Privacy policy
Last updated: 07/09/2026
Courtesy translation. In case of any discrepancy between versions, the Spanish text prevails: it is the original version of this document.
1. Who processes your data
| Controller | APLICACIONES SAAS IBERICA, S.L. (NIF B93773620) |
|---|---|
| Address | Avenida Cañada de los Fenicios, Aldea 5, Casa 24, 18150 Gójar (Granada), España |
| Contact | hola@holdesk.es |
| Data protection officer | Appointment is not required. For any privacy matter, write to the address above. |
2. Two different roles, depending on whose data it is
This matters for understanding the rest of the policy:
- We are the controller of the data of people who visit this site, write to us for information, or contract Holdesk as an accommodation business.
- We are the processor of the data of the guests each property manages with Holdesk. In that case the controller is the property itself: we only process that data on its instructions and in order to provide it with the service. If you are a guest and want to exercise your rights, you should address the property you stayed at; if you write to us, we will redirect you to it.
On the booking and check-in screens you will always see the responsible property identified, with its own contact details.
3. What processing we carry out
One by one, with what the law requires you to know about each:
| What for | What data | On what legal basis | For how long | Who else sees it |
|---|---|---|---|---|
| Answering your enquiry by WhatsApp or email | Phone or email, your name if you give it, and whatever we discuss | Your own request, as a step prior to a possible contract | For as long as the conversation lasts, plus the limitation period for claims | WhatsApp Ireland Ltd. if you write through it |
| Handling the contact form on the website | Name, email, phone and property if you give them, whatever you write to us, and the IP address you send from | Your own request, as a step prior to a possible contract | One year from the last contact, unless you become a client | Our contact manager and Google (reCAPTCHA), which only checks that you are not a bot |
| Providing the service if you contract Holdesk | Name, email, hashed password, tax details, activity log | The contract between us, plus tax and accounting obligations | The relationship, plus 6 years (commercial) and 4 (tax) | The server provider |
| Charging your fee and issuing the invoice | Tax details, amounts, line items | The contract and the legal obligation to invoice | 6 years from the last entry | Our accountants and the Spanish Tax Agency |
| Measuring use of the website | Cookie identifier, IP address, pages viewed, device | Your consent. If you do not give it, nothing is activated | 14 months | Google Ireland Limited |
| Serving the website (fonts, styles and icons) | IP address, browser and the page you arrive from | Our legitimate interest in the site displaying correctly | Not retained on our side | Google (fonts) and jsDelivr (styles and icons) |
4. What we process on behalf of the properties
Here we are not the controller: the property is. We set it out anyway so you know what happens to your data when you book with a property that uses Holdesk.
| What for | What data | On what legal basis | For how long |
|---|---|---|---|
| Managing the booking and its history | Name, email, phone, country, language, dates, amounts | The accommodation contract | Whatever the property decides, plus the statutory periods |
| Traveller register (SES Hospedajes) | Sex, date of birth, nationality, document type and number, support number, expiry, address and date of entry | A legal obligation of the property: Royal Decree 933/2021 and Organic Act 4/2015. It is not optional and does not depend on your consent | 3 years, under those same rules |
| Taking payment for the booking by card | Amount, order reference. Holdesk does not store your card number: it is handled directly by the bank's gateway | The accommodation contract and the bank's own obligations | Accounting and claim limitation periods |
| Letting you know if a place frees up (waiting list) | Name, email, phone, the dates you were looking for | Your own request | Until it is dealt with, or until you ask us to delete it |
| Booking emails: confirmation, reminder, arrival instructions and invoice | Name, email, booking details | The accommodation contract | For as long as the relationship with the property lasts |
| Asking you for a review after your stay | Name, email, and the rating and comment you leave | The property's legitimate interest in learning your opinion of a service you have already used. You can decline and unsubscribe in every email | Until you unsubscribe; the review, for as long as it is published |
| Offers and news from the property | Name, email | Your consent, or the prior relationship if you have already stayed. In both cases, with an unsubscribe link in every message | Until you unsubscribe |
Each property decides which modules it uses: not all of these processing activities may take place at yours.
5. Who the data is shared with
We do not sell personal data, nor do we pass it to third parties for their own commercial use. Only the providers we need in order to deliver the service have access to it, each under its own processor agreement:
- Server hosting and email: Dinaserver, with servers in Spain.
- Payment gateway: Redsys and the relevant bank, when payment is taken by card. Holdesk does not store card numbers.
- Measurement: Google Ireland Limited, only if you accept the measurement cookies.
- Contact form protection: Google Ireland Limited, through reCAPTCHA, which only checks that whoever is writing is not an automated program. It activates when you start filling in the form, not before.
- Handling the messages you send us: our own contact manager, hosted in the European Union, where your enquiry stays until we deal with it.
- Fonts, styles and icons: Google Fonts and jsDelivr. Loading them from their servers means those servers receive your IP address. We are migrating them to our own server so that this stops happening.
- Public authorities: the Spanish Ministry of the Interior, through SES Hospedajes, when the property meets its obligation to report travellers.
Google may process data outside the European Economic Area, relying on the standard contractual clauses approved by the European Commission and on the EU–US Data Privacy Framework. All other providers process the data within the European Union.
6. Automated decisions
We do not take automated decisions affecting you, nor do we build profiles. No machine decides whether your booking is accepted, what price you are offered or whether you are put on a list: that is always decided by a person at the property.
7. Minors
This site is not directed at minors and we do not collect their data directly. When a minor stays accompanied, their details are recorded in the traveller report because the law requires the property to do so.
8. Your rights
You may at any time request access to your data, its rectification or erasure, the restriction of processing, portability, and you may object to it. You may also withdraw your consent whenever you wish, without affecting the lawfulness of processing carried out before then.
To exercise them, write to us at hola@holdesk.es stating which right you wish to exercise. We will reply within one month at most, which may be extended by a further two months if the request is complex, telling you beforehand. We charge nothing for this.
If you are a guest and your data is processed by a property using Holdesk, address that property: it is the controller. If you write to us, we will pass your request on and let you know.
If you believe we have not dealt with your request properly, you may complain to the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid).
9. Security
We apply technical and organisational measures to protect the data: traffic encryption over HTTPS, passwords stored with secure key-derivation functions, encryption of external service credentials, access control by roles and permissions, protected session cookies, and an activity log covering sensitive operations.
10. Changes to this policy
If we change this policy, we will publish the new version at this same address and update the date in the heading. If the change is material and affects data we already process, we will tell you.