Data Processing Agreement
When you use HostFinn to report your guests to SES.HOSPEDAJES, you are the controller of their data and HostFinn is your processor. We store it encrypted, use it only to show it to you and send it to the Ministry when you ask, and delete it when you tell us to.
1. Parties and Roles
Controller: the HostFinn customer who uses the SES.HOSPEDAJES integration to report guests as the operator of the accommodation (“you”).
Processor: CHERT RAZVAN, NIF Z2123957G, Carrer Fra Jaume Torre, 03204 Elche (Alicante), España, operator of HostFinn (“we”). Contact: contact@hostfinn.com.
You accept this agreement in your HostFinn account before you connect your first SES operator. It applies together with our Terms of Service and Privacy Policy.
2. Subject, Purpose and Duration
We process guest data only so that you can meet your obligation to register and report guests to Spain's Ministry of the Interior under Royal Decree 933/2021: we store it in your account, show it to you, check it against the Ministry's rules and send it through the SES.HOSPEDAJES web service.
The agreement lasts for as long as you use the integration, and continues for any data we still hold afterwards until it is deleted.
3. Data and Data Subjects
Data subjects: your guests and, where applicable, the person who books or pays.
Categories of data: first name and surnames, identity document type, number and support number, nationality, sex, date of birth, address, phone and email, relationship to the adult for minors, and booking details (contract date, payment method, dates and times of the stay, rooms, internet). We do not collect card numbers or other payment-card data.
4. Your Instructions
We process the data only on your documented instructions, which are the actions you take in HostFinn: saving data, validating it, sending a communication, cancelling one, turning automatic sending on or off, or deleting data. Data is sent to the Ministry only when you press send or when you have turned on automatic sending for your operator.
We do not use the data for any other purpose: no marketing, no analytics, no profiling and no sale. If we believe an instruction breaks the law, we will tell you.
5. Confidentiality and Security
- Guest data and your SES web-service credentials are stored encrypted. Your SES password is never shown again after you save it.
- Data travels to the Ministry over an encrypted connection whose certificate is verified.
- Each account sees only its own data. We do not keep a copy of the files sent to the Ministry, and our logs contain no guest data.
- Anyone acting for us who could access the data is bound by confidentiality, and accesses it only to give you support you ask for or when the law requires it.
6. Subprocessors
We use one subprocessor for this data: OVHcloud, which hosts our servers in the European Union. We will tell you before adding or replacing a subprocessor; if you object, you can stop using the integration and ask us to delete the data.
The Ministry of the Interior is not our subprocessor: it receives the data from you, through us, because the law requires it.
7. Assistance and Data Breaches
You can view, correct and delete your guests' data in your account, which lets you answer requests from your guests. If you need more help, we will give it.
If we become aware of a personal data breach affecting this data, we will tell you without undue delay, with the information you need to meet your own obligations.
8. Retention and Deletion
The data stays in your account while the booking exists. It is deleted when you delete the booking, or when you ask us to delete it. Copies in server backups disappear as the backups are rotated.
How long you must keep it is your decision as the operator of the accommodation (Royal Decree 933/2021 sets three years). You can mark a booking with “Legal hold” so that it is not removed by any automatic clean-up.
9. Demonstrating Compliance
On request, we will give you the information you need to show that this agreement is being followed, and we will answer reasonable questions from you or from an auditor you appoint, with reasonable notice.
10. Changes
If we change this agreement, we will publish the new version on this page with a new date and ask you to accept it in your account before you continue sending data.