Privacy policy

In accordance with Regulation (EU) 2016/679 of 27 April 2016 (GDPR) and Spanish Organic Law 3/2018 of 5 December on the protection of personal data and the guarantee of digital rights (LOPDGDD), we hereby inform you that personal data collected through the website www.cancalet.com (hereinafter, "the website") is processed by:

• Controller: ESTABLIMENTS CALET, SL
• Tax ID (NIF): B17840190
• Address: Plaça Major, 9 — 17177 Hostalets de Bas, La Vall de Bas (Girona, Spain)
• Email: admin@cancalet.com
• Phone: +34 607 242 171

Can Calet applies the following GDPR principles when processing personal data:

• Lawfulness, fairness and transparency: consent is obtained expressly, with prior information about the processing activities.
• Data minimisation: only strictly necessary data is requested for the intended purpose.
• Storage limitation: data will be kept only for as long as necessary, as indicated for each processing activity.
• Integrity and confidentiality: appropriate technical and organisational security measures are applied to protect data against alteration, loss, unauthorised processing or access.

3.1. Booking and accommodation management

• Purpose: to manage booking requests, formalise the accommodation contract, comply with obligations arising from the stay (invoicing, guest registration with the competent authorities under Spanish Royal Decree 933/2021, among others) and handle queries before or after the stay.
• Legal basis: performance of a contract or pre-contractual measures (Art. 6.1.b GDPR) and compliance with legal obligations (Art. 6.1.c GDPR), including guest registration required by public safety regulations.
• Retention: for the duration of the contractual relationship and, afterwards, during the applicable legal limitation periods (tax, commercial and public safety).

3.2. Contact form

• Purpose: to handle and respond to queries submitted by users through the website contact form.
• Legal basis: consent of the data subject when submitting the request (Art. 6.1.a GDPR).
• Retention: until the query has been handled and, in any case, data may be kept blocked during the limitation periods for potential liabilities.

3.3. Cookies and browsing

• Purpose: to improve the browsing experience, obtain statistical data on website use and, where applicable, display personalised advertising.
• Legal basis: user consent, except for technical cookies necessary for the website to work.
• More information: see our Cookie Policy.

Access to and use of the website, as well as making bookings, is reserved for people aged 18 or over. Can Calet does not knowingly collect data from minors without the consent of their parents or legal guardians.

Users' personal data may be shared with:

• Public administrations, in compliance with legal obligations (e.g., guest registration with the State Security Forces, the Spanish Tax Agency and the Generalitat de Catalunya in tourism matters).
• Service providers acting as processors on behalf of Can Calet (booking management platforms), with whom the corresponding data-processing agreement is signed pursuant to Art. 28 GDPR.

Data will not be transferred to third parties beyond the above cases, except when required by law.

5.1. International transfers

Where any of the providers used by Can Calet is located outside the European Economic Area, international data transfers will take place under the appropriate safeguards provided for in the GDPR (standard contractual clauses, adequacy decisions of the European Commission or other legally provided mechanisms).

Any user may exercise the following rights over their personal data:

• Right of access: to know what data is processed and how.
• Right of rectification: to request the correction of inaccurate data.
• Right of erasure ("right to be forgotten"): to request deletion of data when, among other reasons, it is no longer needed for the purposes for which it was collected.
• Right to object: to object to the processing of one's data.
• Right to restrict processing in certain cases.
• Right to data portability: to receive the data in a structured, commonly used, machine-readable format, or to have it transmitted to another controller.
• Right to withdraw consent at any time, without affecting the lawfulness of processing based on consent prior to its withdrawal.

These rights can be exercised free of charge, providing a copy of an identity document, through:

• Email to: admin@cancalet.com
• Postal mail to: Plaça Major, 9 — 17177 Hostalets de Bas, La Vall de Bas (Girona, Spain)

Data subjects who consider their data protection rights have been infringed may also file a complaint with the Catalan Data Protection Authority (APDCAT) or the Spanish Data Protection Agency (AEPD).

Can Calet has adopted the technical and organisational measures necessary to guarantee the security of personal data and to prevent its alteration, loss, unauthorised processing or access, taking into account the state of the art, the nature of the data stored and the risks to which it is exposed.

Can Calet may operate profiles on social networks (Instagram, Facebook, etc.). The processing of data of users who interact with these profiles is governed by this privacy policy and, in any case, by the terms of use, privacy policies and access rules of the relevant social network.

Can Calet reserves the right to amend this privacy policy to adapt it to new legislation, case law or industry practices. In such cases, any changes will be announced on this page with reasonable advance notice before entering into force.