Skip to content
Casa Candela, Boutique Hotel Sevilla
ES·EN·FR
Book
10% off on our website with the code CasaCandela10

Privacy policy

We handle your data with care and only for what is necessary. In accordance with the General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD), here is who processes it, why, and what rights you have.

Data controller

What data we process and why

This website has no forms and no user accounts: we only process your data when you give it to us in one of these ways.

  • Enquiries. If you email, message us on WhatsApp or Instagram, or call us, we use your contact details and what you tell us to reply.
  • Room bookings. When you book through our engine we receive your name, contact details, dates, requests and the payment details needed to guarantee the booking. If you book through an agency or platform (for example, Booking.com), it passes us the booking details and handles its own data under its own policy.
  • Your stay. On arrival, the law requires us to record guests’ identity details and report them to the Spanish Ministry of the Interior.
  • Table bookings at Retinta. Name, phone or email, date and number of guests to serve you; and allergies or intolerances only if you tell us.
  • Invoicing. The details needed to issue the invoice and meet our tax and accounting obligations.
  • Browsing. Like any website, the server logs technical data (IP address, browser, pages visited) to serve the site and protect it from abuse. When you view the maps, your browser downloads the images from OpenStreetMap’s servers, which also receive your IP. We use no analytics or advertising.

Legal basis

  • Bookings, stays and table bookings: performance of the contract or of pre-contractual steps you request (Art. 6(1)(b) GDPR).
  • Guest register and invoicing: compliance with legal obligations (Art. 6(1)(c) GDPR), including Spanish Organic Law 4/2015 on public safety and Royal Decree 933/2021.
  • Enquiries: your consent when you contact us (Art. 6(1)(a) GDPR) or, if you ask about a booking, pre-contractual steps.
  • Allergies and intolerances: your explicit consent (Art. 9(2)(a) GDPR).
  • Technical browsing data: our legitimate interest in keeping the website secure and running (Art. 6(1)(f) GDPR).
  • Marketing communications: only with your prior, express consent, which you may withdraw at any time.

How long we keep it

  • Enquiries: as long as needed to reply and, at most, one year afterwards.
  • Bookings and stays: for the duration of the relationship and then for the legal periods: three years for the guest register and up to six years for accounting and tax records.
  • Table bookings: until the booking has taken place, unless the law requires us to keep them longer.
  • Server logs: short periods, unless needed to investigate a security incident.

Who receives it

We do not sell or share your data. It is only received by:

  • The Spanish Ministry of the Interior, which receives the guest register as required by law.
  • The Spanish Tax Agency and other authorities, when required by law.
  • Providers that process data on our behalf, under contract and following our instructions: Little Hotelier (SiteMinder), booking engine and hotel management; Vercel, website hosting; the payment provider for bookings; and our email and messaging services.

International transfers

Some of these providers may process data outside the European Economic Area. When they do, they apply the safeguards required by the GDPR, such as European Commission adequacy decisions or standard contractual clauses.

Your rights

You may at any time request access to, rectification or erasure of your data, object to or restrict its processing, request its portability and withdraw any consent you have given. Write to info@casacandelasevilla.com with the subject “Data protection”; if necessary, we will ask you to verify your identity. We will reply within one month.

If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es).

Minors

We do not collect data from children under 14 without the consent of their parents or guardians. Details of minors staying at the hotel are recorded only as required by law.

Security

We apply appropriate technical and organisational measures to protect your data against loss, unauthorised access or misuse.

Changes

We may update this policy when the law or the way we work changes. The current version is always the one published here.

This is a translation; in case of discrepancy, the Spanish version prevails. Last updated: 10 October 2026.