Technical draft pending legal review. It describes what the system does; a lawyer must review it and complete the items [in brackets] before it is used as the final policy.
What data we process
When you book: first name, last name, email address, phone (optional), identity document (optional), dates of stay, number of guests, the room chosen, the language of the booking and the booking code.
When you write to us through the contact form: name, email address, phone (optional), subject and message.
Technical data: the IP address of the connection, used to limit abusive attempts (automated bookings or messages) and, for hotel staff, in the log of access to the admin panel. The site uses technical session cookies (see below).
We do not ask for payment card details: the site does not charge online.
What we use it for
- Managing your booking and your stay: confirming it, emailing you the voucher, reminding you of your arrival a few days before, cancelling it if you ask, and thanking you after check-out.
- Answering the enquiries you send us.
- Protecting the site against abuse and fraud.
We do not use your data for advertising and we do not sell it.
Legal basis
[To be completed with legal advice: performance of the lodging contract and pre-contractual steps; legitimate interest in the security of the site; legal obligations, for example tax obligations.]
Who we share it with
Only with the providers needed to deliver the service, acting on behalf of the hotel:
- the site's hosting provider [specify];
- the email delivery provider [specify];
- the provider of the hotel's mailbox, which receives booking notices and contact messages [specify];
- Cloudflare, if the site uses its protection or anti-bot verification [specify if applicable];
- Google, only if you choose to show the map or play a YouTube video (see "Cookies");
- WhatsApp, only if you choose to start a conversation from the site.
Some of these providers may store data outside Chile. [Review international transfers with legal advice.]
Cookies
The site only uses technical cookies needed to work: the session cookie and the form-protection cookie (XSRF). We do not use analytics or advertising cookies.
The Google Maps map is not loaded until you ask for it with the "Show map" button; from that moment Google receives your IP address and may use its own cookies.
The same applies to the YouTube videos on the History page: they are not loaded until you press play; from that moment YouTube (Google) receives your IP address and may use its own cookies.
How long we keep it
- Bookings: as long as needed for the stay and to meet legal obligations. [Define the period with legal advice.]
- Contact form messages: [24 months, to be confirmed with legal advice].
- Staff access and activity log: 12 months.
Your rights
You may request access to your data, its rectification or deletion, object to its processing or request a copy, under Chilean personal data protection law. Write to the email address shown under "Data controller". [To be completed with legal advice: response times and how identity is verified.]
Security
The site is published over an encrypted connection (https) [confirm when publishing]. Staff access to the admin panel requires a strong password and, for administrators, two-step verification; their activity is logged. The database and photos are backed up every day [confirm that automatic backups are active on the hosting].
Changes
If this policy changes, we will publish the new version on this page with its update date.