a contract or pre-contractual measures (art. 6.1.b GDPR).

b) Handling enquiries, information requests and quotations. Legal basis: pre-contractual measures or legitimate interest in responding (arts. 6.1.b and 6.1.f GDPR).

c) Complying with the documentary register and the communication of travellers' data to the competent authorities through the SES.HOSPEDAJES platform, pursuant to Royal Decree 933/2021 of 26 October. Legal basis: compliance with a legal obligation (art. 6.1.c GDPR).

d) Issuing invoices and complying with applicable accounting, tax and tourism obligations. Legal basis: legal obligation (art. 6.1.c GDPR).

e) Verifying identity during online check-in. Legal basis: legal obligation to register travellers and performance of the contract (arts. 6.1.c and 6.1.b GDPR).

f) Managing payments, deposits, incidents, damages and claims, and preventing fraud. Legal basis: performance of the contract and legitimate interest in defending our rights (arts. 6.1.b and 6.1.f GDPR).

g) Sending commercial communications, offers and newsletters. Legal basis: the data subject's consent or legitimate interest in sending information on similar services to previous customers (arts. 6.1.a and 6.1.f GDPR and art. 21 LSSI-CE). You may unsubscribe at any time.

h) Requesting reviews and feedback on your stay and carrying out quality surveys. Legal basis: legitimate interest in improving our services (art. 6.1.f GDPR).

i) Using analytical, personalisation and advertising cookies. Legal basis: consent (art. 6.1.a GDPR and art. 22.2 LSSI-CE), as detailed in the Cookies Policy.

4. Retention periods

Booking data is retained for the duration of the contractual relationship and, thereafter, blocked for the limitation periods applicable to legal actions arising from the contract. Data with tax and accounting relevance is retained for the periods set out in commercial and tax legislation. Data reported under Royal Decree 933/2021 is retained for the three-year period established therein. Images of identity documents and check-in verification photographs are deleted once their purpose has been fulfilled and, at the latest, on the day of departure from the accommodation. Data processed on the basis of consent is retained until such consent is withdrawn.

5. Recipients

Your data may be disclosed to: State law enforcement authorities and tourism and tax authorities, where there is a legal obligation to do so; financial institutions and payment service providers for the management of payments; the owner of the accommodation, where necessary for the provision of the service; and insurance companies and legal and tax advisers in the event of incidents or claims.

In addition, our technology and operational suppliers access the data as data processors under a contract entered into in accordance with article 28 GDPR: the booking management system and web engine, distribution platforms and sales channels, communication and messaging tools, online check-in services, IT hosting services and cleaning and maintenance companies.

Data is not transferred to third parties for purposes other than those stated, nor for commercial resale.

6. International transfers

As a general rule, data is processed within the European Economic Area. Should any of our suppliers process data outside the EEA, such transfer is covered by an adequacy decision of the European Commission or by the Standard Contractual Clauses approved by it, together with any additional safeguards required. You may request information about these safeguards by writing to info@ftsl.pro.

7. Data subject rights

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, and withdraw your consent at any time without affecting the lawfulness of processing carried out beforehand. To do so, write to info@ftsl.pro or to the postal address given in section 1, proving your identity and indicating the right you wish to exercise.

If you consider that your rights have not been properly addressed, you may lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan, 6, 28001 Madrid - www.aepd.es).

8. Security measures

We apply appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including encryption of communications, access control based on the need-to-know principle and training of authorised personnel.

9. Automated decision-making

No automated decisions producing legal effects on the user are taken, nor is profiling with similar significant effects carried out.

10. Minors

The services on this website are not aimed at children under 14. Bookings must be made by a person of legal age, who shall be responsible for the data of any minor occupants provided.

11. Amendments

This Privacy Policy may be updated to reflect regulatory changes or new processing activities. Periodic review is recommended.

Last updated: 16 August 2026.