Legal
Privacy Policy
Last updated: 24 August 2026
1. Data controller
- Identity: SANCHO GALICIA, S.L.
- Tax ID: B-80774805
- Address: Paseo de las Delicias, 56, 28045 Madrid, Spain
- Commercial Registry: pending confirmation from the owner
- Contact email: reservas@hotel-sancho.com
2. Purpose of processing
This website has no booking engine or user accounts: the only personal data collected is what the user voluntarily enters into the booking-request form on the Booking request page. It is processed solely to:
- Respond to the enquiry or request for information made.
- Manage the pre-contractual relationship arising from that enquiry (for example, an availability or quote request).
No behavioural advertising or profiling is carried out, and the data is not shared with third parties for commercial purposes.
3. Legal basis
The legal basis for processing is the consent of the data subject (art. 6.1.a of Regulation (EU) 2016/679, GDPR), given expressly by checking the acceptance box for this policy on the booking-request form. Consent may be withdrawn at any time by writing to reservas@hotel-sancho.com, without affecting the lawfulness of processing carried out before its withdrawal.
4. Retention period
Data from the booking-request form is kept only for as long as necessary to handle the enquiry and, at most, 12 months from the last contact, after which it is deleted, unless a longer legal retention obligation applies.
5. Recipients and data processors
Data is not shared with third parties except where legally required. To provide this website’s service, the following data processors are used, under a contract/DPA per art. 28 GDPR:
| Provider | Purpose | Basis/safeguard |
|---|---|---|
| Cloudflare, Inc. | Website hosting (Cloudflare Pages) and sending the booking-request form email to the hotel’s verified address (Cloudflare Email Routing, “send only” mode) | Data processor (Cloudflare’s DPA); international transfer to the US covered by the European Commission’s Standard Contractual Clauses |
| Cloudflare, Inc. — Cloudflare Web Analytics | Aggregate traffic measurement in server/edge mode: no cookies, no persistent identifier, no script runs in the user’s browser | Does not constitute processing of identifiable personal data (aggregate, anonymous metrics) |
No international data transfers other than the one indicated above are carried out, and no third-party analytics, advertising, interactive maps, or CAPTCHA provider is used: the form’s anti-spam validation runs entirely on the hotel’s own server, without sending data to any additional external service.
6. Rights of data subjects
Any person has the right to:
- Access their personal data.
- Rectify inaccurate data.
- Erase their data when it is no longer necessary.
- Restrict or object to processing in certain circumstances.
- Request data portability.
These rights can be exercised by writing to reservas@hotel-sancho.com, attaching a copy of an identity document. The response is free of charge and within the legally established period.
If you consider that your rights have not been properly addressed, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) (www.aepd.es).
7. Source of the data
All data processed comes directly from the data subject, through the website’s booking-request form. No data is obtained from third-party sources.
8. Security measures
Appropriate technical and organisational measures are applied to guarantee the security of the data processed, in accordance with the GDPR and Spanish Organic Law 3/2018 on Data Protection and the Guarantee of Digital Rights (LOPDGDD).